Meta’s official API lets a business answer an Instagram DM within 24 hours of the customer’s last message, send one private reply to each comment within 7 days (during the broadcast for Live comments), and send text of up to 1,000 bytes per message. Each Instagram professional account can make 2 Conversations API calls per second and 750 private replies per hour to post and reel comments. This page lists every rule we could confirm on Meta’s own developer pages for Instagram, Facebook Pages and Threads, one rule per table row, each with a link to the page it comes from.
Last checked against Meta’s developer documentation in November 2026. Meta changes these rules, as the retired message tags further down show, so follow the source link before you build on a number.
For how these rules shape a comment campaign in practice, see the Instagram comment automation guide.
How to read this reference
Meta offers two main Instagram setups. With the Instagram API with Facebook Login, the Instagram account is linked to a Facebook Page and messages go through the Page. The Instagram API with Instagram Login needs no Page. A third option, Unified Login, is the one Meta recommends for new integrations. Where a number differs between setups, the row says which setup it belongs to.
Every row links to a page on developers.facebook.com. Where Meta states the same rule on several pages, the row links to the most specific one. Times are measured from the event the row names. Rate limits name the unit (per second, per hour, per 24 hours) and what is counted (an Instagram account, a Page, an app).
Messaging windows and message tags
| Rule | Limit | Source |
|---|---|---|
| Standard messaging window | 24 hours, for most user actions | Messaging policy |
| Window after a Click-to-Direct or Click-to-Messenger ad | Up to 7 days from the person’s first message after tapping the ad | Messaging policy |
| Who starts the conversation on Instagram | The Instagram user must message first; only then can the app send a message | Messaging API, Instagram Login |
| Promotional content inside the window | Allowed | Messaging policy |
Human Agent tag (human_agent) |
A human agent can reply within 7 days of the user’s message, in a window separate from the 24-hour one | Instagram Platform overview |
| Allowed use of Human Agent | Human support for issues that cannot be resolved in the standard window, for example when the business is closed for the weekend | Instagram Platform overview |
| How an app gets Human Agent | It is a feature the app requests Advanced Access for in App Review | App Review for Instagram API |
| Content in tagged messages | No promotional content, including deals, offers, coupons and discounts | Send messages |
| Tags used outside approved cases | May restrict the Page’s or Instagram account’s ability to send messages | Send messages |
| Retired tags | From April 27, 2026, requests with CONFIRMED_EVENT_UPDATE, ACCOUNT_UPDATE or POST_PURCHASE_UPDATE return error code 100 |
Send messages |
| Tags on Instagram | Some tags exist only on Messenger, not on the Instagram Messaging API | Messaging policy |
| One-time Notification, news messaging, sponsored messages | Not available on the Instagram Messaging API | Messaging policy |
| Persistent menu tap | Opens the standard window; the business has 24 hours to respond | Persistent menu |
Meta’s policy lists these user actions as ones that open the standard window: sending a message, tapping a call-to-action button such as Get Started, sending a first message after tapping a Click-to-Messenger or Click-to-Direct ad, starting a conversation through a Messenger plugin, tapping an m.me or ig.me link with a ref parameter in an existing thread, and reacting to a message.
What this means for replies after a day has passed, and how the Human Agent tag differs from automation, is covered in replying to Instagram DMs after 24 hours.
Private replies to comments
A private reply is a DM sent to the person who wrote a comment, using the comment’s ID as the recipient.
| Rule | Limit | Source |
|---|---|---|
| Messages per commenter | One message to the person who commented | Private replies, Instagram Messaging |
| Window for comments on posts, ads posts and reels | 7 days from when the comment was created | Private replies, Instagram Messaging |
| Window for Instagram Live comments | Only during the live broadcast; none once it ends | Private replies, Instagram Messaging |
| Comments that qualify | Comments on the account’s posts, reels, stories, Live and ad posts | Private replies, Instagram Platform |
| Follow-up messages | Only after the person responds, and within 24 hours of that response | Private replies, Instagram Platform |
| Where the reply lands | The person’s Inbox if they follow the account, otherwise their Requests folder | Private replies, Instagram Messaging |
| What the reply shows | The message contains a link to the post the person commented on | Private replies, Instagram Messaging |
| Requirements (Facebook Login setup) | instagram_manage_comments and pages_messaging, the Human Agent feature, and Advanced Access |
Private replies, Instagram Messaging |
| Facebook Page: messages per person | One message to a person who posted on the Page or commented on a Page post or comment | Private replies, Messenger |
| Facebook Page: window | 7 days from when the post or comment was created | Private replies, Messenger |
| Facebook Page: recipients | A private reply cannot be sent to another Facebook Page | Private replies, Messenger |
How to send an automatic DM when someone comments on Instagram covers how to write that one message so it works on its own.
