Hootsuite API: Access, Endpoints, Limits, and Alternatives

TLDR: Hootsuite has a free REST API for scheduling posts, uploading media, and managing teams, plus an Analytics API and four MCP servers from 2026. Access needs an approved developer account, limits are 20 requests a second and 100,000 a day, and it cannot publish to TikTok, YouTube, or Bluesky. It suits integrations into Hootsuite, not products posting for their users.

Does Hootsuite have an API?

Yes, and the Hootsuite API has been public for a decade. Hootsuite opened its first public APIs, for publishing, user management, and Ow.ly link analytics, on April 12, 2016, and the same REST API still runs at https://platform.hootsuite.com. If you have read that it is partner-only, that is not quite right: the Hootsuite API is free, but Hootsuite reviews every developer account before handing out credentials, which makes it a gated API rather than a partner program.

As of October 2, 2026, the Hootsuite developer platform has six parts:

• REST API v1: scheduling, media uploads, members, teams, and social profiles, with webhooks and SCIM 2.0 provisioning.
• Analytics API: post and profile metrics, new in April 2026, behind a paid add-on.
• Inbox 2.0 APIs: CRM sync, bots, real-time metrics, and proactive messaging for care teams.
• Amplify API: employee advocacy content.
• iFrame SDK: apps that run inside the Hootsuite dashboard.
• MCP servers: four remote servers for AI assistants.

The company around the Hootsuite API changed shape in 2026. Co-founder Ryan Holmes returned as CEO and wrote on May 15 that Hootsuite is going headless, exposing every capability to AI agents through MCP. On June 24, under the name Social OS, publishing and planning became Perch, the inbox became Nest, Amplify became Parliament, and Talkwalker became Lumen. The API docs still use the old names.

How do you get access to the Hootsuite API?

Getting Hootsuite API access takes two accounts and one approval. Hootsuite’s app submission guide sets out the order:

1. A Hootsuite account. A trial works to start, but the account needs a paid plan after 14 days.
2. Developer access. Apply from the developer portal, describing in detail how you plan to use the REST API. Hootsuite emails you on approval and publishes no turnaround time.
3. An app. Create one under My Apps to get a client ID and client secret, which Hootsuite’s FAQ calls your REST API keys. They work as OAuth client credentials, not a key sent with each request.
4. Redirect URIs. Add them in the app’s Security tab, starting with https:// or http://localhost. Once an app is in review or launched, changes go through Developer Support.

Listing in the Hootsuite App Directory is optional and only needed if other customers will install your app; Hootsuite says its review team responds within two to four weeks.

Users then authorize your app with OAuth 2.0: send them to the authorize endpoint with a state of at least eight characters and the offline scope for a refresh token (the URL is one line, split here for reading):

https://platform.hootsuite.com/oauth2/auth
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://app.example.com/hootsuite/callback
  &scope=offline
  &state=8f2c1a9d4e

Exchange the returned code within 10 minutes, with your client credentials in a Basic auth header rather than the request body:

curl -X POST https://platform.hootsuite.com/oauth2/token \
  -u "$HOOTSUITE_CLIENT_ID:$HOOTSUITE_CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code=AUTH_CODE_FROM_REDIRECT \
  -d redirect_uri=https://app.example.com/hootsuite/callback

A few details from the authentication guide and the API reference save debugging time. Each authorization code works once, and using it a second time revokes every token the first exchange granted. Refresh tokens never expire but are single use, so store the new one every time you refresh. Access token lifetimes differ across Hootsuite’s own examples, from an hour (expires_in of 3599 in the REST API FAQ) to 30 days (2592000 in the reference), so read expires_in from each response rather than assuming.

Authorization code is one of four grant types the guides document (the reference’s grant_type list also includes client_credentials, which no guide covers):

For your own company’s integration, Hootsuite’s analytics guide suggests a shortcut: create the app under a service-account member, install it yourself (your own app needs no review), and request hour-long tokens with member_app. The organization_app grant is not self-serve; Developer Support links your app to the organization after a ticket.

