Sync contacts, handle direct messages and comments, and read existing flow analytics. Flow creation and editing are outside this API.
Authentication
Create an integration with selected pages and permissions in API integrations. Send the token in the Authorization header as Bearer. Tokens expire after one year and can be rotated or revoked in the dashboard.
The page parameter is the internal page ID, distinct from the Instagram page_id. Read conversation_key from the conversations list and URL-encode it in paths.
Pagination
Lists return items in data. Set per_page from 1 to 100 and pass meta.next_cursor as cursor for the next page. Single-resource responses also use data.
Request filters
done and updated_since; comments accept media_id and parent_id. Analytics accepts period=7
Sending replies
Send message text up to 1,000 characters. If delivery is uncertain, check the inbox before sending again.
curl -X POST 'https://highfollower.com/api/v1/pages/12/conversations/CONVERSATION_KEY/replies' \
-H 'Authorization: Bearer YOUR_API_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"message":"Hello! How can we help?"}'
Conversation status and contact tags
To change conversation status, send status as open or done. To replace contact tags, send a tag_ids array; an empty array removes all tags.
Dedicated webhooks
Configure the URL and events and send a test webhook. Payloads contain id, type, api_version, occurred_at, platform_page_id, platform and data. Message and comment events include inbound and outbound items. A synced event signals that the application should reload the list.
Verify webhook authenticity
Verify HMAC-SHA256(secret, timestamp + "." + raw_body) before parsing JSON. X-HighFollower-Signature starts with sha256=. Validate X-HighFollower-Timestamp within five minutes and persist the event id to deduplicate processing.
Signature verification example — Python
import hashlib, hmac, json, time
def verify_webhook(raw_body, headers, secret):
timestamp = headers["X-HighFollower-Timestamp"]
if abs(time.time() - int(timestamp)) > 300:
raise ValueError("Expired webhook")
digest = hmac.new(
secret.encode(), timestamp.encode() + b"." + raw_body,
hashlib.sha256,
).hexdigest()
if not hmac.compare_digest(
"sha256=" + digest, headers["X-HighFollower-Signature"]
):
raise ValueError("Invalid signature")
return json.loads(raw_body)
# Deduplicate the verified payload["id"] in your database.
# Return 2xx after durably accepting the event.
Retries and delivery history
2xx acknowledges receipt. Network errors, 408, 425, 429 and 5xx retry up to eight attempts; other responses, including redirects, fail. Retry delays are 1, 5, 15, 60, 180, 360 and 720 minutes plus queue delay. Event IDs stay stable. History lasts 30 days. Changing the URL or secret cancels pending deliveries from the previous configuration.
Limits & errors
Request limits
API and webhooks are included in Growth with 3 active connections and Pro with 10. The Growth trial includes these features too. Each integration allows 120 requests per minute. Replies require an active page with valid credentials and credit. On 429, wait for the Retry-After interval.
API errors
Errors: 401 invalid or expired token; 403 insufficient scope or inactive sending page; 404 missing or out-of-scope resource; 409 idempotency conflict; 422 invalid input; 429 rate limit. Plan limits use error=plan_limit_reached.