Facebook API platforms: a map of every Meta developer API, what each is for, and how you get in

One API underneath: how the Graph API works

Every Meta platform is the Graph API: a versioned HTTP interface at graph.facebook.com (with graph.instagram.com and graph.threads.net as sibling hosts for the Instagram Login and Threads paths) where nodes are things — a Page, a post, a user, an ad account — edges are the connections between them — a Page’s /feed, a post’s /comments — and fields are the properties you ask for with ?fields=. Reads are GETs, writes are POSTs, and every call carries an access token whose type decides what it can see.

Versions ship a few times a year — v25.0 on 18 February 2026, v26.0 on 29 July 2026 — and each is guaranteed for roughly two years. Deprecations announced with a version usually apply to that version immediately and to all older versions about 90 days later, so “we pinned an old version” buys a quarter, not immunity.

The platforms, one row each

“Platforms” also means something smaller

In an app’s dashboard, Settings → Basic → Add platform lists Website, iOS, Android, Windows, Page Tab and others. Those are the client surfaces your app runs on, and registering one is what lets the SDK for that surface log in. They are unrelated to the API platforms above, but the shared word sends a lot of searches to the wrong documentation.

The access ladder

Every platform shares one path from “I made an app” to “real users can use it”:

1. 1
   Create an app of the right type

   Business apps get the business permissions (Pages, Instagram, WhatsApp, ads); Consumer apps get Facebook Login and user-data permissions. The type cannot be changed later, so pick Business for anything that touches a Page.

2. 2
   Add products and request permissions

   Each product lists the permissions it needs. Request only those. Every extra permission is another App Review item and another reason to be declined.

3. 3
   Build under Standard Access

   Permissions work immediately for anyone with a role on the app — admins, developers, testers — and for the Pages and accounts they own. This is enough to build and demo the whole integration.

4. 4
   Complete Business Verification

   Required for most business permissions before Advanced Access. Upload registration documents for the legal entity behind the app. Days to weeks.

5. 5
   Submit App Review for Advanced Access

   Per permission: a description of how it is used, a screencast of the flow, a privacy policy URL, and for some, a data-handling questionnaire. Expect at least one round of “please show us where in the video this happens”.

6. 6
   Pass Tech Provider verification if you serve other businesses

   Apps that act on behalf of clients — agencies, SaaS tools — are Tech Providers and go through an additional verification. It is also what unlocks higher rate limits on the Marketing API.

7. 7
   Keep passing the annual Data Use Checkup

   Once a year you re-certify how each permission is used. Miss it and the permissions are revoked.

Rate limits: which one applies to your call

Meta has two limit systems and every call falls under exactly one. The response headers X-App-Usage and X-Business-Use-Case-Usage tell you which, and how close you are.

The practical rule: spread reads across the day, batch where the API allows (/?batch=[...] takes up to 50 requests), and use webhooks instead of polling for anything that changes — comments, messages, Page mentions all push. Publishing is rarely the thing that hits limits; polling insights every minute is.

What changed in 2025–26 that will break old code

• Impressions are gone. Instagram removed impressions and Reel plays on 21 April 2025 in favour of views. Facebook Pages began removing page_impressions, post_impressions and page_fans on 15 November 2025, finishing across every version on 15 June 2026, replaced by page_media_view, post_media_view and page_follows.
• Instagram Basic Display API is dead. It shut down on 4 December 2024. Anything reading a personal Instagram account’s media through it has been broken since; the replacement is Instagram API with Instagram Login on a professional account.
• WhatsApp On-Premises API retired in October 2025; the Cloud API is the only path, and pricing moved from per-conversation to per-template-message in mid-2025.
• Advantage+ Shopping and App campaigns can no longer be created or edited through the Marketing API from v25.0, extending to all versions after 90 days.
• Commerce endpoints are being removed with v26.0 and from all versions on 27 October 2026.
• Webhook mTLS moved to Meta’s own certificate authority in 2026; endpoints that pin certificates need the new root in their trust store.

Publishing to a Page, as a worked example

The most common reason to touch the Facebook platform is to post to a Page, and it shows how the pieces fit. Log in with Facebook and the pages_show_list, pages_manage_posts and pages_read_engagement permissions. Call /me/accounts to list the Pages the user admins, each with its own Page access token. Then:

# A text or link post
curl -X POST "https://graph.facebook.com/v26.0/{page-id}/feed" \
  -d "message=We are open late on Saturdays from this week." \
  -d "link=https://example.com/hours" \
  -d "access_token=$PAGE_ACCESS_TOKEN"

# A photo post — a different edge and a different body shape
curl -X POST "https://graph.facebook.com/v26.0/{page-id}/photos" \
  -d "url=https://cdn.example.com/storefront.jpg" \
  -d "message=New hours, same coffee." \
  -d "access_token=$PAGE_ACCESS_TOKEN"

Text goes to /feed, photos to /photos, video to /videos over a resumable upload, Reels to /video_reels with a two-phase start-and-finish. The Pages API also accepts a scheduled_publish_time with published=false, one of the few native scheduling primitives on any social network. What it does not do is keep the Page token alive forever, fan the same post out to five Pages, or reconcile which of them failed — which is the layer a publishing API adds on top.

Where PostMCP fits

PostMCP sits on the Pages and Instagram Platform corners of this map, plus the Threads API. It holds the app registration, the App Review approvals and the Page and Instagram tokens, and exposes publishing to every Page and professional account you connect as one REST call or MCP tool — the /feed-versus-/photos split, the Reels two-phase publish, token refresh and per-Page failure handling included. It does not touch Messenger, WhatsApp, the Marketing API or the Conversions API. For those you build against Meta directly, and the map above is where to start. The Facebook API reference documents what PostMCP does with the Pages API, and the Instagram API and Threads API pages cover the other two.