Story replies and Story mentions
| Rule | Detail | Source |
|---|---|---|
| How a Story reply arrives | As a messages webhook, like any DM |
Webhooks for Instagram Messaging |
| How a Story mention arrives | As a messages webhook; the account gets a message in its inbox that references the story |
Story mention |
| Tags in regular posts | Do not trigger a webhook; only Story mentions do | Webhooks for Instagram Messaging |
| GIFs and stickers in Story replies | Not supported by the Story replies webhook | Webhooks for Instagram Messaging |
| Mentions from private accounts | Delivered only if the private account follows the business account; mentions from public accounts are delivered | Story mention |
| Storing the story | The media must not be stored or cached on your server; the CDN URL may be stored | Story mention |
| Story lifetime | 24 hours, or until the user deletes it; after that the URL stops rendering | Story mention |
Automating replies to both is covered in Instagram Story reply automation.
Message types and size limits
| Item | Limit | Source |
|---|---|---|
| Text message (Instagram) | UTF-8, 1,000 bytes or less; Meta’s limitations list also says under 1,000 characters | Send a message, Instagram |
| Links | Must be validly formatted URLs | Send a message, Instagram |
| Image | png or jpeg, up to 8 MB | Send a message, Instagram |
| Video | mp4, ogg, avi, mov or webm, up to 25 MB | Send a message, Instagram |
| Audio | aac, m4a, wav or mp4, up to 25 MB | Send a message, Instagram |
| File | pdf, up to 25 MB | Send a message, Instagram |
| Images in one Instagram message | Up to 10 attachment objects | Send a message, Instagram |
| Images in one Messenger message | Up to 30 images | Send messages, Messenger |
| Sharing a post in a DM | The business must own the media it sends | Send a message, Instagram |
| Reusing an upload | Upload once with is_reusable set to true to use the media in several messages |
Attachment Upload API |
| Upload file names | Names with non-ASCII characters are not supported | Attachment Upload API |
| Conversation size | One customer per conversation; group messaging is not supported | Instagram Messaging overview |
| Incoming GIFs and stickers | No webhook is sent | Webhooks for Instagram Messaging |
| Incoming disappearing media | Not supported on Instagram media webhooks | Webhooks for Instagram Messaging |
| Incoming shares | Only the URL of the shared media or post is included | Instagram Messaging overview |
Rate limits
| API | Limit | Counted per | Source |
|---|---|---|---|
| Instagram Platform, all calls except messaging | 4,800 × number of impressions, per rolling 24 hours | App and app user pair | Instagram Platform overview |
| Pages API with a Page or system user token | 4,800 × number of engaged users, per 24 hours | Page | Graph API rate limiting |
| Platform rate limit (user and app tokens) | 200 × number of users, per rolling hour | App | Graph API rate limiting |
| Messenger API (Facebook Page messaging) | 200 × number of engaged users, per rolling 24 hours | App | Messenger Platform rate limits |
| Conversations API | 2 calls per second | Instagram account (or Facebook Page) | Messenger Platform rate limits |
| Send API, text, links, reactions and stickers, Facebook Login setup | 300 calls per second | Instagram account (or Facebook Page) | Messenger Platform rate limits |
| Send API, text, links, reactions and stickers, Instagram Platform page | 100 calls per second | Instagram account | Instagram Platform overview |
| Send API, audio or video | 10 calls per second | Instagram account (or Facebook Page) | Messenger Platform rate limits |
| Private replies to Live comments | 100 calls per second | Instagram account | Messenger Platform rate limits |
| Private replies to post and reel comments | 750 calls per hour | Instagram account | Messenger Platform rate limits |
| Many messages into one thread | The app may be rate limited (no number published) | Thread | Messenger Platform rate limits |
| High volume, Instagram | Above 72,000 messages sent and received, new messages stop showing in the Instagram inbox and the account cannot send until volume drops (Meta gives no time period) | Instagram account | Messenger Platform rate limits |
| High volume, Messenger | Above 40 messages per second, new messages stop showing in the Page inbox and the Page cannot send until volume drops | Facebook Page | Messenger Platform rate limits |
Meta’s two pages give different Send API numbers for text: 300 per second on the Messenger Platform rate limit page, which describes the Page-linked Messenger API for Instagram, and 100 per second on the Instagram Platform overview.