What can the Hootsuite REST API do?

The Hootsuite API documentation lives in two places: guides at developer.hootsuite.com, and the REST and Analytics references at apidocs.hootsuite.com, each with a downloadable OpenAPI spec. There is no official REST client library; the SDKs Hootsuite ships are the iFrame SDK for dashboard apps and a Messenger SDK for chat. For AI coding agents, developer.hootsuite.com/llms.txt indexes every page, and adding .md to a guide’s URL returns it as Markdown.

The REST API reference itself is compact. These are its endpoint groups:

The comments endpoints approve or reject comments queued for publishing from Hootsuite; they do not read the comments people leave on your posts, which belong to the Inbox 2.0 APIs.

The publishing rules worth knowing before you write code:

• One request, many profiles. POST /v1/messages accepts several social profile IDs and returns one message per profile. Pinterest is the exception and must be scheduled on its own.
• Lead time. scheduledSendTime must be UTC ISO 8601 ending in Z and at least five minutes ahead. Video posts need 15 minutes, and Hootsuite recommends an hour for large files or approval workflows.
• Media is a three-step upload. Request a signed Amazon S3 URL with the exact byte size and MIME type, PUT the file, and wait for READY before attaching it. The reference accepts MP4, GIF, JPEG, and PNG (the media guide adds MOV), custom video thumbnails are not supported, and uploads are deleted 90 days after use.
• Webhooks report state changes. Pass webhookUrls on a message and Hootsuite calls you as it moves through SCHEDULED, PENDING_APPROVAL, APPROVED, SUBMITTED, SENT, SEND_FAILED_PERMANENTLY, DELETED, or REJECTED.
• Some networks are missing. The API overview lists TikTok, YouTube, and Bluesky as unsupported by the Publishing API, and Facebook Groups return error 40024. One older FAQ page says Instagram Business profiles are unsupported, but the REST API FAQ says they have worked since 2024.
• It sees only Hootsuite’s own posts. GET /v1/messages lists messages scheduled or sent through Hootsuite, four weeks at a time, and no endpoint pulls a profile’s full posting history. The Analytics API covered below returns published posts with their metrics, but its docs do not say whether that includes posts made outside Hootsuite.

Hootsuite documents no sandbox; its scheduling guide warns that the sample request publishes for real, so test on a throwaway profile.

Is the Hootsuite API free, and what are its rate limits?

The Hootsuite API is free; Hootsuite is not. The API terms say the APIs are currently free and may be charged for later, and the developer FAQ confirms the REST API and SDK cost nothing for approved developers. But every request runs as a Hootsuite user, and that user needs a plan. As of October 2, 2026, Hootsuite’s plans are:

There is no free plan: new accounts get a 14-day trial without a credit card, capped at 10 to 20 posts a day per organization with bulk scheduling off, and monthly billing costs more than the annual prices above. The Analytics API also needs the Advanced Analytics add-on, and the Ow.ly link-shortening API is Enterprise-only.

The Hootsuite API rate limits are generous for a single company: 20 requests per second and 100,000 calls per day. Three headers report usage:

Going over returns HTTP 429 with error code 1003, “Account plan limit exceeded”; wait for the window to reset. The remaining-requests header is counted per server node, so treat it as an estimate.

For a product, the request limits are not what binds; the seat price is. If 50 customer brands each connect through their own Hootsuite account, that is 50 subscriptions starting at $99 a month each before anyone posts, paid by your customers or by you.

How do you schedule a post with the Hootsuite API?

