Hootsuite API in 2026: Access, Limits and Publishing

Hootsuite's API overview describes a REST/JSON API that works on the same data as the dashboard: a message you schedule through the API shows up in the Hootsuite planner, and the other way around. It sits next to an iFrame SDK for apps that run inside the dashboard, and webhooks for message state changes. The API is split into these parts:

The publishing side is small. The REST API reference exposes POST /v1/messages to schedule, endpoints to list, read and delete messages, approve or reject messages that are pending review, upload media, and list social profiles. There is no endpoint to connect a new social account: that happens in the dashboard.

The API itself is. Hootsuite's developer FAQ says the REST endpoints and the SDK are free for anyone with approved developer access, and there is no per-call price. What you pay for is the Hootsuite account the API acts on. The overview asks for an active Hootsuite user account plus a developer account, and the Hootsuite plans page lists paid plans from $99 (Standard, up to 10 social accounts) through $199 (Professional) to $399 (Advanced) per user per month, with a 14-day trial and custom Enterprise pricing.

So "free API" really means free on top of a seat. That works when you are automating your own team's Hootsuite. It changes the math when you want to post on behalf of your customers, because each of them would need their own Hootsuite account for the API to reach their profiles.

Hootsuite does not hand out a single API key. You get a client ID and client secret for an app, and exchange them for short-lived access tokens. Going by the developer docs, the path looks like this:

1. Sign in to Hootsuite with the member account you will use. Hootsuite suggests a service account that is not tied to a real person for single-company integrations.
2. Open the Hootsuite developer portal and join the developer community. The first visit triggers a developer review, and you get an email when the account is approved.
3. Create an app. On its Security section, Rest API tab, copy the client ID and client secret and enable the scopes you need.
4. Add your redirect URIs under App directory, Developer apps, your app, Security. They must start with https:// or http://localhost, and you can register several for local, staging and production.
5. For a private, single-company integration, install your own app from the App Directory. That is enough: you only go through Hootsuite's app review if you want the app listed publicly for other Hootsuite users.

One trap: once an app is In Review or Launched, you can no longer edit redirect URIs yourself and have to ask Hootsuite developer support.

Authentication is OAuth 2.0 against platform.hootsuite.com, and every token inherits the permissions the member has in the dashboard. The authentication guide lists four grant types:

• authorization_code: the standard three-legged flow for a web app where a Hootsuite user signs in and approves.
• refresh_token: swaps a refresh token for a new access token and a new refresh token.
• member_app: gets a token for a member who has your app installed, using only your client credentials and their member ID. This is the simplest option for internal jobs.
• organization_app: the same at organization level. Hootsuite configures the installation, and some uses require the Enterprise plan.

# 1. Send the Hootsuite user to the consent page
https://platform.hootsuite.com/oauth2/auth
  ?response_type=code
  &client_id=$CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &scope=offline

# 2. Exchange the code (it expires after 10 minutes)
curl -X POST https://platform.hootsuite.com/oauth2/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=$CODE" \
  -d "redirect_uri=https://yourapp.com/callback"
# -> access_token, expires_in: 3599, refresh_token (single use)

Access tokens last an hour (expires_in: 3599 in the REST API FAQ). Refresh tokens do not expire, but each one works only once. If two refresh jobs run in parallel, one of them fails, and if you keep the wrong token the user has to authorize again. Store the new refresh token in the same transaction that uses the old one; our guide to refresh token rotation covers the locking pattern.

Hootsuite's rate limit page sets 20 requests per second and a daily quota of 100,000 calls. Responses carry X-Account-Quota, X-Account-Quota-Used and X-Account-Rate-Limit-Requests-Remaining. The remaining-requests header is counted per node, so Hootsuite tells you to treat it as a guide only. Going over either limit returns HTTP 429 with error code 1003, "Account plan limit exceeded", and you have to wait out the window.

Those limits are generous for scheduling. The analytics endpoints are where batching bites: at most 10 social profile IDs per call, 100 results per page, and data going back two years.

Scheduling takes up to four calls: find the social profile ID, request an upload URL, upload the file, and create the message. The flow below follows Hootsuite's message scheduling and media upload guides.

