Changelog

• Facebook Reels and video analytics: GET /v1/posts/:id/analytics now returns rich video metrics for Facebook posts, including views, average and total watch time, and a retention graph (opt in with ?include=retention). Reels additionally report total plays, replays, and followers gained, while regular videos report an approximate completion rate. Metrics that Meta does not provide come back as null and are listed under platform_specific.unavailable_fields, with raw video details available under platform_specific.video. This works automatically for both new and previously imported posts, with no changes needed on your end.
• Set a cover image for Facebook video posts: You can now specify videoCoverUrl when creating or updating a Facebook video post to control the thumbnail shown before playback. The URL must be a valid HTTP(S) link and is only accepted for video posts, with clear validation errors if it isn't.

• Reels analytics: GET /v1/posts/:id/analytics now returns average watch time, total watch time, skip rate, reposts and total interactions for Reels posts, including Reels you imported rather than posted through Outstand. Any metric Meta doesn't report comes back as null and is listed under platform_specific.unavailable_fields.
• Follower growth on accounts: GET /v1/social-accounts/:id/metrics now includes a follower_growth block with followers gained, followers lost, net change, and daily new followers. Accounts under 100 followers won't have this data from Meta; those fields come back as null and are listed under follower_growth.unavailable_fields.
• Follow status on Instagram webhooks: message.received now includes a sender object, and comment.received now includes an author object, each with isFollower, isFollowedByAccount, followerCount and isVerified. This lets you build flows like a follow gate, where a user confirms they're following before getting a reply. For comments, this is only available once the commenter has messaged the account directly; otherwise the fields come back as null, meaning unknown rather than "not a follower." A new follow-gate recipe using quick replies has been added to the comment-to-DM guide.
• Fixed Vimeo documentation sample: the example request on the Vimeo setup page attached media as a plain string, which the API rejects. It now shows the correct { url, filename } object format so the sample works when copied as-is.

• Threads replies delivered as comment.received: Replies to your Threads posts now arrive through the same comment.received webhook used for Instagram and Facebook comments, so you can handle them with the same code path. No reconnect is needed for existing accounts since the required permission is already included by default.
• Self-replies are filtered out automatically: If your account replies to its own Threads post (for example, via an auto-reply), that reply is skipped so you don't end up processing your own messages in a loop.
• Known limitation documented for cross-thread replies: A reply to your own reply under someone else's Threads post isn't delivered, since it belongs to another account's thread; this is now called out in the docs so it isn't a surprise.
• Threads docs updated: The Threads configuration page now has a dedicated Comment Webhooks section covering requirements (public accounts, Managed Keys), behavior differences from other networks, and the fact that Threads doesn't send an author ID on replies. The webhooks page also lists Threads replies as a supported comment.received source.

• Post analytics now return the same account ID everywhere: social_account.id in GET /v1/posts/:id/analytics now matches the ID you see from the posts list, /v1/social-accounts, and the MCP analytics tool. Previously analytics used a different internal ID format, making it impossible to reliably match analytics rows back to your connected accounts.
• More reliable Instagram account connections: Connecting an Instagram account now works correctly even when Instagram's response doesn't include a user ID right away, with an automatic fallback to retrieve it. This reduces failures during account connection caused by incomplete data from Instagram.

• Official listing badge on the Claude page: The /claude page now shows "Now in Claude's connector directory" with a link straight to our listing, so you don't have to take our word for it or hunt down the URL yourself.
• New FAQ confirms directory listing: A new question, "Is Outstand in Claude's connector directory?", answers this directly and is also structured so it can surface in search results.
• Clarified LinkedIn connector answer: The FAQ about Claude's LinkedIn support now correctly explains that it comes through a third-party connector listed in Claude's directory, rather than something you'd need to add yourself.

• Search when connecting Facebook or LinkedIn pages: If you manage more than 5 pages, a search box now appears on the account selection screen so you can quickly filter by page name or @handle instead of scrolling a long list. Your selections are preserved even after you filter, and Select All / Deselect All now apply only to the pages currently shown when a search is active.
• Corrected Bluesky connection guidance: Documentation and in-product messaging previously suggested Bluesky could be connected via OAuth or an app password. Bluesky only supports app password authentication, and all references now reflect that accurately so you don't run into confusion while setting up your Bluesky connection.

• Send quick reply buttons on Instagram DMs: Add up to 13 tappable buttons (a title and an id) to any message sent through the Conversations API. Buttons go out with the message text and work alongside scheduled sends.
• Open conversations with quick replies: Private replies to comments can now include quick reply buttons too. A tap counts as the contact's reply, so it opens the 24-hour messaging window in a single tap, the standard way to turn a comment into a DM conversation.
• Know exactly which button a contact tapped: Messages and webhooks now include an interaction field showing the type of interaction and the id of the button that was tapped, so your inbox can respond based on the selected option rather than parsing button text.
• See the buttons you sent on any message: Sent message objects now include the full list of quick reply buttons that were offered, so an inbox can display exactly what the contact was shown.
• Clearer validation for quick reply buttons: Button titles over 20 characters, blank ids, and duplicate ids across buttons are now rejected up front with a clear error instead of causing confusing behavior later.

• Search followers to mention them: Company page accounts can now search their LinkedIn followers by name to get the identifier needed for linkedin.mentions. This makes it possible to tag a specific person in a post without already knowing their LinkedIn URN. Note that LinkedIn only returns followers of the page, personal accounts aren't supported, and search is by name only (not profile URL). Existing LinkedIn company page connections need to be reconnected once to pick up the required permission.

• Switch between Pay as you go and Business whenever you want: Subscribed organizations can now change plans directly from Settings → Billing, no need to cancel and resubscribe. Upgrading to Business applies immediately, with the price difference invoiced right away (cards requiring 3D Secure are handled with a secure confirmation link). Downgrading to Pay as you go takes effect at the end of your current billing period, and you can cancel the scheduled downgrade anytime before it applies by clicking "Keep Business". Moving onto Business also raises your account management limit to at least 1,000 accounts. Plan changes can be made by org owners and admins.
• Bring your own callback URL for YouTube: YouTube credentials now support customer-owned HTTPS OAuth callback URLs, giving you more control over the authentication flow for your YouTube integrations.
• TikTok gets a dedicated platform API

• Receive comments on connected Facebook Pages: the comment.received webhook event, previously available for Instagram, now also fires for comments on connected Facebook Pages. To enable it, request the pages_manage_metadata scope when generating your auth URL and complete the connection through your backend. Facebook comments don't include a username, so the event now carries an authorName field with the commenter's display name (this field is also present, and null, on Instagram).
• More reliable YouTube upload quota tracking: fixed an issue where queued YouTube uploads could be published without their usage being counted against your quota, which could in turn cause valid uploads to be incorrectly rejected once quota enforcement was active. Quota accounting for queued uploads is now accurate.
• Corrected social network auth-url documentation: the docs and integration guide referenced the wrong HTTP verb and path for generating a social network auth URL. They now correctly show POST /v1/social-networks/{network}/auth-url, including a clarification that the path segment is the network name, not a stored account ID.
• Threads post deletion documentation corrected: several docs and reference pages incorrectly stated that deleting a Threads post was not supported. Threads post deletion has in fact worked for some time, and the documentation now reflects that correctly.

• Fixed incorrect organization ID example in webhook guide: The conversations webhook documentation previously showed an organization ID example that wasn't formatted the way real IDs actually look, which could mislead you when writing code to parse webhook payloads. The example now matches the real ID format used consistently across our docs, and the sample media upload URL in the video processing guide was also corrected so it doesn't point to a path that can't actually serve the file.
• Corrected MCP server availability info for X and Pinterest: Our pages answering "Does this platform have an official MCP server?" incorrectly said no for both X (Twitter) and Pinterest. X has run an official hosted MCP server since mid-2026, and Pinterest announced one in September 2026 (currently limited to ads and insights, not yet generally available). Both pages now reflect the accurate status.

• Event details for Google Business promotions and offers: You can now attach full event information, title, start date, start time, end date, and end time, to EVENT and OFFER post types on Google Business Profile. The API validates that all required event fields and call-to-action details are present before a post is accepted, and the call-to-action URL is now correctly optional for CALL actions while still required for every other action type.
• Fairer, more reliable YouTube upload capacity: Managed YouTube uploads (via the API, scheduled publishing, and the web composer) now draw from a shared daily capacity pool that is actively managed so no single organization can exhaust the day's allowance for everyone else. Capacity is released gradually throughout the day, organizations get a fair initial allotment with more available later in the day, and accounts using their own YouTube credentials (BYOK) are unaffected. If you hit a quota limit, you'll now get a clear, actionable error telling you when to retry.
• New YouTube quota visibility dashboard: Admins can check current YouTube upload capacity usage via a new read-only dashboard, making it easier to understand and plan around upload availability.
• Corrected Threads capability documentation: The Threads page previously said post deletion wasn't supported. It is, deletion of your own posts and comments is available (subject to Meta's rate limits). We also corrected carousel post limits across the page from an understated 2–10 images to the actual supported range of up to 20.