Once a user has authorized your app, scheduling takes three calls: refresh the token, list the social profiles, and create the message. In Node.js 18 or later, saved as an ES module (a .mjs file, or "type": "module" in package.json) so the top-level await works:

const API = 'https://platform.hootsuite.com';
const basicAuth = Buffer.from(
  `${process.env.HOOTSUITE_CLIENT_ID}:${process.env.HOOTSUITE_CLIENT_SECRET}`,
).toString('base64');

// Refresh tokens are single use: the response carries the replacement.
async function refreshAccess(refreshToken) {
  const res = await fetch(`${API}/oauth2/token`, {
    method: 'POST',
    headers: {
      Authorization: `Basic ${basicAuth}`,
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken }),
  });
  if (!res.ok) throw new Error(`Token refresh failed: ${res.status}`);
  return res.json();
}

async function hootsuite(token, path, init = {}) {
  const res = await fetch(`${API}${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${token}`,
      'Content-Type': 'application/json;charset=utf-8',
    },
  });
  if (res.status === 429) {
    throw new Error('Rate limited: wait for the current window to reset');
  }
  const body = await res.json().catch(() => ({}));
  // Partial failures return both data and errors, so log errors without dropping data.
  for (const err of body.errors ?? []) {
    console.warn(`Hootsuite error ${err.code}: ${err.message}`);
  }
  if (!res.ok) throw new Error(`Hootsuite request failed: ${res.status}`);
  return body.data;
}

const tokens = await refreshAccess(process.env.HOOTSUITE_REFRESH_TOKEN);
// Store tokens.refresh_token now: the old one no longer works.

// List what this user can publish to, then pick targets by Hootsuite profile id.
const profiles = await hootsuite(tokens.access_token, '/v1/socialProfiles');
for (const p of profiles) console.log(p.id, p.type, p.socialNetworkUsername);

const messages = await hootsuite(tokens.access_token, '/v1/messages', {
  method: 'POST',
  body: JSON.stringify({
    text: 'Version 2.4 is out: faster sync and a new calendar view.',
    socialProfileIds: process.env.HOOTSUITE_PROFILE_IDS.split(','),
    scheduledSendTime: '2026-10-09T15:00:00Z',
    webhookUrls: ['https://app.example.com/hooks/hootsuite'],
  }),
});
for (const m of messages ?? []) console.log(m.id, m.state); // one message per profile

The same flow in Python with requests:

import json
import os

import requests

API = "https://platform.hootsuite.com"
CLIENT = (os.environ["HOOTSUITE_CLIENT_ID"], os.environ["HOOTSUITE_CLIENT_SECRET"])


def refresh_access(refresh_token):
    # Refresh tokens are single use: the response carries the replacement.
    res = requests.post(
        f"{API}/oauth2/token",
        auth=CLIENT,
        data={"grant_type": "refresh_token", "refresh_token": refresh_token},
        timeout=30,
    )
    res.raise_for_status()
    return res.json()


def hootsuite(token, method, path, payload=None):
    res = requests.request(
        method,
        f"{API}{path}",
        headers={
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json;charset=utf-8",
        },
        data=json.dumps(payload) if payload is not None else None,
        timeout=30,
    )
    if res.status_code == 429:
        raise RuntimeError("Rate limited: wait for the current window to reset")
    try:
        body = res.json()
    except ValueError:
        body = {}
    # Partial failures return both data and errors, so log errors without dropping data.
    for err in body.get("errors") or []:
        print(f"Hootsuite error {err['code']}: {err['message']}")
    res.raise_for_status()
    return body.get("data")


tokens = refresh_access(os.environ["HOOTSUITE_REFRESH_TOKEN"])
# Store tokens["refresh_token"] now: the old one no longer works.

for p in hootsuite(tokens["access_token"], "GET", "/v1/socialProfiles"):
    print(p["id"], p["type"], p.get("socialNetworkUsername"))

messages = hootsuite(
    tokens["access_token"],
    "POST",
    "/v1/messages",
    {
        "text": "Version 2.4 is out: faster sync and a new calendar view.",
        "socialProfileIds": os.environ["HOOTSUITE_PROFILE_IDS"].split(","),
        "scheduledSendTime": "2026-10-09T15:00:00Z",
        "webhookUrls": ["https://app.example.com/hooks/hootsuite"],
    },
)
for m in messages or []:
    print(m["id"], m["state"])

