Facebook Page comments and replies
Use inbox/query, SDK queryInbox or default MCP query_inbox with facebook_posts to discover published posts authored by the connected Page; no post selector is accepted and bodies are opt-in. Native ranking and visibility apply, including an approximate 600 ranked posts/year reference limit; this is not a full archive. Use the returned ID with facebook_comments and facebook_post_id, or facebook_replies plus a top-level facebook_comment_id. The explicit Page connection needs pages_show_list/pages_read_engagement/pages_read_user_content and native moderation access. Current Page identity, exact native post author, comment object and parent are checked. Bodies require include_body:true; missing capabilities/counts remain null. Pages default25/max50, with bound15-minute cursors and no complete-history claim. The same exact query supports opt-in inbox/syncs polling under existing retention and gap limits; message push cannot wake comment trackers. Reviewed comment writes use the separate actions below; attachments and automatic traversal into every child thread are separate. Native approval and staging receipts remain required.
Reviewed Facebook comment actions
Read the selected comment with include_body:true to obtain revision; pass it as expected_revision to inbox/operations or action-enabled MCP reply_facebook_comment, set_facebook_comment_hidden or delete_facebook_comment. Requires inbox:read/inbox:write plus explicit pages_manage_engagement and comment read grants. Supply facebook_post_id, facebook_comment_id, optional facebook_parent_id only for moderating a reply, and a stable Idempotency-Key. Replies require a visible non-private top-level comment and native reply capability; text is1–2,000characters without native Page mentions. Hide/unhide uses hidden and can_hide; delete requires confirm_delete:true and can_remove and may affect descendants. Native identity, object/parent, content revision, capabilities and current credentials are rechecked. All Page comment actions share ordered ambiguity blocking; never resend an uncertain result. These are preflight checks, not native atomic locks. Native approval and live mutation/visibility tests remain required.
Facebook and Instagram message change notifications
Use inbox/operations action enable_message_push for Instagram or enable_facebook_message_push for Facebook (SDK submitInboxOperation; matching MCP enable tools) with replace_native_fields:[messages] and metadata_only:true to explicitly select messages-only native fields. Instagram additionally accepts exactly [messages,messaging_seen] to opt into outgoing read-receipt correlation. Facebook additionally accepts [messages,message_deliveries] for exact-message delivery callbacks; [messages,message_reads] or [messages,message_deliveries,message_reads] explicitly enable inbox.read_watermark events. A Page-scoped participant_reference also appears in authorized Facebook conversation/message participants. Match it within the same connection; keep the greatest native provider_watermark_at when callbacks arrive out of order. observed_at is local receipt time. These are conversation boundaries, never individual read confirmations. The reference is pseudonymous, not anonymous. inbox.message_delivered identifies one successful Techrace reply in the current consent window; provider_watermark_at is the native watermark and observed_at is local receipt time. It does not claim an exact delivery time or a read. Missing mids, unmatched or ambiguous sends produce no delivery event. Existing messages-only registrations stay unchanged. The inbox.message_read event identifies a successful Techrace operation in the same currently authorized connection and registration window, bound to its native message and recipient. An early callback waits for pending send completion; duplicates emit once. Unmatched or ambiguous sends and missing callbacks do not imply read or unread. No callback body or raw participant identifier is stored. Both fields must also be configured in the Meta app. A professional Instagram connection needs basic/manage_messages grants; a Facebook Page needs pages_manage_metadata/pages_read_engagement/pages_messaging. Internal inbox:read and inbox:write are required. The app first needs a verified HTTPS callback and messages setup in Meta. Native subscription and current-credential registration are separate checked steps. Signed incoming notifications first persist private metadata, then background fanout produces deduplicated inbox.changed hints in bounded steps without retaining message text or sender details. A callback acknowledgement confirms durable admission, not customer delivery. Each step rechecks current registration and authority; lost queue sends remain recoverable. Recovery and retention use resumable bounded background work with stale-job protection and operator backlog monitoring. Fetch conversations/messages through the authorized inbox API, or explicitly configure inbox/syncs for periodic observations. Set wake_on_messages:true separately when creating a Facebook/Instagram conversation/message tracker to coalesce verified hints into earlier reads; default false. Both registration and tracker authority remain required, hints during a round schedule another round, and periodic polling continues. This does not reconstruct unavailable history. GET inbox/push/{connection_id} reports current local authority. POST its disable endpoint with customer_id and disable_local_delivery:true removes local delivery and cancels pending enables, without removing a native subscription shared by other projects. Native approval and live delivery tests remain required.
Consent and ownership
Use a Facebook Page connection with observed pages_manage_metadata, pages_read_engagement and pages_messaging grants. Configured permissions do not prove consent. Page identity and two-person conversation membership are checked before data access or replies. Advanced Access and live reviewer evidence are required before third-party customers can use the reviewed permissions.
Durable scoped observations
POST inbox/syncs with an exact inbox query and interval_seconds (300–86400, default900). Requires inbox:read and inbox:sync:write. Bodies require explicit include_body consent. Up to8 trackers per connection share100 encrypted pending batches/10MiB and10000 indexed items. Read/list batches, process them durably using tracker ID/sequence, then acknowledge to release storage. The first full native-page sweep and later sweeps produce observed upserts; missing rows are never inferred deletions. Instagram messages cover at most the latest20. Expired cursors or unacknowledged24hour batches cause an explicit gap and require reviewed replacement. Pause cannot erase that gap. Deletion fences access then purges cached data in bounded steps; no native messages are deleted. SDK and MCP have matching methods/tools, with separate confirmations for ongoing polling, deletion and acknowledgment. New Facebook observations also retain private collecting-grant provenance. An admitted data-deletion request blocks matching body reads and schedules selective removal; affected trackers require reviewed replacement after checkpoint reset. Newer batch bodies are preserved. The callback remains disabled until complete stored-data deletion is qualified.