Throttled calls return error code 4 (app), 17 (user), 32 (Pages calls with a user token), 613 (a custom limit for a specific API), 80001 (Page calls with a Page or system user token) or 80002 (Instagram). The X-Business-Use-Case-Usage response header shows how close an app is, including the minutes until calls are no longer throttled. Both are on the Graph API rate limiting page.
Comment moderation
| Action | Rule | Source |
|---|---|---|
| Reply to an Instagram comment | Top-level comments only; a reply to a reply is added to the top-level comment | IG Comment Replies |
| Reply to a hidden comment | Not possible | IG Comment Replies |
| Reply to a Live comment | Not possible in public; send a private reply instead | IG Comment Replies |
| Hide or unhide an Instagram comment | hide=true or hide=false; not supported on Live video comments |
IG Comment |
| Hide the account’s own comment | Comments by the media owner on their own media always stay visible | IG Comment |
| Delete an Instagram comment | Only the owner of the media can delete, even if someone else wrote the comment; not supported on Live video | IG Comment |
| Read Live comments | Only while the broadcast is running | IG Comment |
| Read comments on a post | At most 50 comments per query, top-level only unless replies is requested, no filter by timestamp |
IG Media Comments |
| Turn comments off on a post | POST /<IG_MEDIA_ID> disables or enables comments |
Comment moderation |
| Hide a Facebook comment | is_hidden, which applies to Page comments only |
Graph API Comment |
| Comment as a Facebook Page | Needs pages_manage_engagement, pages_read_engagement and pages_read_user_engagement; commenting as a user returns error 1705 |
Comments and @mentions |
| Hide a Threads reply | /manage_reply hides or unhides top-level replies, and their nested replies with them |
Threads reply management |
| Limit who can reply on Threads | reply_control takes everyone, accounts_you_follow, mentioned_only, parent_post_author_only or followers_only |
Threads reply management |
Hiding at volume is the subject of how to bulk hide bad comments on Instagram.
Webhook fields
| Platform and field | What it reports | Permission (Facebook Login or Unified Login) | Source |
|---|---|---|---|
Instagram comments |
Comments on the account’s media | instagram_manage_comments |
Instagram webhook fields |
Instagram live_comments |
Comments on a Live broadcast | instagram_manage_comments |
Instagram webhook fields |
Instagram mentions |
@mentions of the account | instagram_manage_comments |
Instagram webhook fields |
Instagram messages |
DMs, shares, Story replies and mentions, quick replies, deletions, and the business’s own sent messages (is_echo) |
instagram_manage_messages |
Webhooks for Instagram Messaging |
Instagram messaging_postbacks |
Taps on an ice breaker or a Generic Template button | instagram_manage_messages |
Webhooks for Instagram Messaging |
Instagram message_reactions, messaging_seen, messaging_referral |
Reactions, read receipts, ig.me links with a ref in an existing chat |
instagram_manage_messages |
Instagram webhook fields |
Facebook Page feed |
Posts, comments, reactions and shares on the Page | pages_manage_metadata and pages_show_list |
Webhooks for Pages |
Facebook Page messages |
Messenger DMs to the Page | pages_messaging |
Webhooks for Pages |
Threads replies |
