PostEverywhere API Reference
Public v1 API for PostEverywhere — schedule and publish content across social platforms (X/Twitter, Instagram, Facebook, LinkedIn, YouTube, TikTok, Threads, Pinterest, Bluesky, Telegram, Discord).
New here? Start with the Quick Start (first post in 5 minutes) and Authentication. Platform-specific behavior lives in the Platform Guides, and media constraints in Media Requirements.
Authentication
All endpoints (except the device-login pair under /auth/device) accept an
API key in the Authorization header:
Authorization: Bearer pe_live_...
Keys are created in the dashboard (Developers) or minted by the CLI device
flow (POST /auth/device → POST /auth/device/token). Keys carry scopes
(read, write, ai); each operation's required scope is noted via
x-scope. A missing scope returns 403 insufficient_scope. A browser
session cookie also works as a fallback for interactive testing; scopes are
then implicitly read, write, ai and API-key rate limits are skipped.
Auth failures return 401 with codes invalid_api_key, api_key_revoked,
or api_key_expired. Organizations without an active subscription receive
402 subscription_required (the error object additionally carries
subscription_status).
Response envelope
Every endpoint responds with the same JSON envelope:
{ "data": { ... }, "error": null, "meta": { "request_id": "1a2b3c4d", "timestamp": "2026-07-08T09:00:00.000Z" } }
On failure data is null and error is populated:
{ "data": null,
"error": { "message": "...", "code": "validation_error", "retryable": false, "details": { } },
"meta": { "request_id": "1a2b3c4d", "timestamp": "..." } }
error.retryable is true for transient failures (HTTP 5xx and 429) and
false for permanent ones — clients should not blindly retry 4xx.
Exception: the auth layer's own 401/402 responses omit retryable and
meta.request_id (they carry only meta.timestamp).
Rate limiting
API keys are limited to 60 requests/minute and 1,000 requests/hour.
When the API-key limit is hit the 429 response includes
X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset
(unix seconds) headers. Every 429 (including posting-budget and
AI-budget limits, which are separate from the API-key limit) includes a
Retry-After header (seconds, default 30).
Posting budgets (per user): immediate publishes 20/min, 200/hour,
1,000/day; scheduled posts 100/min, 1,000/hour with no daily cap.
Media uploads: 60/hour, 300/day (counted at /media/{id}/complete or
/media/upload-from-url, not at presign).
Timestamps
All timestamps are ISO 8601. scheduled_for request values without an
explicit offset are interpreted as UTC. The timezone field is display
metadata only — it never changes when a post fires.
Authentication
- HTTP: Bearer Auth
API key created in the dashboard (Developers) or via the device-login
flow. Keys start with pe_live_ and carry scopes (read, write, ai);
only a SHA-256 hash is stored server-side. See each operation's
x-scope for the scope it requires.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | pe_live_... |