Limits and conventions

Request and content limits, pagination, dates and time zones, ids, versioning and the conventions that hold across every route.

Request limits

Counted per credential per minute. Details and the full table are in Authentication.

Bucket	Limit
Default	300/min
`POST /v1/media`	60/min
Account routes (Bearer)	60/min
Create key	10/min
Public routes	60/min per IP

Headers on every response: x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-reset (seconds until the bucket resets). Past the limit: 429 RATE_LIMIT_KEY.

Content limits

Rule	Value
Caption	up to 2,200 characters
Media items per post	1 to 10; Story exactly 1
Accounts per post	1 to 5
Image	JPEG, PNG or WebP; up to 8 MB; 320 to 1920 px wide; feed 320 to 1440 px and aspect ratio 4:5 to 1.91:1
Video	Reel up to 15 min and 300 MB; Story and carousel item up to 60 s and 100 MB
Scheduling	1 minute to 75 days ahead
Posts per account	100 every 24 hours (Meta's quota)
Profile name	up to 120 characters; description up to 500
Key name	up to 60 characters
`idempotencyKey`	up to 128 characters

Pagination

Listings (/v1/connect/integrations, /v1/posts) use limit and offset and return total so you know when to stop.

Parameter	Default	Range
`limit`	20	1 to 100
`offset`	0	≥ 0
`sort`	`desc`	`asc` or `desc`, by creation date

Listing shape

{ "success": true, "total": 137, "integrations": [ … ] }

GET /v1/profiles returns every profile at once, without pagination.

Dates and time zones

Every date in the API is ISO 8601. On input, scheduledFor accepts Z or an explicit offset (-03:00); without one of them the request is rejected.
On output, every date is UTC with Z.
timezone (IANA, such as America/Sao_Paulo) is stored with the post so you can display the local time. It does not convert scheduledFor: the instant is what the offset date says.

Identifiers

Ids are opaque strings with a prefix that tells the type: proj_, prf_, int_, post_, tgt_, med_, key_. Do not rely on the format beyond the prefix.

profileId="null" (the literal string) in listings means "without a profile". In responses, a field with no value comes as JSON null.

Route conventions

/v1 prefix on every route.
The trailing slash is optional: /v1/posts and /v1/posts/ are the same route.
Success responses carry success: true; creation answers 201; acceptance for background processing answers 202.
An unknown route answers 404 NOT_FOUND in the same error envelope. Without a credential, the 401 comes before the 404.
CORS is enabled for the dashboard only. Browser calls with x-access-key are blocked on purpose.

Versioning

The version lives in the path (/v1). Within it, changes are additive: new fields may appear in responses at any time, and your client should ignore what it does not know. Removing a field, changing a type or the meaning of a code only happens in a new path version, with advance notice.

The OpenAPI spec is generated from the routes themselves on every deploy and is the authoritative description of the contract.