What the code is doing:

• Token refresh uses Basic auth with your client credentials and returns a new refresh token that replaces the old one.
• socialProfileIds takes Hootsuite’s own profile IDs, not the network’s IDs, which come back separately as socialNetworkId.
• The response holds one message per profile with its own id and state. A partial failure returns data and errors together, so the helper logs errors rather than throwing.
• Media needs POST /v1/media, the S3 upload, and a READY check first, then media: [{ "id": "..." }] on the message.

What do the Hootsuite MCP servers do?

Hootsuite announced remote MCP servers for Perch, Nest, and Lumen on June 24, 2026. Parliament’s server was not in that announcement and has no published launch date, but all four Hootsuite MCP servers are listed on its MCP page as of October 2, 2026:

ChatGPT and Claude get prebuilt Hootsuite connectors; Copilot and Gemini take the server’s https:// URL as a custom MCP server, which Hootsuite suggests handing to your IT administrator. Either way you sign in with your Hootsuite account once, and the assistant can only reach the workspaces, social accounts, permissions, and products that account already has, so Lumen needs access to Hootsuite’s Lumen listening product.

Read the last column before you plan an agent workflow. Hootsuite’s MCP page shows sample prompts that publish a post right away, but the Perch developer reference says the server saves drafts and has no tools to publish or schedule. A draft with a scheduledDate sits in grey on the Planner until a person publishes it in Hootsuite: a sensible safety choice for a brand account, but the agent prepares work rather than finishing it. Zapier also offers a Hootsuite MCP whose actions mirror the REST API’s media upload and Schedule Message endpoints, so it can schedule where Perch cannot, through your Zapier account.

If you want an agent that can publish, PostZen’s MCP server creates and schedules posts behind an OAuth consent screen where the user picks read-only or read-and-write access. The agents page has setup steps for Claude, Cursor, and other clients.

What does the Hootsuite Analytics API return?

The Analytics API arrived in April 2026. It returns a profile’s published posts with lifetime metrics, daily profile metrics with breakdowns, and campaign, ad set, and ad metrics for Facebook and X ad accounts.

• Requirements: the user must have bought the Advanced Analytics add-on, and your app must enable and request the analytics:read scope.
• Networks: Facebook Pages, X, Instagram Business, TikTok Business, YouTube channels, Pinterest, and Threads. LinkedIn data is excluded because LinkedIn does not permit its export, and X data comes back as platform IDs only.
• Limits: 10 social profile IDs per request, data up to two years back, and 100 results per page with a cursor.

Note the asymmetry: the Analytics API reads TikTok and YouTube, which the Publishing API cannot post to. To pull metrics from each network directly instead, see our social media analytics API guide.

Can you build a product for your users on the Hootsuite API?

The Hootsuite API can connect any Hootsuite user through OAuth, but three things make it a poor base for a product that posts on its users’ behalf:

1. Every user needs Hootsuite. Your users must hold Hootsuite accounts, connect their social profiles inside Hootsuite, and keep paying for seats. Your product becomes a front end for their Hootsuite subscription.
2. The terms limit what you can build. Hootsuite’s API terms say developers must “not substantially replicate products or services offered by Hootsuite,” and must not sell, sublicense, or redistribute access to the APIs or charge users extra fees for access to the content. A scheduler for your customers sits close to the first clause.
3. Broad access runs through people. Organization-wide access needs Hootsuite’s Developer Support to link your app, redirect URI changes on a launched app need a ticket, and technical calls are booked through a Customer Success Manager.