• Comment-to-DM guide: A new step-by-step guide covers the full flow for replying to Instagram comments with a private DM, from the comment.received webhook through to a working POST /v1/conversations request. It includes Instagram's rules (one private reply per comment, a 7-day window, text only), the account setup you need, a curl example with its response, a sample keyword auto-reply handler, how to continue the conversation once the commenter replies, and what each error status means for retries. It replaces having to piece the flow together from several separate pages.
• Media upload tool renamed, old name still works: The tool for requesting a media upload URL is now called request_media_upload_url for clearer, more consistent naming. Clients still calling it by its old name, upload_media, keep working without any changes needed on your end.

• Start a conversation from an Instagram comment: POST /v1/conversations lets you send a private reply to someone who commented on a post, using the commentId and authorId delivered in the comment.received webhook. This is the standard way to open a direct conversation with a commenter on Instagram. Instagram only allows one private reply per comment and only within 7 days of the comment being posted; attempting a duplicate reply returns a clear 409 error, and a comment older than 7 days returns a 422. The Instagram-specific fields (comment_id, author_id) are grouped under an instagram object in the request body, keeping the endpoint ready to support other networks' ways of starting a conversation in the future.
• Clearer status for new conversations: the endpoint returns the created conversation and its first message right away with a 201; check the message's status and listen for the message.sent webhook to know when delivery completes.
• Try it from the demo scheduler: the Messages tab now has a "Start conversation" dialog where you can pick an Instagram account, paste a comment ID, and send a private reply directly, with clear error messages if the comment is too old or already replied to.
• Smoother setup with Claude's Connectors Directory: our MCP server now meets Claude's directory requirements, so analytics tools like get_post_analytics, get_replies, and get_account_metrics no longer prompt for confirmation on every call, and the server no longer collects conversation-level data, making it eligible for listing in Claude's directory.

• Accurate callback contracts per network: The getting-started guide previously showed one universal callback shape and implied every network returned it. It now documents the three distinct shapes you'll actually see: networks that return an account id directly on the callback (X, Instagram, TikTok, YouTube, Vimeo), networks that return only a success/error flag and require a follow-up lookup (Pinterest, Reddit, Threads), and networks that return a session token requiring a separate finalize step before the account exists (LinkedIn, Facebook, Google Business Profile).
• Guidance for the finalize step: For networks using the session-token flow, the docs now show how to call the finalize endpoint with the session token to complete the connection.
• Important callout for LinkedIn, Facebook, and Google Business Profile: These three networks currently require a browser session to complete the connect flow, meaning a third-party app cannot finish connecting these accounts on a user's behalf today. This is now clearly flagged so you don't hit it as a surprise mid-integration.
• Supported Platforms table now links to the right detail: The platforms table previously implied all networks (besides Bluesky) share one OAuth flow. It now points to the new callback contracts section for the full picture.

• Unique previews for every docs page: Sharing a link to any page in our documentation (on Slack, Twitter, LinkedIn, or anywhere else that generates a link preview) now shows that page's actual title, description, and URL instead of a generic "Outstand API Documentation" preview pointing back to the docs homepage. This makes it easy for your team to tell at a glance which page a shared link leads to.

• Instagram comment webhooks: Subscribe to the new comment.received event to get notified in real time whenever someone comments on, or replies to a comment on, a connected Instagram account's post. The payload includes the comment text, author, and the related post ID when the post was published or imported through Outstand. Comments your own account posts (e.g. auto-replies) are never delivered, so you can safely automate replies without creating a loop. Since the same event can be delivered more than once, dedupe on commentId.
• Shared subscriptions across organizations: Organizations can now share a subscription instead of each one needing its own, making it easier to manage billing for teams running multiple organizations.
• Fixed dropped webhook deliveries containing emoji or non-Latin text: Webhook payloads containing emoji or non-Latin characters (common in DM text and comments) could previously fail to send at all. message.received, message.sent, and comment.received deliveries with this kind of content are now delivered reliably.

• See real usernames in Instagram DMs: Conversations in your messaging dashboard now show the actual Instagram username of the person you're talking to instead of a raw numeric ID, making it much easier to recognize who you're chatting with at a glance.
• Human agent tag support for Instagram: Organizations that need to respond to customers outside Instagram's standard messaging window can now have the human agent tag enabled for their account on request. Once enabled, this can be toggled from the admin panel, and accounts without access will get a clear error if they try to use it.
• More reliable Instagram profile pictures and data handling: Fixed an issue where some Instagram accounts with very large user IDs could fail to have their profile pictures fetched or their data properly deleted, ensuring these operations now work correctly for all accounts.
• Clearer video processing pricing: Updated the video processing pricing page to remove the draft notice, clarify the billing structure, add a start date for when charges apply, and provide more accurate example costs.

• Instagram DMs are now billed by conversation: Each Instagram conversation with at least one message you send through our API is billed once per billing period, rather than per message. Messages you send from the Instagram app itself are never billed. Pricing for this is now disclosed on our site, and your account usage endpoint reports your current billable conversation count for the period.
• Clearer distinction between API and app-sent messages: Messages sent from the native Instagram app no longer appear in message history retrieved through the API; you'll now only see them via a message.sent webhook carrying source: "native_app". Messages sent through our API now include source: "api" on both the API response and the webhook, so you can reliably tell them apart.
• Automatic data deletion for Facebook, Instagram, and Threads: When one of your customers removes your connected app or requests data deletion through Meta, we now automatically delete their connected accounts, tokens, DMs, and imported posts on your behalf, keeping you compliant with Meta's platform requirements without any manual work. If you use your own Meta app, check our updated docs for the callback URLs Meta now requires.
• New account setup walks you through getting started: New signups are now guided through a short setup flow covering your use case and team before choosing a plan, with the option to decide on a plan later.

• Instagram comment webhooks: Connected Instagram accounts can now receive webhook notifications for comments on posts, in addition to direct messages. If your app requests comment-management permissions during connection, you'll start getting notified of new comments and replies as they come in.
• Richer LinkedIn comment authors: The LinkedIn comments API now returns author_name, author_username, author_avatar_url, and author_profile_url so you can display who commented without extra lookups. A new resolve_author_names option fetches human-readable names for commenters, with sensible fallback handling when a name can't be resolved.
• Clearer Instagram DM privacy disclosures: Our privacy policy, terms, and data processing agreement now spell out exactly how Instagram Direct Messages are handled: what's stored versus relayed and discarded, how long stored messages are retained, and what your responsibilities are as the connecting business. Updated September 24, 2026.
• Easier discovery for AI agents and tools: outstand.so now publishes standard machine-readable endpoints (OAuth/OIDC discovery, agent skill descriptors, and a catalog file) so AI agents and automated tooling can find and understand our API and MCP server more easily.
• More accurate API examples: Example IDs, URLs, and request fields across our developer guides and website have been corrected to match what the API actually returns and accepts, so copy-pasted examples work on the first try instead of returning errors.

• Pick the TikTok cover frame: Set videoCoverTimestampMs when posting a video to TikTok to choose exactly which frame becomes the cover, instead of letting TikTok pick one for you. Sending a timestamp of 0 now correctly selects the very first frame instead of being ignored.
• Custom YouTube thumbnails: Add youtube.thumbnailUrl to a post to set a custom thumbnail image (JPEG or PNG, up to 50MB) on your uploaded video. No reconnection is required for existing YouTube accounts. If the thumbnail can't be applied (for example on an unverified channel), your video still publishes normally with a default thumbnail.
• Tag LinkedIn company pages you don't administer: Mentioning an organization in a LinkedIn post no longer fails with a 403 error when you're not an admin of that page. Tagging now works the same whether or not you manage the page, as long as the mentioned name matches.
• Clearer LinkedIn error messages: Failed LinkedIn requests now surface the actual error details from LinkedIn instead of an unhelpful generic message, making it easier to diagnose account or permission issues.
• Easier discovery for AI tools and agents: Our API and MCP server are now easier for AI assistants and agents to find and understand, with a published API catalog and server metadata alongside our public site.