Replies on the user’s Threads posts | threads_basic, threads_read_replies |
Threads webhooks |
Threads mentions |
Public posts that mention the user | threads_basic, threads_manage_mentions |
Threads webhooks |
| Webhook rule | Detail | Source |
|---|---|---|
| Access level for Instagram comments | Advanced Access is required for comments and live_comments |
Instagram webhooks setup |
| Private Instagram accounts | Get no comment or mention notifications; the media owner must be public | Instagram webhooks setup |
| Live comment notifications | Stop when the broadcast ends | Instagram webhooks setup |
| Fields per account | Cannot be chosen per account; every account gets every field the app selected | Instagram webhooks setup |
| Failed deliveries | Retried with decreasing frequency for 36 hours, then dropped; deduplicate on your side | Instagram webhooks setup |
| Response time | Answer every notification with 200 OK within 5 seconds |
Messenger Platform webhooks |
| Signature | Payloads are signed with SHA256 and the app secret, in the X-Hub-Signature-256 header |
Messenger Platform webhooks |
| App status | The app must be published to receive webhooks, whatever its App Review status | Webhooks for Instagram Messaging |
| Creator accounts | Must make one Conversations API request before they can receive webhooks | Instagram Messaging overview |
| Facebook Pages | Notifications arrive only after the Page installs the app through subscribed_apps |
Webhooks for Pages |
| Threads | No notifications for media created by private accounts; the app’s business must be verified | Threads webhooks |
Ice breakers and the persistent menu
| Feature | Limit | Source |
|---|---|---|
| Ice breakers, number of questions | At most 4 | Ice breakers |
| Ice breakers on desktop | Not available | Ice breakers |
| Persistent menu, button types | web_url and postback |
Persistent menu |
| Persistent menu updates | Not in real time; existing chats see a new menu only after the person refreshes their inbox | Persistent menu |
| Persistent menu per person | Cannot be customized per recipient | Persistent menu |
| Persistent menu, version | Meta requires Messenger API support for Instagram v226 or above, on iOS or Android | Persistent menu |
| Persistent menu, number of items | Meta recommends 5 at most (a best practice, not a hard limit) | Persistent menu |
Threads replies API
| Rule | Limit | Source |
|---|---|---|
| Direct messages | The Threads API reference has no messaging endpoint; its endpoints cover publishing, media, reply management, users, locations, insights, oEmbed and debugging | Threads API reference |
| Permissions to reply | threads_basic, threads_content_publish, and threads_manage_replies for replies with reply_to_id |
Create replies |
| Who can reply through the API | The owner of the root post, or an app with threads_keyword_search or threads_manage_mentions |
Create replies |
| Replies per profile | 1,000 per moving 24 hours | Threads overview |
| Posts per profile | 250 API-published posts per moving 24 hours | Threads overview |
| Deletions per profile | 100 per moving 24 hours | Threads overview |
| Text length | 500 characters per text post | Threads overview |
| Call limit | 4,800 × number of impressions per rolling 24 hours, per app and app user pair | Threads overview |
How to auto-reply to comments on Threads puts these to work.