# 1. List the social profiles this Hootsuite member can post to
curl -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://platform.hootsuite.com/v1/socialProfiles

# 2. Ask for an upload URL with the exact file size
curl -X POST https://platform.hootsuite.com/v1/media \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"sizeBytes": 8036821, "mimeType": "video/mp4"}'
# -> uploadUrl (valid ~599 s), id

# 3. PUT the file to uploadUrl, then poll GET /v1/media/{id} until state is READY

# 4. Schedule the message (UTC, ending in Z; video needs 15+ minutes of lead time)
curl -X POST https://platform.hootsuite.com/v1/messages \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Launch day",
    "socialProfileIds": ["115185509"],
    "scheduledSendTime": "2026-11-20T14:00:00Z",
    "media": [{ "id": "aHR0cHM6Ly9ob290c3VpdGUtdmlkZW8..." }]
  }'
# -> { "data": [{ "id": "3681703710", "state": "SCHEDULED", ... }] }

Use the Hootsuite profile id from /v1/socialProfiles, not the socialNetworkId, which is the network's own ID; the guide calls this out explicitly. A message moves through the states SCHEDULED, SUBMITTED, PENDING_APPROVAL, SENT, REJECTED and SEND_FAILED_PERMANENTLY, and you can pass webhookUrls on the message to be told when the state changes instead of polling.

Most failed first attempts come from a short list of rules buried in the guides:

• Time format. scheduledSendTime must be UTC in ISO 8601 and end in Z. Offsets like -03:00 are rejected on purpose.
• Lead time. Messages need at least 5 minutes in the future, and messages with video at least 15. Hootsuite suggests an hour for large videos or when an approval step is involved.
• Media not ready. A 5000 unknown error after attaching a fresh upload usually means processing has not finished. Check GET /v1/media/{id} until it reports READY.
• Upload details. The upload URL expires in about ten minutes, and the Content-Length of your PUT must match the sizeBytes you declared. Accepted types are mp4 and mov for video, gif, jpeg, jpg and png for images. Custom video thumbnails are not supported.
• Redirect URI. unknown_redirect_uri means the URI is not registered on the app, character for character.
• member_app errors. "The request could not be authorized" means the member in member_id has not installed your app.

Instagram is the one area where the docs disagree with each other. The general developer FAQ still says posting to Instagram Business profiles is not supported, while the REST API FAQ marks that error as deprecated and says scheduling to Instagram Business profiles has been supported since 2024. Test with a real business profile before you promise it to anyone.

The social profile object in the reference lists Facebook, Facebook Page, Instagram, Instagram Business, LinkedIn, LinkedIn Company, Pinterest, Threads, TikTok Business, X (Twitter), WhatsApp and YouTube channel types. Listing a profile type is different from publishing to it: the API overview states that the Publishing API does not support TikTok, YouTube or Bluesky. You can read a TikTok or YouTube profile through the API and still not be able to schedule a message to it.

If short video matters to your product, that gap decides the question by itself. TikTok and YouTube Shorts each have their own posting API with its own review, and our list of every platform with a posting API shows what each one takes to get access.

For automating your own social team, yes, and it is a sensible choice if you already pay for Hootsuite: push posts from a CMS, a spreadsheet or an approval tool into the calendar your marketers already use, and let Hootsuite's approval flow sit in the middle.

For a product that posts on behalf of your own customers, it is the wrong shape. Every end user has to be a Hootsuite member who connected their accounts inside Hootsuite, signs in on Hootsuite's consent screen, and pays for a Hootsuite seat. Your product becomes a front end for someone else's dashboard, without TikTok or YouTube. We go through that difference in more depth in social media API aggregator vs. management tool, and the cost side in build vs. buy for social media APIs.

That multi-customer case is what a developer-first posting API handles. With PostGate, your users connect their accounts through a hosted OAuth page under your product, one request publishes or schedules to several profiles, including TikTok, YouTube and Bluesky, and you read the delivery result for each destination. If you are comparing the two directly, the Hootsuite and PostGate comparison lays out the differences.