• Instagram DMs now need an explicit scope request: Instagram connections no longer request messaging permissions by default. To send and receive DMs, include instagram_business_manage_messages in the scopes field when generating an auth URL. Since custom scopes replace the defaults rather than add to them, you need to pass the full scope list, not just the messaging one. Existing and dashboard-connected accounts need to be reconnected through the auth URL to pick up messaging access. Our docs now cover the exact scopes to use, how to reconnect existing accounts, and what happens if the scope is missing.
• Request Instagram DM access from the MCP server: the get_auth_url MCP tool now accepts a scopes input, so MCP users can enable Instagram messaging the same way as direct API calls. The parameter table in the MCP docs is also corrected.
• Pinterest configuration guide is now accurate: the guide has been restructured so the steps that apply to everyone (connecting, boards, posting, media, tokens) come first, with bring-your-own-app details (credentials, redirect URI, access tiers, rate limits) in a separate section at the end. We also fixed several factual errors: the correct connect endpoint, a missing redirect URI for custom Pinterest apps, the real prerequisite for publishing (Pinterest Standard access, not Trial access), accurate video specs and size limits, and clarified that a cover image is optional and an overly long description gets truncated rather than rejected.
• Marketing pages no longer overflow on phones and tablets: our Instagram, TikTok, LinkedIn and X landing pages were rendering far wider than the screen on mobile devices, forcing browsers to zoom out and shrink all the text. Pages now fit the screen properly at every size, code samples scroll within their own box instead of stretching the page, and the Instagram page in particular is more compact and easier to read on a phone.

• Reply to Instagram DMs: The Conversations API can list threads, read messages, and reply with text or media on Instagram, complete with webhooks and read receipts. Check out the new direct messages section in our docs, with a full curl walkthrough and the details you need to know (reply-only, the 24 hour reply window, required permission, and account type restrictions).
• Instagram DM permission is now explicit: Connecting an Instagram account through our web OAuth flow no longer requests the messaging permission by default. If you want to send and receive DMs, include the messaging scope explicitly when generating your auth URL, and reconnect any existing accounts so they pick up the new permission.
• Video processing now bills by duration: Instead of a flat charge per output rendition, video processing is now billed in 10-second blocks based on the actual output duration. A short clip now costs less than a long one, so your bill better reflects what you actually process.
• Smoother mobile browsing: Fixed an issue where our Instagram, TikTok, LinkedIn, X, and other network pages rendered too wide on phones, causing browsers to zoom out and pages to scroll sideways. These pages now fit properly on mobile screens.

• Instagram Direct Messages: Accounts connected through the web OAuth flow on Managed Keys now grant the permission needed to receive Instagram DMs, so messages sent to your connected accounts arrive as expected. Existing accounts need to reconnect once to pick up the new permission. This is currently available on Managed Keys only; support for Bring Your Own Key apps is coming later.
• Subscribe to conversation and message webhooks: The webhooks settings page now lets you select conversation.started, message.received, message.sent, and message.failed events, so you can react to incoming and outgoing Instagram messages in real time. Full payload examples are documented alongside the existing webhook events.
• Conversations API docs: New documentation covers the Conversations API, including endpoints and webhook events, so you can build messaging features with a clear reference.
• Data Processing Agreement page: A DPA page is now available, making it easier to find and review our data processing terms.
• More reliable comment lookups: Fixed an issue where certain comment IDs could fail to decode correctly when fetching comments.

• Accurate Pinterest refresh token lifetime: The Pinterest configuration docs previously stated refresh tokens are valid for 1 year. Pinterest has moved to a continuous refresh token model with a 60-day expiration that renews indefinitely on each refresh. The docs now describe this correctly, including how it behaves for apps created before and after September 25, 2025, and what happens if a refresh ever fails permanently.
• Corrected Pinterest supported image formats: The docs listed GIF as a supported Pin image format. It isn't. Pinterest supports BMP, JPEG, PNG, TIFF, and WEBP, and the docs now list TIFF in place of GIF to match Pinterest's actual requirements.

• Threads publishing retries automatically: If Threads reports a container as not yet ready due to normal propagation delay, we now retry automatically instead of failing the request, so transient Threads-side delays no longer surface as publishing errors. Error responses for genuine container failures and timeouts are now clearer and easier to handle in your integration.
• More accurate Facebook and Instagram analytics: Engagement metrics for video posts and single-photo posts on Facebook are now calculated correctly, and fields that a platform doesn't support for a given post type (such as certain Instagram Stories metrics) are now clearly identified instead of returning misleading data.
• Consistent analytics response structure: Analytics responses now follow a standardized schema across platforms, making it easier to read and compare engagement data regardless of which network a post was published to.
• Clearer Business plan pricing: Our pricing pages and AI agent documentation now fully detail the Business plan alongside Pay as you go, including account allowances, volume pricing, reselling terms, and the exact usage level at which each plan becomes the better value, so you can pick the right plan for your usage with confidence.

• New Business plan: A new Business plan is now available, giving teams with growing needs a pricing option built for them. Check out the updated pricing page to see if it's the right fit.
• Clearer plan visibility: Your organization details and subscription settings now show which plan you're on, making it easy to confirm your current plan at a glance.
• Smoother checkout: Signing up or upgrading now supports plan-based pricing directly at checkout, so you can select the plan that fits your needs and get started right away.
• New documentation: We've published documentation introducing the Business plan and what it includes, so you can quickly evaluate whether it meets your team's needs.

• Opt-in video transcoding: Set processMedia: true when creating a post with video and Outstand automatically produces the renditions each destination network needs, so you no longer have to pre-encode video yourself for every platform's format and size requirements.
• Upfront video validation: Every video is checked against each target network's requirements at post creation. Unfixable problems return a clear error immediately instead of a confusing failure from the network later, and fixable issues come back as warnings so you can decide how to proceed.
• Video processing status in the API: GET /v1/posts/:id and GET /v1/media/:id now report processing status for video, including whether it's still encoding, failed, or wasn't needed, along with the source video's probed details and any per-network issues, so you can track progress without guessing.
• More reliable publishing for processed video: Posts with video processing enabled now wait for renditions to finish before publishing, and will still publish using whatever is ready if processing takes longer than expected, so posts no longer get stuck unpublished.
• More accurate video detection: Fixed edge cases where certain non-video files with video-like names could be misidentified, and where video files without a recognizable extension were missed entirely.

• Accounts must be ids or exact usernames: The accounts field in POST /v1/posts/ no longer shows network names (like "linkedin") as valid values, since those were never accepted. Examples now consistently use a real account id or an exact username, matching what the API actually resolves.
• Documented silent partial publishing: If a request includes a mix of valid and invalid account identifiers, the post now clearly documents that it succeeds and publishes only to the accounts that resolved, silently dropping the rest. Previously this behavior wasn't documented, which could lead to posts going out to fewer accounts than intended without any warning.
• Documented username matching across networks: The docs now explain that matching by username has no network filter, so the same username can resolve to multiple accounts across different networks, including disconnected ones.
• Placeholder account ids in examples: Request examples now use clearly labeled placeholders (like YOUR_LINKEDIN_ACCOUNT_ID) instead of realistic-looking but fake account ids, making it obvious you need to substitute your own values.
• Response now documents the account id field: The response for creating a post always included an id for each account it published to, but this wasn't documented. You can now rely on this field to check exactly which accounts a post reached.

• Disclose AI-generated content on YouTube uploads: You can now set containsSyntheticMedia on the youtube post configuration to comply with YouTube's altered/synthetic content disclosure requirement. Set it to true or false to make an explicit declaration, or omit it entirely if you don't need to disclose anything. This applies to new uploads; videos already published need to be updated directly in YouTube Studio.
• Fixed broken accounts examples across the docs and website: Every code sample that showed "accounts": ["facebook"] or similar network names has been replaced with working examples. Those samples would return a 400 error or a silent partial publish if copied as-is, since accounts must be referenced by account ID or username, never by network name. Fixes cover the getting-started guide, per-network configuration pages, comparison and idempotency examples, and the MCP tool reference.
• Corrected guidance on which networks need your own developer app: Documentation for Facebook, Instagram, LinkedIn, Pinterest, Threads, TikTok, and YouTube now leads with the fact that these are covered by our managed keys, so most integrations don't need to register a developer app at all. Bring-your-own-key is now clearly presented as an optional white-labelling path rather than a requirement. Missing disclosure callouts were also added for networks that do require your own keys (Google Business Profile, X).
• Fixed dead links in the network configuration docs: Several links to the configurations index and to individual network pages (including Bluesky and Pinterest, which were missing from the index entirely) were pointing to the wrong path and returning a 404. All configuration pages are now reachable from the index.