Accounts, access levels and permissions
| Rule | Detail | Source |
|---|---|---|
| Account type | Instagram professional account, for a business or a creator | Instagram Platform overview |
| Facebook Login setup | The Instagram account must be linked to a Facebook Page, and the person must be able to do admin-equivalent tasks on that Page | Instagram Platform overview |
| Choosing a login | An app uses either Facebook Login or Instagram Login, not both | App Review for Instagram API |
| Standard Access | The app can only interact with people who have a role on the app | Instagram Messaging overview |
| Advanced Access | Needed to serve accounts you do not own or manage; requires App Review and Business Verification | Instagram Platform overview |
| App Review | Not required for an app serving only your own business; required for a tech provider serving several businesses | App Review for Instagram API |
| Human escalation | Apps using the Instagram Messaging APIs must offer a path to a human agent | Instagram Messaging overview |
| Bot disclosure | Where the law requires it, automated chats must say they are automated, at the start, after a long gap, and when a chat moves from a person to automation; Meta names California and Germany | Messaging policy |
| Requests folder | Conversations inactive for 30 days are not returned by the API | Instagram Messaging overview |
| Replying from a third-party app | Moves the conversation to the General folder | Instagram Messaging overview |
| Read status | Messages received through webhooks or the API do not show as Read in the Instagram app until a reply is sent | Instagram Messaging overview |
Permission names, by setup:
| Setup | Messaging and comment permissions | Source |
|---|---|---|
| Instagram API with Facebook Login | instagram_basic, instagram_manage_comments, instagram_manage_messages, pages_show_list, pages_read_engagement, Human Agent |
Instagram Platform overview |
| Instagram API with Instagram Login | instagram_business_basic, instagram_business_manage_comments, instagram_business_manage_messages, Human Agent |
Instagram Platform overview |
| Instagram messaging webhooks | instagram_basic, instagram_manage_messages, pages_manage_metadata |
Webhooks for Instagram Messaging |
| Facebook Page private replies and Messenger | pages_messaging |
Private replies, Messenger |
| Threads | threads_basic, threads_content_publish, threads_read_replies, threads_manage_replies, threads_manage_insights |
Threads permissions |
How VivaDialog applies these limits
VivaDialog connects Instagram through Facebook Login, so your Instagram professional account is linked to a Facebook Page and DMs go through that Page. It asks for instagram_basic, instagram_manage_comments, instagram_manage_messages, pages_show_list, pages_read_engagement, pages_manage_metadata and business_management. What each permission is for explains them one by one. On top of Meta’s rules, every automation follows these:
- 24 hours for every automatic reply. An automation never answers a comment or DM older than 24 hours. If Meta refuses a DM because the window has closed, the automation’s History shows “Outside Meta’s 24-hour messaging window”.
- One public reply per item. Each comment or message gets at most one automatic public reply, even when several automations match.
- One private DM per comment. VivaDialog records the private reply it sent, so a second automation on the same comment skips the DM instead of sending one Meta would refuse.
- Live comments get a DM only. On a Live comment an automation sends the private DM and skips the public reply and the hide action, which Meta does not support there.
- Reminders stay inside the window. A reminder DM can be scheduled from 30 minutes to 23 hours after the customer’s message, and it is cancelled if the 24-hour window closes first.
- Story replies and mentions reach automations as messages, and Only from in an automation’s advanced settings limits it to them.
- Threads replies are checked every 5 minutes, replies from one Threads account go out at least 30 seconds apart, and the private DM action is skipped because Threads has no DM API.
- New connections. When an account connected less than 7 days ago sends more than 25 automatic replies and DMs in 24 hours, the Automations page shows a warning. This number is our own cautious choice, not a Meta limit.
How automations work covers each of these in the product. How these limits relate to account safety is in is Instagram comment automation safe?, and the setup steps are in Instagram auto reply: what you can automate and the limits. The Instagram DM automation guide puts the DM rules into a working setup.
Frequently asked questions
How long do I have to answer an Instagram DM through the API?
24 hours from the customer’s last message, for most conversations. A conversation that began with a first message after a Click-to-Direct ad can stay open for up to 7 days. A person on your team can answer within 7 days using the Human Agent tag, if the app has that feature approved.
How many private replies can I send to one Instagram comment?
One. It must go out within 7 days of the comment, or during the broadcast for a Live comment. You can send more messages only after the person answers, and then within 24 hours of their answer.
What is the Instagram DM rate limit?
For the Page-linked setup, Meta lists 2 Conversations API calls per second, 300 Send API calls per second for text, 10 per second for audio or video, and 750 private replies per hour to post and reel comments, each per Instagram account. The Instagram Platform page lists 100 per second for text.
How long can an Instagram DM sent through the API be?
1,000 bytes of UTF-8 text. Images can be up to 8 MB, and video, audio and PDF files up to 25 MB.
Can I hide or delete comments on an Instagram Live?
No. Meta’s API does not support hiding, deleting or replying in public to comments on a Live video. A private reply to the commenter works during the broadcast.
Is there an API for Threads DMs?
No. The Threads API covers posts, replies, mentions and insights, with no messaging endpoint.
VivaDialog is in early access right now, and participants get the Growth plan free for 30 days. The pricing page has the details.