Read conversations and messages
POST inbox/query with inbox:read, customer_id, connection_id and resource conversations or messages. Only messages accepts a required conversation_id. Text is excluded unless include_body is true. Limit is 1–50, default25. Reuse all inputs with next_cursor; encrypted cursors expire after15minutes and cannot cross customers, Pages or reconnected credentials. Live pages are not a consistent or complete history snapshot. Missing or unverifiable sender/recipient data produces an error instead of invented ownership.
Reply to an existing conversation
POST inbox/operations with inbox:read and inbox:write, an Idempotency-Key, action reply_text, conversation_id, recipient_id, in_reply_to and text. The worker checks the exact inbound anchor among at most250recent messages. The anchor must be less than24hours old with a30second safety margin. in_reply_to establishes eligibility; it does not create a quoted reply. Text is limited to2,000characters; standard RESPONSE messages only. Read content never grants permission to send.
Delivery and recovery
Poll inbox/operations/{id} using inbox:operations:read. Requests expire after15minutes; replies to the same conversation execute in order. Provider acceptance does not confirm recipient delivery. Unknown outcomes block later replies and are never automatically resent. After inspecting the native inbox, an owner/admin with inbox:write and inbox:operations:read may explicitly acknowledge the uncertainty with a short note. Acknowledgment does not retry or convert the outcome to success.
YouTube channel comments
Use inbox/query with youtube_threads (optional youtube_video_id and youtube_moderation) or youtube_replies (youtube_parent_id required). Explicit youtube.force-ssl grants and native channel ownership are required. Body text is opt-in, reply pagination is separate, missing moderation stays null, and held/spam threads may match a reply. Use the comment etag for inbox/operations actions reply_youtube_comment, moderate_youtube_comment, reject_youtube_comment or delete_youtube_comment, also available through SDK and opt-in MCP. Rejection requires confirmation, hides replies and cannot be republished. Deletion requires confirmation and channel authorship. No author bans. All comment writes on the connection share ordering and ambiguity protection. Preconditions are read checks, not native atomic locks. Authorized native recordings and provider review remain required.
Share a Facebook or Instagram image reply
Upload a customer-owned PNG/JPEG image (maximum8MiB), then queue inbox/operations action reply_image using SDK submitInboxOperation or action-enabled MCP reply_facebook_image or reply_instagram_image. Supply media_id, expected_sha256 from the completed upload, confirm_share_media:true, conversation_id, recipient_id, recent inbound in_reply_to and a stable Idempotency-Key. Requires inbox:read, inbox:write and media:write. The worker checks the customer, checksum, storage generation, native ownership, reply window and current authority before sharing a one-hour private download URL with Meta. Instagram image replies require expected_provider:instagram; omission retains Facebook semantics. Each MCP tool pins its named provider. Customer-supplied URLs, video and file replies are unsupported. Pending/uncertain work and61minutes after native start pin the media against ordinary deletion. Native acceptance is not delivery; follow the same ordered ambiguity investigation as text replies. Caller authorization must cover this exact image and recipient.
Explicit conversation mark-seen
Queue inbox/operations action mark_conversation_seen, SDK submitInboxOperation or MCP mark_facebook_conversation_seen / mark_instagram_conversation_seen with conversation_id, recipient_id, anchor_message_id, confirm_mark_seen:true and a stable Idempotency-Key. Omitting expected_provider retains Facebook Page Messenger intent; expected_provider:instagram explicitly selects Instagram Login and its basic/manage_messages grant. The Instagram MCP tool sets that provider itself. It requires inbox:read plus inbox:write and current native messaging grants. The worker verifies a recent inbound anchor, conversation/recipient ownership and current credentials. Techrace uses the same24hour window minus30seconds as replies. The native sender action marks the recipient conversation, potentially including newer messages; the anchor is not a per-message read watermark. No text is sent. Native acceptance does not prove recipient display. Uncertain outcomes block later work in the same conversation until investigation/owner acknowledgment, and are never blindly replayed. Reading inbox data does not authorize a visible read receipt.
Instagram comments and moderation
Use Instagram Login with actual instagram_business_basic and instagram_business_manage_comments grants. inbox/query supports media, comments (media_id required) and replies (media_id plus comment_id). Caption/comment text requires include_body. inbox/operations accepts reply_comment with text, set_comment_hidden with hidden, or delete_comment with confirm_delete=true. Native identity, media owner and comment/media binding are checked before the final credential fence. Replies require a visible top-level comment. Hiding the media owner's comments is rejected. Deletion is permanent. Operations on the same media run in order; unknown outcomes block that media until explicit owner acknowledgment. Each exact action needs customer authorization.
Current boundaries
Instagram Login DMs require instagram_business_basic and instagram_business_manage_messages. Conversations return routing ownership when available. Only the latest20message details are available, with up to4concurrent reads and no message cursor. Replies require an inbound anchor inside24hours minus30seconds, at most1000UTF8bytes, and no other app owning routing. The seven-day ad-entry exception is not implemented. Owned PNG/JPEG replies up to8MiB require explicit media sharing and expected_provider:instagram. Other attachment families, live comment events and delivery receipts remain separate work. Explicit messaging_seen consent enables signed read callbacks correlated to successful Techrace sends; absent callbacks do not mean unread, and unmatched messages or messages before a new consent window are not guessed. Durable explicitly scoped observations and optional messages-only push wake are implemented within the latest20 window. Reads and writes are paused by default. Local fixtures verify contracts and recovery; provider approval and hosted acceptance have not been obtained.
These guides describe implemented code and operating requirements. Enabled capabilities and permissions may differ. Use the current API specification and your project’s capability view.
OpenAPI specification