• Per-network content overrides: You can now specify different post text for individual networks while keeping a shared body for the rest. Character limits are validated per network at request time, so a post tailored for X and a longer version for LinkedIn can both go out in the same request.
• Longer, more reliable connect flow: The window to complete connecting a social account now extends to 30 minutes, up from as little as 5-10 minutes. This gives extra time for cases like converting a new Instagram account to Professional, handling 2FA prompts, or working through a platform's security checkpoint.
• You'll always hear back from a connect attempt: Previously, if a connect flow ran past its time limit, your server would receive neither a success nor an error redirect, and no account would appear in /v1/social-accounts even though your tenant_id was submitted. Connect attempts now always redirect back to you with a result, success or error.
• Fixed silent failures on LinkedIn, Google Business, Threads, and YouTube: Failed connect attempts on these networks now redirect to your configured redirect_uri with an error, instead of silently landing on our own dashboard or failing without explanation.

• Lower TikTok posting ceiling: The global quota for TikTok posts has been reduced from 1000 to 500. If you post to TikTok at high volume, plan your throughput against the new ceiling.
• Vimeo setup guide published: Vimeo requires you to register your own developer app, but until now we had no configuration guide for it. There's now a full setup page covering prerequisites, redirect URI, scopes, post fields, upload behavior, rate limits and token management.
• TikTok and Bluesky docs corrected: These pages previously told you to register your own developer app for TikTok and Bluesky. Both are covered by our managed keys, so you no longer need your own app for either — Bluesky's page now walks through the one real setup step, creating an app password.
• Accurate claim on our X (Twitter) page: Our X page previously implied we manage the X developer app on your behalf. We don't — X requires you to bring your own paid developer app and OAuth credentials. We've corrected the copy; we still handle the OAuth flow and token refresh for you.
• Real numbers on our homepage: A display bug could show 0% uptime and 0ms response time to visitors who hadn't scrolled the page (including automated readers and link previews). The real, measured figures now show immediately.

• Higher TikTok posting quota: The global ceiling for TikTok requests has been raised from 100 to 1000, so teams with higher posting volume are far less likely to hit a rate limit.
• Faster blog and changelog pages: Images on our blog and changelog now load noticeably faster, with retina displays seeing over 50% smaller downloads and a wasted redirect removed from every image request.

• Pending OAuth connection endpoints now require an API key: GET /v1/social-accounts/pending/:sessionToken and its /finalize counterpart previously accepted only the session token from the OAuth redirect, which could expose page access tokens and let a leaked link attach accounts to your org. Both now require an API key scoped to the same org as the session, and the page-picker response no longer includes access tokens. If you call these endpoints directly, make sure requests include your API key; our official SDK and demo app already do.
• Instagram messages sent outside Outstand now appear in your conversations: replies or messages sent from the Instagram app or directly through the Graph API are now ingested and stored as outbound messages, so conversation threads reflect the full exchange instead of only the messages sent through our API.
• New setup guides for Zapier, Make, and n8n: the MCP setup docs now include step-by-step connection details, including the server URL, bearer token, and correct transport setting, for each of these platforms, along with guidance on scoping and revoking API keys used with third-party tools.

• Delete your account from Settings: A new "Delete account" option in Settings lets you permanently remove your account without contacting support. Confirming it cancels any active subscription, removes the organizations you own along with their connected social accounts and API keys, and signs you out. If your account is shared with other members, deletion is blocked and we tell you which organization needs to be transferred or emptied first, so you never accidentally destroy someone else's posts or connections.

• Instagram DM sends work again: Sending a direct message reply on Instagram no longer fails outright. Instagram's messaging platform has no concept of a threaded reply on outbound sends, so we removed the unsupported reply option that was causing every reply attempt to be rejected.
• No more stuck "pending" messages: If a message send fails to queue, it's now correctly marked as failed instead of staying stuck in a pending state forever. If you're polling for message status, you'll now reliably see failures instead of an orphaned pending message that never resolves.
• YouTube added to unsupported comment networks list: Our documentation now correctly lists YouTube alongside TikTok, Pinterest, and Google Business Profile as networks where comment replies and fetching replies aren't yet supported, so you know what to expect before integrating.

• Instagram DMs now reach your inbox: Inbound Instagram Direct Messages were being silently dropped due to a mismatch in how Instagram accounts were identified. Messages now correctly match to the connected social account, so conversations arrive as expected.
• Instagram accounts are automatically subscribed to messaging on connect: Previously, granting message permissions during connect did not actually enable delivery, so newly connected accounts received no Direct Messages at all. Accounts are now subscribed automatically as part of the connect flow, and the exact permissions granted are recorded accurately.
• Correct inbox isolation for shared Instagram accounts: If the same Instagram account is connected across multiple separate organizations, incoming messages are now correctly routed only to the organization that owns that connection, preventing messages from crossing into the wrong inbox.
• Instagram OAuth token exchange no longer logs sensitive tokens: Access tokens returned during the Instagram connect process are no longer written to application logs, reducing exposure of sensitive credentials.

Note: accounts connected before this release need to be reconnected once to receive inbound Instagram messages.

• Update your email from Settings: You can now change the email address on your account directly from /app/settings instead of asking an admin to do it for you. For security, the change is confirmed in two steps: a link goes first to your current address to approve the request, then a second link goes to your new address to finish the switch and verify it. If your current address was never verified, you'll just get a single link at the new address to complete the change. Links expire after an hour, so be sure to click through promptly.

• Manage Instagram DM conversations: New endpoints let you list conversations, fetch conversation details, and read or send messages for any connected Instagram account, all through the same API-key auth and cursor pagination you already use.
• Send rich messages: Outbound messages support plain text, images, video, audio, links, multiple images in a single send, media-only messages, and replying directly to a specific inbound message.
• Mark conversations as read: A single call marks all inbound messages in a conversation as read and clears the unread count.
• Schedule messages and cancel before they send: Set a future scheduled_at on an outbound message and cancel it any time before it goes out.
• Reply outside the normal time window: Instagram limits free-form replies to 24 hours after a contact's last message. Tagging a send as a human agent response now extends that window to 7 days for support-style conversations.
• Real-time delivery events: New webhook events (conversation.started, message.received, message.sent, message.read, message.failed) let your systems react to conversation activity as it happens, including reliable delivery of read receipts.
• Instagram OAuth fix: Removed a messaging permission from the default Instagram connection scopes that could have broken sign-in before it was approved by Meta.

• Publish to Facebook Stories: Post a single image or video directly to a Page's Story by setting publishAsStory: true in your Facebook configuration, mirroring the same option already available for Instagram. Since Stories don't support captions, comments, or mentions, we'll reject those clearly at submission time rather than silently dropping content you wrote.
• Publish to Facebook Reels: Set publishAsReel: true to publish a video as a proper Facebook Page Reel instead of a standard Page video, so it gets Reels-specific treatment and placement on Facebook. No extra permissions or re-authorization needed.
• Story analytics that degrade gracefully: Analytics for a published Story work as expected while it's live; once a Story expires after 24 hours, requesting its metrics now returns a clear "expired" result instead of an ongoing error.
• Media-only posts are now valid: You can submit a post container with only an image or video and no caption text, without needing a workaround. Fully empty containers (no caption and no media) still return a clear validation error.
• Facebook settings now reachable through MCP tools: Facebook-specific configuration, including page mentions, can now be set when posting through MCP tools; previously this was silently unavailable there.

• Clearer scheduling limits: Posts can now only be scheduled up to 30 days in advance. If you try to schedule further out, you'll get an immediate, clear error instead of a silent failure later.
• Better feedback on scheduled posts: Responses for scheduled posts now include the scheduling status and a message, so you can confirm at a glance whether your post was successfully queued.
• More reliable scheduling error handling: If scheduling a post fails, you now get an informative response explaining what went wrong, so you can retry or adjust as needed.
• Correct aspect ratios for Bluesky images: Images posted to Bluesky now preserve their correct dimensions and aspect ratio, so your embeds display exactly as intended.
• Fixed broken Google Business Profile setup link: The link for requesting Google Business Profile API access in our docs now points to Google's current request form instead of a broken page.

• Reply to a specific comment on Threads: Replies now target the exact comment you're responding to instead of always landing as a new top-level reply on the post. Threads supports nesting to any depth, and your replies will now show up in the right place in the conversation.
• Accurate hidden/visible status for Threads comments: A comment that had been hidden now correctly shows as hidden right away, instead of appearing visible until you toggled it again.
• Nested reply structure documented in the API reference: The API reference and generated client libraries now correctly represent Threads' unlimited reply nesting, instead of describing it as a single level like Facebook, Instagram, and LinkedIn.
• Connect Outstand to Grok Bot: Grok Bot can now be added as an MCP connector. A new setup guide walks through pasting your MCP URL into a chat message and completing the sign-in prompt, with no manual API key entry required.