What the Hootsuite API does well is the reverse: bringing your systems into Hootsuite. Hootsuite documents a CMS sending approved content to the Planner, a digital asset manager inside the composer, CRM sync with the inbox, user provisioning, and analytics exports to a warehouse, and paid App Directory apps keep 70% of the revenue. For publishing under your own brand, see our roundup of white-label social media APIs.

Hootsuite API vs PostZen: which one fits?

We built PostZen for the product case, so this comparison is not neutral, but each Hootsuite row comes from the documentation linked above and each PostZen row from our API reference.

Use the Hootsuite API if:

• Your marketing team already works in Hootsuite and you want your CMS, asset library, or CRM to feed it.
• You need social listening, approval workflows, employee advocacy, or a care inbox with routing, none of which PostZen offers.
• You want an AI assistant to draft into your team’s Hootsuite Planner for a person to review.
• You are building an App Directory app for Hootsuite’s 100,000-plus customers.

Use a developer API like PostZen if:

• Your users are not Hootsuite customers and should not need to become one.
• You need TikTok, YouTube, or Bluesky publishing through an API.
• You want an agent that publishes and schedules, not one that only drafts.
• Your costs should grow with connected accounts, not with seats.

A few honest notes on our side of the table. PostZen has no listening, no advocacy, no approval workflow, and no team seats. Bluesky video and LinkedIn analytics are not live yet, and X posts carry X’s own per-request API charges, which we pass through. Our Hootsuite alternatives page covers the dashboard comparison, our Buffer API guide covers the other big scheduler whose API changed this year, and the best social media APIs for developers roundup compares the other API-first options.

The shorter path: one request to every platform

Here is a 30-second release video going to TikTok and YouTube, which Hootsuite’s Publishing API cannot reach, plus Instagram and LinkedIn, in one request:

curl -X POST https://api.postzen.dev/v1/posts \
  -H "Authorization: Bearer $POSTZEN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "x-request-id: release-2-4-video" \
  -d '{
    "content": "Version 2.4 in 30 seconds: faster sync and a new calendar view.",
    "scheduledFor": "2026-10-09T15:00:00Z",
    "mediaItems": [{ "url": "https://cdn.example.com/release-2-4.mp4" }],
    "platforms": [
      {
        "platform": "tiktok",
        "accountId": "acc_tiktok",
        "settings": { "privacyLevel": "publicToEveryone" }
      },
      {
        "platform": "youtube",
        "accountId": "acc_youtube",
        "settings": { "title": "Version 2.4 in 30 seconds", "privacyStatus": "public" }
      },
      {
        "platform": "instagram",
        "accountId": "acc_instagram",
        "settings": { "postType": "reel" }
      },
      { "platform": "linkedin", "accountId": "acc_linkedin" }
    ]
  }'

Line by line:

• platforms holds one target per network with its own accountId and settings: TikTok needs a privacyLevel, YouTube a title and privacyStatus, and Instagram takes the video as a reel.
• mediaItems takes a URL that PostZen re-hosts, up to 100 MB, with no upload step or status polling; POST /v1/media/presign takes direct uploads up to 5 GB.
• x-request-id makes the create idempotent, so a retry returns the original post instead of a duplicate.
• scheduledFor must be at least 60 seconds ahead; the scheduling API guide explains which networks schedule natively.

Bluesky takes text and image posts through the same endpoint; Bluesky video is not supported yet. Webhooks report post.published, or post.partially_failed and post.failed with the detail, and account.needs_reauth flags a connection that needs attention. Your users connect accounts through a hosted link (GET /v1/connect/{platform} returns an authUrl) without a PostZen account. Rate limits run from 60 to 2,000 requests a minute by plan, and two SDKs, @postzen/node and postzen-sdk for Python, wrap the same endpoints.

If you came looking for a Hootsuite API alternative because you heard the API was closed or partner-only, that is not the case: it is free, documented, and moving faster in 2026 than it has in years. If you came because your users should never have to open Hootsuite, that has not changed, and it is the case we built our social media API for.