Social Automation API: Instagram & Facebook Comment Auto-Reply REST API

Quick start

1. Create a key under API & AI in the dashboard account menu (choose Read & write). 2. Check that it works:

curl https://social-automation.cresclab.com/api/v1/me \
  -H "Authorization: Bearer sa_live_YOUR_KEY"

3. Create an activity. Without a status it is a draft and nothing is sent:

curl -X POST https://social-automation.cresclab.com/api/v1/activities \
  -H "Authorization: Bearer sa_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "account_id": "ACCOUNT_ID", "name": "+1 → product link", "trigger": "ig_comment", "keywords": [ "+1", "want" ], "public_replies": [ "Sent you a DM 💌", "Check your DMs!" ], "dm": [ { "type": "text", "text": "Here is the link you asked for 👇" }, { "type": "button", "title": "Shop now", "url": "https://shop.example.com/serum" } ], "post_scope": "next_post" }'

4. Activate it once the setup looks right. From then on, your account replies publicly and DMs the real people who comment:

curl -X PATCH https://social-automation.cresclab.com/api/v1/activities/ACTIVITY_ID \
  -H "Authorization: Bearer sa_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"active"}'

Authentication and access

• Send the header Authorization: Bearer sa_live_... with every request.
• Keys are Read only (GET) or Read & write (GET, POST, PATCH, DELETE).
• A key acts as the person who created it: a team member's key only sees and changes the accounts they were given. If that person is deactivated or leaves the workspace, the key stops working.
• Revoke keys on the same dashboard page; it takes effect immediately.

Endpoints

All paths are relative to https://social-automation.cresclab.com/api/v1.

The activity object

account_id and trigger are required when creating; everything else is optional. Updates change only the fields you send, and arrays (keywords, public_replies, dm) replace the old value.

{
  "account_id": "ACCOUNT_ID",
  "name": "+1 → product link",
  "trigger": "ig_comment",
  "keywords": [
    "+1",
    "want"
  ],
  "public_replies": [
    "Sent you a DM 💌",
    "Check your DMs!"
  ],
  "dm": [
    {
      "type": "text",
      "text": "Here is the link you asked for 👇"
    },
    {
      "type": "button",
      "title": "Shop now",
      "url": "https://shop.example.com/serum"
    }
  ],
  "post_scope": "next_post"
}

Triggers

Three DM shapes

• Text plus up to 3 link buttons: up to 640 characters of text with buttons, 1,000 without.
• A single image: one image block on its own. The URL must return the image file itself (Google Drive or Dropbox share pages are rejected).
• A card carousel: 1–10 cards, up to 3 buttons each, nothing else mixed in.

Errors and limits

Every error has the same shape. action_url points to where the user can fix the problem (connect an account, upgrade, create a key):

{
  "error": {
    "code": "trial_expired",
    "message": "The 7-day trial has ended. Upgrade the plan to keep creating and activating activities.",
    "action_url": "https://social-automation.cresclab.com/dashboard/workspace"
  }
}

• 400 invalid_request: a field is invalid; error.field says which.
• 401 unauthorized: missing or invalid key.
• 403 insufficient_scope / trial_expired / contract_expired / plan_limit.
• 404 not_found / account_not_found.
• 429 rate_limited: up to 120 requests per minute per key, with a Retry-After header.

For AI agents: MCP

The same operations are available as MCP tools for Claude Code, Cursor and Codex. See the MCP setup.