• Fixed Facebook analytics for video and single-photo posts: Requests to GET /v1/posts/:id/analytics for Facebook video and single-photo posts no longer fail or return metrics: null. These post types now also return impressions, reach, and click data for the first time, alongside likes, comments, and shares. When shares data is temporarily unavailable, it now shows as a measured zero with a clear unavailable_fields flag instead of breaking the whole response.
• More accurate error reporting for deleted Facebook posts: Analytics requests for posts that have been deleted on Facebook now correctly report a "post not found" error instead of being incorrectly flagged as a missing permission issue.
• Clarified bring-your-own-key setup for Google Business Profile: Documentation now more clearly explains the bring-your-own-key requirements for connecting Google Business Profile.

• Manage Threads replies: New default permissions let you read, manage, and delete replies on Threads posts, so you can build full reply moderation and engagement features without asking users for extra authorization steps.
• Custom scope setups keep working: If you already configure custom OAuth scopes for Threads, your existing setup continues to work exactly as before.

• LinkedIn media captions: You can now include an optional caption when posting media to LinkedIn, giving you more control over how your content is presented alongside images and videos.

• Out-of-cycle invoicing for high usage: New subscriptions are now invoiced automatically once accrued usage charges reach $50 within a billing cycle, instead of accumulating everything into a single invoice at the end of the month. Your regular monthly invoice date does not change, this simply adds an interim invoice so charges are settled sooner and balances stay predictable as usage grows. This applies to new subscriptions going forward; existing subscriptions are unaffected.

• Threads posts over 500 characters are now rejected immediately: Creating or updating a post that targets a Threads account now fails fast with a clear 400 error if any container exceeds Threads' 500-character limit, instead of silently succeeding and failing later at publish time with a raw error from Meta. The error message tells you exactly which containers are too long and by how much. This applies whether you're posting to Threads alone or cross-posting to multiple networks at once, and covers both the REST API and MCP tools. Character counts are based on visible characters, so emoji and other multi-byte characters are counted the way you'd expect.
• Edit tenant IDs and see account IDs directly in the dashboard: Social accounts connected through the dashboard could previously only get a tenant ID at connect time via the API, leaving web-connected accounts stuck with no way to organize them by tenant short of disconnecting and reconnecting. You can now set or clear an account's tenant ID directly from the accounts page using a new edit button. Each account row also now shows its public ID (the same id format used in API responses, webhooks, and MCP output) with click-to-copy, making it easy to match a dashboard row to what you see in your integration.
• Platform counts across our site and docs now correctly say 12: Reddit shipped as our 12th supported network, but several customer-facing spots, including the homepage headline, the platforms section, the shared preview image, docs, and API descriptions, still referenced 11 or fewer platforms and sometimes omitted Reddit from lists entirely. All of these now consistently reflect all 12 supported platforms.

• Post and engage on Reddit: Publish text and link posts to any subreddit, with support for flair, NSFW/spoiler tags, and reply preferences. Multi-part posts are supported too, publishing follow-up parts as a comment chain under your post.
• Manage Reddit comments: Publish replies, read the full comment tree on a post, and delete comments, all through the same API you use for other networks.
• Track Reddit performance: Pull public post metrics (score, upvote ratio, comment count) and a karma snapshot for the connected account, plus import a history of previously submitted posts.
• Reddit requires your own app credentials: Reddit is a Bring-Your-Own-Key network, so you'll need to register your own Reddit application to connect accounts; Outstand does not offer managed keys for Reddit.
• Clearer guidance on which networks need your own keys: Docs now call out that X, Google Business Profile, Vimeo, and Reddit require your own app credentials, while the other 8 supported networks work with Outstand's managed keys, so there's no more ambiguity when connecting an account.

• MCP server on the newest protocol revision: The MCP server now supports the latest protocol revision (2026-07-28). Existing clients on the previous revision, including Claude's connector, continue to work exactly as before with no changes required on your end.
• Fixed browser-based MCP clients failing to connect: A missing set of headers in cross-origin requests was silently blocking browser-based MCP clients from connecting at all. This is now fixed.
• Fixed OAuth discovery returning 404: Clients doing OAuth resource discovery against our MCP server's protected resource path were getting a 404 instead of the metadata document. Discovery now works correctly, including additional metadata like supported scopes and a link to documentation.
• Structured output on every MCP tool: All 28 MCP tools now return a structured, machine-readable result alongside the existing text output, so clients that support the new revision can consume results directly instead of parsing text.
• Clearer tool titles and behavior hints: Every tool now carries a human-readable title and accurate annotations, so MCP clients can correctly show which actions are read-only versus which make changes, and which changes are destructive.
• Corrected MCP documentation: The MCP README and docs now correctly list all 28 tools (previously showing 26 and missing two), the correct port, an up-to-date authentication section, and the correct platform count of 11, including Vimeo which had been missing from the list.
• Claude Code Plugin documentation: Added a new documentation page covering installation, features, and commands for the Claude Code Plugin, with links to it from the docs navigation and llms.txt.

• New Posts page: See what's about to go out and what already has, right from your dashboard. Switch between a chronological Queue (split into Upcoming and History) and a full month Calendar, so you can finally answer "what's coming up?" and "did that land?" without going back to the API.
• Full post content in the calendar: Click any post in the calendar to see everything in it, not just a one-line snippet. Multi-container posts show every reply in order, attached images and video render as preview tiles, and long text expands with a Show more / Show less toggle. This same detail view is also available from the Queue.
• Draft posts no longer clutter your calendar: Drafts were showing up on the calendar dated by when they were created, inflating day counts with posts that were never actually scheduled. They're now hidden from the default view and only appear when you filter specifically for drafts.
• Fixed a visual glitch on the dashboard: The marketing site's wordmark was briefly bleeding through the sidebar on the Posts page, and the sidebar background was rendering the wrong shade throughout the dashboard. Both are now fixed.
• TikTok Business API plan: A new plan tier is available for customers who need TikTok's business API access.

• Better authentication error detection for Facebook and Instagram: Errors from Meta's API are now recognized more accurately, including its distinct authentication error codes, so expired or invalid tokens are correctly flagged instead of being misclassified. This means health checks on your connected Facebook and Instagram accounts are more trustworthy, and you get clearer signals when a reconnection is actually needed.

• AI content disclosure for Instagram: You can now mark Instagram media as AI-generated using a new isAiGenerated field, available for feed posts, Reels, carousels, and Stories. Instagram will surface this with an "AI info" label, helping you stay compliant with content labeling requirements and keep your audience informed.
• Invoice history in billing settings: Your billing settings page now includes an Invoices panel showing your past charges, so you no longer need to leave the app to check billing history. History remains visible even if your subscription is cancelled or past due, and each invoice links to both a hosted view and a downloadable PDF.
• More reliable TikTok publishing: TikTok enforces a shared cap on distinct creator accounts that can post within a 24-hour window. Publishing now checks against this quota before attempting a post, reducing failed or rejected publishes tied to TikTok's platform-wide limits.
• Clearer errors for expired Instagram Story insights: When Instagram Story insights are no longer retrievable because they've expired, the API now returns a specific, clearer error instead of a generic failure.
• Fewer false alarms on metrics retrieval: Error handling for Facebook and Threads metrics now distinguishes recoverable issues from real permission problems, cutting down on noisy errors during normal account states.
• Updated Terms of Service: Our Terms of Service have been updated to reflect current API rate limits.

• Story-specific metrics: Requesting metrics for Instagram Stories now returns replies, profile visits, and navigation actions, giving you insight into how people interact with Stories specifically.
• Accurate metrics for Stories: Since Instagram Stories don't support likes, comments, or saves, those fields now correctly return null instead of misleading zero values.
• Clearer error messages for expired Stories: If you request metrics for a Story after its 24-hour insight window has expired, you'll now get a clear, properly classified error instead of a confusing failure.
• Updated documentation: API docs now clearly explain the differences between Story metrics and standard post metrics, including the 24-hour expiration window for Story insights.

• Deleted posts no longer reappear: Removing a post that was live on multiple networks used to show it again after refreshing the published posts list, even though it was truly gone from the network you deleted it from. The list now correctly reflects deletion status per network, so a post only disappears entirely once it's been removed from all the networks it was published to, and stays gone.

• Try the API live at test-ui.outstand.so: A new hosted demo scheduler lets you paste in your own API key and try posting, scheduling, and managing accounts through the Outstand API directly in your browser, no setup required. Your key stays in your browser session and is never stored on our servers.
• Threads "Who can reply" setting now works in the demo: Fixed an issue in the demo scheduler where the reply-control selector for Threads posts displayed a value but didn't actually apply it when posting.
• Facebook page post fetching stays reliable long-term: Updated the Facebook Graph API version used for fetching page posts so this endpoint won't be affected by Meta's upcoming API sunset, keeping page post retrieval working without interruption.
• Consistent tool counts across all documentation: Our docs, landing page, and integration guides now consistently report the accurate number of available MCP tools (28), so you can trust the numbers no matter where you look.

• No more accidental double subscriptions: If a payment fails and your subscription goes past-due, you'll now see a clear "payment failed" warning with a link to update your card, instead of being prompted to start a brand new subscription. This closes the gap where retrying checkout could leave you paying for two plans at once while the failed one is still unresolved.
• Cancelling your subscription no longer disconnects your accounts: Previously, a cancelled or lapsed subscription could remove your managed social credentials and, with them, every social account connected through them. That connected-account teardown has been disabled, so cancelling a plan no longer risks losing your connections.
• New guide to passing TikTok's Direct Post audit: TikTok requires apps to pass its Content Posting API audit before Direct Post works without restrictions. We've published a step-by-step guide covering the application checklist, a demo video shot list, the exact UI text reviewers look for, and common mistakes to avoid.
• New known issue page for TikTok's active creator cap: If you're hitting reached_active_user_cap on TikTok, a new known-issues page explains why: the cap counts distinct creators (not posts), applies at the app level rather than per organization, and rolls over gradually rather than resetting all at once.
• Instagram media import kept on a supported API version: Instagram media fetching now runs on a newer, longer-supported version of Meta's API, avoiding a future disruption to media import as the older version approaches its retirement date.

• Facebook post analytics now show real impressions, reach, and engagement rate: Previously, Facebook posts always reported zero impressions, zero reach, and no engagement rate because those metrics were never actually requested from Facebook, even though the analytics response advertised them. That data now comes through correctly, and likes/comments/shares are untouched if the extra metrics ever fail to load.
• Facebook Page-level insights no longer show false "not enough activity" messages: Facebook retired several Page metrics we were still requesting, and the failed request was being silently turned into all-zeros with a misleading note about low activity. Page insights now use the current metric names and report the real reason if a metric can't be measured, instead of masking it as low engagement.
• Engagement rate on Facebook posts now reflects total reactions, not just Likes: The engagement calculation now includes all reaction types (Love, Haha, Wow, etc.), not just the Like reaction, so it better matches what you'd see in Facebook's own Page tools.
• Instagram and Facebook connections now request broader default permissions: New connections request instagram_business_manage_comments on Instagram and read_insights on Facebook by default, enabling comment management and analytics access without extra configuration. Accounts connected before this change keep their existing permissions and will pick up the new ones the next time they reconnect.

• Force account selection when connecting a network: Most networks were silently reusing whatever account was already signed in on the browser, so connecting a second account often just re-authorized the first one. Pass a new force_account_selection flag to POST /v1/social-networks/:network/auth-url (also available on the get_auth_url tool) to make the network show its account picker instead. Supported today for TikTok, Facebook, Instagram, YouTube, and Google Business Profile, with no effect on networks that don't support it, so you can send it unconditionally. Existing integrations are unaffected when the flag is left off.
• tenant_id now included on every social account response: Connecting a Bluesky account without passing tenantId previously created the account with a null tenant and gave no indication anything was missing, which could later cause tenant-filtered lookups to come back empty with no explanation. The Bluesky connect response, and account list responses, now consistently include tenant_id so you can catch a missing tenant immediately instead of debugging it downstream.
• Fixed missing and duplicate accounts when paginating GET /v1/social-accounts: Paging through accounts with limit/offset could skip some accounts entirely and return others twice, especially on orgs with many accounts under active token refresh. Results are now returned in a stable order, so paginating through your accounts returns every account exactly once.

• Safe retries on POST /v1/posts: Send an Idempotency-Key header with your post creation requests and retry safely if a request times out or your connection drops. A retry with the same key and body returns the original result (marked with Idempotency-Replayed: true) instead of creating a duplicate post. Reusing a key with a different body returns a 422, a request still in flight returns 409 with Retry-After, and keys expire after 24 hours so you can reuse them for a genuinely new request. If a post was created but publishing hadn't been scheduled yet when a retry comes in, we return that post as-is rather than scheduling it again; use PATCH to set a scheduledAt when you're ready.
• Fixed tenant isolation for Facebook and LinkedIn connections: Accounts connected through the dashboard with a tenant_id for Facebook or LinkedIn are now correctly tagged with that tenant, matching how Google Business connections already worked. Previously these accounts lost their tenant association, so they could be missing from tenant-filtered account and post lists, and reconnecting the same account under a tenant could create a duplicate entry.

• Filter posts by tenant: GET /v1/posts now accepts a tenant_id (or tenantId) filter, matching what GET /v1/social-accounts already supported. Multi-tenant apps no longer need to fetch every tenant's accounts and filter posts client-side - the API does it for you, returning each matching post with its full list of connected accounts.
• Filtered post pages are now complete: Filtering posts by social_account_id could previously return a short page (e.g. 3 posts for limit=50) even when more results existed, because the filter was applied after pagination. Paged, filtered results are now always full and correct.
• Accurate pagination totals: pagination.total now reflects the real number of matching posts instead of just the number returned on the current page, so you can reliably tell how many results exist across all pages. The previous page-length value is still available as pagination.count.
• Encoded account IDs now filter correctly: Filtering posts by social_account_id using the encoded IDs returned elsewhere in the API previously matched the wrong account under the hood. Both encoded and numeric IDs now work as expected, and invalid IDs return a clear error.
• Reconnecting an account no longer creates duplicates: Reconnecting the same social account - even after its underlying platform identifier changed (a recreated page, a re-registered handle, etc.) - now updates the existing connected account instead of creating a duplicate with stale credentials. Reconnecting under a different tenant still creates a separate account, as intended.
• Bluesky reconnect no longer fails on repeat connect: Connecting a Bluesky account you'd already connected previously returned a conflict error; it now succeeds and updates the existing connection.
• Auth tokens are no longer exposed in API responses: Stored credentials (OAuth tokens, Bluesky session tokens, app passwords, and similar secrets) could previously appear in responses from fetching a single post, the MCP get_post tool, and the web accounts page. These fields are now stripped from every response by default; the existing opt-in includeTokens parameter on the accounts list endpoint is unaffected.
• Automatic rich text in Bluesky posts: Links, mentions, and hashtags in Bluesky post text are now automatically detected and turned into proper rich-text links, including resolving mentions to the correct account.
• More reliable Bluesky account connection: The connection flow now keeps your session alive for longer during setup and no longer clears your session on recoverable errors, so a retry doesn't force you to start over.

• Partial updates no longer wipe your platform settings: Sending a partial update to PATCH /v1/posts/:id (or the update_post MCP tool) that only touches one field of a network's config, like TikTok's disableComment, used to silently erase every other field you'd set for that network, including things like privacy level and post mode. These updates now merge field-by-field within each network's config, so untouched settings are preserved.
• Unrecognized config fields now trigger a warning: Typos or wrong casing in platform-specific config (like post_mode instead of postMode, or a tiktok field that doesn't exist) were previously stripped silently, sometimes causing a post to land as a draft instead of publishing. Both post creation and updates now warn on unrecognized keys anywhere inside a network's config block, with a suggestion when your key is a close match to a real one.
• Clearer API errors when a subscription lapses: Requests to the API or MCP server from an organization without an active subscription now return a clear 402 Payment Required response with a link to your billing page, instead of continuing to work indefinitely or failing with confusing errors. Access resumes immediately once your subscription is active again.
• Faster, more reliable TikTok post lookups: GET /v1/posts/:id now saves the resolved TikTok video ID the first time it's looked up, instead of re-resolving it on every request. Post URLs and future lookups are quicker as a result, with no change in behavior for you.

• Update posts instead of deleting and recreating them: A new PATCH /v1/posts/:id endpoint (and matching update_post MCP tool) lets you change a scheduled post's content, media, platform-specific config, or publish time without losing the post id. Every field is optional and only what you send changes; platform config is merged per network, so updating TikTok settings leaves your YouTube settings untouched. Posts that have already published (fully or to any account) return a clear 409 instead of silently doing nothing.
• Require two-factor authentication across your organization: Owners and admins can now turn on "Require two-factor authentication" from the team page, once every member already has it enabled. The switch names anyone still missing 2FA. Once enabled, no member can disable their 2FA and no invitation can be accepted without it, both enforced server-side.
• See who has 2FA enabled on your team: The team page now shows a two-factor status column for every member, along with passkey counts for context.
• Accepting an invite with 2FA required now works in one pass: Completing the inline two-factor setup on the invitation page now correctly reveals the Accept/Decline buttons right away, instead of requiring a manual page reload.
• Banned users now see why: If your account has been banned, the login error now includes the reason your admin recorded, along with the expiry date if the ban is temporary.
• Pricing is now readable by AI agents: The full pricing model, including billable-post definitions, tier costs, and the Unlimited Posting add-on, is now published as plain markdown at outstand.so/pricing.md for agents and LLM crawlers to read directly.

• Two-factor authentication and passkeys: A new Security settings page lets you enable TOTP-based two-factor authentication with backup codes, or register a passkey for passwordless sign-in, and see at a glance which sign-in methods are active on your account.
• Sign in with a passkey: The sign-in page now offers a "Sign in with a passkey" option alongside password sign-in, and accounts with 2FA enabled are guided through a dedicated verification step.
• Clearer messages for banned accounts: If your account has been banned, the sign-in error now shows the actual reason (and expiry date for temporary bans) instead of a generic message.
• Fixed TikTok posts silently hitting the account cap: Video posts that didn't explicitly set a post mode were incorrectly going through TikTok's Direct Post flow, which is capped at 5 creators per day on our shared TikTok app. These now correctly land as drafts in the creator's TikTok inbox, avoiding the cap. Note that this changes default behavior: draft posts don't go live automatically, don't carry a caption for video, and won't have analytics until the creator publishes them from the TikTok app.
• More actionable TikTok error messages: Publishing errors from TikTok (rate limits, spam checks, unverified accounts, and more) now come with clear guidance instead of a raw error code.
• Fewer failed TikTok uploads: TikTok now pulls video and image media directly from your media library instead of requiring a separate file upload, and the maximum upload size has increased, reducing upload failures.
• Bigger Bluesky image uploads: The maximum image size for Bluesky posts has increased from 1MB to 2MB, matching Bluesky's current limits.
• Improved OAuth/OpenID compatibility: Added a JWKS endpoint and updated OAuth discovery metadata, fixing discovery errors for OAuth and MCP clients that follow the OpenID Connect Discovery spec.

• TikTok posts default to drafts for review: If you don't explicitly set a post mode when posting to TikTok, your posts now land in the creator's inbox/drafts for review instead of publishing immediately. This matches TikTok's recommended flow for most integrations. If your integration depends on posts publishing immediately, set postMode explicitly in your request to keep that behavior.
• Fixed a login issue that could cause an endless loading spinner: After signing in, some accounts could get stuck on an infinite spinner on Connected Accounts and other pages, especially after signing out and back in. Signing in now correctly refreshes your organization data, and if no organization is selected, you'll see a clear message instead of a page that never finishes loading.

• Fixed link preview images: Shared links to our docs and website now show the correct preview image when posted in Slack, Twitter, or other apps that render link previews.
• Correct organization selected on login: When you log in, you're automatically taken to the right organization instead of having to switch manually.
• New banner for expired account connections: If one of your connected social accounts loses access, a banner now appears prompting you to reconnect it, so you can catch and fix expired connections before they cause missed posts.

• Control who replies to your Threads posts: Set a reply control option when publishing to Threads so you can choose who is allowed to reply to each post.
• Delete comments on Threads and Instagram: Remove unwanted comments directly through the API on both platforms.
• Hide or unhide comments on Instagram and Threads: Toggle the visibility of comments without deleting them, giving you a lighter touch for moderating conversations.
• Manage pending replies on Threads: Review pending replies on your Threads posts and approve or ignore them before they go live.

• Priority Support plans, laid out clearly: The support page now shows a full breakdown of Priority Support tiers, including what each tier includes, pricing, and billing details, so you can compare options and pick the plan that fits your team.
• More ways to reach us: A dedicated section makes it simple to contact the team directly by email or Slack Connect, right from the support page.
• A cleaner support page overall: The layout has been refined throughout for easier browsing and a better experience when you're looking for help.

• X account engagement is no longer null: GET /v1/social-accounts/:id/metrics now returns real engagement totals (views, likes, comments, shares, quotes) for X accounts, calculated from the account's own posts in the requested date range. Previously this field always returned null since X's free tier doesn't expose engagement totals directly. Note that X bills this lookup against your own connected app at roughly $0.005 per post (up to ~$2.50 per call), and if X's rate limits or API tier block the request, engagement gracefully falls back to null with an explanatory note instead of failing the whole call.
• Pinterest account engagement is no longer null: The same metrics endpoint now maps Pinterest's existing analytics data into the standard engagement object, giving you views, saves, pin clicks, and outbound clicks instead of an empty field. Full raw analytics remain available for anyone who needs the extra detail.
• "Powered by Outstand" badge: A new embeddable badge is available for customer sites, with light and dark theme variants. Documentation now includes previews on different backgrounds along with ready-to-use HTML snippets.

• TikTok comment limitations documented: The TikTok configuration guide now explains that posting and reading comments, replies, and first-comment containers isn't available for TikTok accounts, along with what is available instead, such as disabling comments at publish time and viewing comment count analytics.
• Network support note for first comments: The first-comment guide now lists which networks don't support a comments API, including TikTok, Pinterest, and Google Business Profile, and clarifies that your root post still publishes successfully even if a first-comment reply targets one of these networks.
• API reference reflects comment restrictions: The reply endpoint descriptions in the API reference now call out which networks are unsupported, so you can catch limitations while reading the docs instead of hitting an error at runtime.

• Alt text for media: Add alt text to images and other media attached to your posts, improving accessibility for your audience. Supported across platforms, including Bluesky.
• PDF uploads to LinkedIn: You can now attach PDF documents to LinkedIn posts. They're automatically detected and rendered as native document posts.
• More reliable Bluesky posting: Session handling for Bluesky accounts has been improved, reducing the chance of failed posts due to expired credentials.
• Clearer errors on post creation: The API now warns you when a post request includes unrecognized fields, helping you catch mistakes before they cause issues.
• Simplified account targeting: Target accounts using the new accounts field, which lets you reference connected accounts by network name or username instead of the old socialAccountIds field.
• Billing cycle visibility: Organization details now include your billing cycle, so you can see when it renews at a glance.
• Updated X posting requirements: Documentation now clarifies that, starting February 2026, new developers need an active access plan on the POST /2/tweets endpoint to post to X.

• Post URLs now available for all networks: Every publish, analytics, and import response can now include a direct link to the published post, not just for Instagram. Facebook, LinkedIn, YouTube, Bluesky, X, Pinterest, Threads, TikTok, Google Business Profile, and Vimeo all now return a platformPostUrl so you can link straight to the live post without building the URL yourself.
• More reliable X media uploads: Uploading media to X is now more robust, with better handling of different response formats so media IDs are picked up correctly and issues are easier to diagnose if an upload fails.
• Smoother API key setup: API key creation now reflects your subscription status more accurately, with clearer loading states and button behavior so you're not left waiting or confused about whether you're able to create a key.

• Large Pinterest videos now upload reliably: Pinterest videos are streamed to Pinterest instead of being loaded into memory all at once, so large files (up to Pinterest's ~2 GB limit) no longer fail to upload. Upload failures are now also reported clearly instead of showing up later as a confusing timeout.
• Repost or reshare posts from MCP clients: A new repost_post tool lets MCP clients reshare an already-published post to the networks it was posted to, with an optional quote/commentary on networks that support it (X, Bluesky, LinkedIn, Threads).
• Sign in to MCP with one click: In addition to API keys, you can now connect to the MCP server with one-click OAuth sign-in from ChatGPT, Claude, Cursor, or any client that supports remote MCP connectors. API keys remain supported for CLI and headless setups.
• Pinterest profile pictures now load correctly: Pinterest avatars, served from Pinterest's own CDN, now display properly on the accounts page instead of showing as broken images.
• Clearer media requirements and rate limits per network: Each network's configuration guide now documents its media requirements (file size, formats, duration, dimensions, text limits) and publishing rate limits, cross-referenced against each platform's official documentation, so you can plan uploads and posting frequency with confidence.

• Repost existing posts: A new endpoint lets you reshare an already-published post across connected networks, with optional added commentary, so you can amplify content without recreating it from scratch.
• Custom Instagram Reel cover images: You can now set a custom cover image and thumbnail offset when publishing Reels, so your Reels grid looks intentional instead of relying on an auto-picked frame.
• No more double-billing on plan switch: Legacy subscribers who previously added the standalone Managed Keys add-on and then switch to the new plan (which bundles Managed Keys for free) are no longer charged for it twice.
• Redesigned dashboard and account pages: The dashboard, sign-in and account screens, settings, billing, API keys, webhooks, and accounts pages all got a visual refresh for a cleaner, more consistent look.
• Unlimited Posting add-on is easier to find: The Unlimited Posting add-on is now promoted directly in the web app so you can discover and enable it without digging through settings.
• Faster docs updates: Documentation changes now go live noticeably faster.
• Legible code samples in light mode: Code blocks and inline code chips on documentation pages now render with proper contrast in light mode instead of dark text on a dark background.

• Large video uploads to YouTube and LinkedIn now succeed reliably: Previously, large video files could fail to upload to YouTube or LinkedIn due to memory limits. Videos are now uploaded in small pieces instead of all at once, so even large files post successfully.
• Copy improvements across the board: Various wording and messaging updates throughout the product for clarity.
• No more duplicate charges when upgrading your plan: Customers who previously added the standalone Managed Keys addon and then migrated to a plan that includes it for free will no longer be billed for both the addon and the bundled feature.

ps: as you might have noticed, we have started following a new Changelog-reporting format, using dates.

• Instagram post links in your API responses: Every Instagram post now includes a platformPostUrl field with the live permalink to the post, available when you fetch a single post, list posts, or receive the post.published webhook. If a permalink can't be fetched for any reason, publishing still succeeds and the field simply returns null.
• Post links in analytics too: The analytics endpoint (and the corresponding MCP tool) now returns the Instagram permalink as platform_post_url alongside your other metrics.
• Older Instagram posts get their links filled in automatically: If you fetch analytics for an Instagram post published before this feature existed, we now fetch and save its permalink on the fly so it shows up in that same response going forward, no action needed on your end.
• Clearer error when importing personal LinkedIn accounts: Attempting to import posts for a personal LinkedIn account (rather than a company page) now fails immediately with a clear, human-readable error instead of silently failing later. Our docs also now note that this permission isn't currently available for personal accounts.

• Large YouTube uploads now succeed: Videos that previously failed to upload due to an internal memory limit now stream reliably regardless of file size, so long or high-resolution videos published to YouTube no longer get stuck or error out.
• Instagram Reels views metric: You can now fetch the views count for Instagram Reels as part of media insights, giving you a fuller picture of Reels performance alongside your other engagement metrics.
• More reliable TikTok metrics: TikTok metrics fetching has been improved for better accuracy and reliability when pulling post performance data.
• New "Building a Social Media Scheduler" guide: A step-by-step, copy-paste walkthrough for authenticating, scheduling posts, listing your queue, and interpreting per-account outcomes, with full TypeScript and Python examples, plus corrected request/response examples in the Quick Start.
• New architecture explainer: A new "How It Works: Architecture" page walks through how posts flow from request to publish, including synchronous vs. asynchronous handling, partial-success behavior, rate limiting and retries, and what to expect for scheduling accuracy and performance under load.
• New developer quickstart, platform list, and pricing guide: A one-page quickstart for connecting an account and creating your first post, a clear table of supported platforms, and worked cost examples at 1k, 10k, and 100k posts per month to help you estimate integration effort and spend.
• Refreshed MCP and white-label pages: The MCP and white-label landing pages have been updated to our latest design.

Changelog

- Added TikTok Managed Keys

- Improved the Facebook Page health check returning accurate health status for Facebook Pages

- Added per-account publish results: multi-account publishes now return an individual success/failure result for each target account instead of a single combined status

Changelog

- Added LinkedIn page mention validation: rejects posts where the mention text doesn't match the organization's exact registered name on LinkedIn (case-sensitive), preventing silent plain-text fallback

- Added Facebook mention validation: rejects posts where the anchor text is missing from comment containers, or where the target page ID is inaccessible

- Moved Facebook page tagging from the post body to comment containers — Meta's Graph API only supports @[pageId] mentions in comments, not feed posts

- facebook.mentions now requires at least one comment container (second containers entry) whose text contains the anchor; posting mentions without a comment container returns a clear error

We're adding Pinterest to the Outstand network lineup. You can now connect Pinterest accounts and publish to them through the same unified API you already use for every other platform.

Connect with zero setup - managed keys

Unlike networks that require you to bring your own OAuth credentials, Pinterest connections run on Outstand-managed keys. There's no Pinterest developer app to register, no client ID and secret to provision - your customers can authorize a Pinterest account and start publishing immediately.

Publish pins - images and video

Create pins through the unified posts API, with full Pinterest options:

• Target a board - choose which board a pin lands on
• Destination link, title, and alt text - set the pin's link, title, and accessibility text
• Video pins - upload video natively. Pinterest doesn't accept a video URL as a source, so Outstand handles the whole flow for you: we download the media, request an upload slot from Pinterest, and upload it - you just pass the media and we take care of the rest.

Manage boards and profiles

New Pinterest-specific endpoints let you work with the account directly:

• Get profile - read the connected Pinterest profile
• List boards - fetch the account's boards
• Create a board - create a new board to publish into

Get started

Connect a Pinterest account from your dashboard or via the API, then publish using the standard posts endpoint with Pinterest options. Full reference is in the Pinterest API docs.

Just added support for custom scopes. That means you can easily use the scopes parameter in the authentication endpoint and customize the default list of scopes for its network that supports it.

Added the ability to invite and manage team members.

Owners and admins of teams can now invite more team members. There is no limit in how many members a team can have.

API endpoint added:

• /v1/social-accounts/:id/health: a specialized endpoint for confirming/validating the health and the connection of a social account - if needed - before use.
• documentation: https://www.outstand.so/docs/check-account-health

Improvemenets:

• Adjustable LinkedIn articles in feed. Content customization is now possible to the extent that LinkedIn API allows. More docs here: https://www.outstand.so/docs/create-a-post
• We have started automatically refreshing profile picture URLs which had been expired. This runs automatically to all connected accounts without any further configuration required.

We've added Pinterest as a fully supported network in Outstand. You can now connect Pinterest business accounts to your organization, list and create boards, publish image pins with titles, descriptions, links, and alt text, and pull pin analytics.

What's new

• OAuth connect flow - one-click Pinterest connection from the Settings → Accounts screen
• Pinterest composer - a dedicated /compose/pinterest page that walks you through selecting an account, picking or creating a board, and publishing a pin with full Pinterest-specific fields: title, description, destination link, and alt text.
• Board management - list a connected user's boards and create new ones (public) from inside the composer.

LinkedIn improvements:

• personal accounts can now pull metrics using the latest LinkedIn APIs
• fixed MCP integration with LinkedIn which resulted in some cases in wrong personal profiles URNs

MCP server fixes:

• posts in some cases were stuck in "pending" mode. This issue has been resolved.

Introduced support for Instagram Stories

• You can now publish Instagram Stories by configuring instagram: { publishAsStory: true }

Add accountId field to webhook payload and post publishing results

- Updated webhook payload structure to include accountId for social accounts.

Added:

• Experimental support for BYOK Google-My-Business has been rolled out

Updated/Fixed:

• Instagram connection failures
• Documentation clarifications for 3-leg auth networks (LinkedIn and Facebook)
• Billing screen improvements and bug fixes, which caused significant toil when managing a subscription

Added (experimental) Bluesky support.

After a short period of Bluesky being unavailable in our platform, it's now back in rotation with a simpler API as well as web UI-first approach for connecting accounts!

Added support for personal LinkedIn profiles.

Fixed issues with media uploads on X (using the v2 endpoints).

TikTok is now available under our Managed Keys offering.

Introducing @outstand-so/ui npm package, delivering extendable React UI components and directly integrating with the Outstand API.

Install with npm i @outstand-so/ui

UI Components included:

• ConnectAccountButton & ConnectAccountButtonGroup
• MediaUploader & MediaList
• CreatePostForm
• OAuthCallback
• PostMetrics and PostsWithMetrics

Hooks:

• useAccounts
• usePosts
• usePostMetrics
• useMediaUpload
• useOAuthFlow
• useOutstandApi

https://www.npmjs.com/package/@outstand-so/ui

Improvements:

• Facebook integration for business Pages.
• CDN integration for media endpoints

Added:

• Media endpoints: now you can add smaller or larger media files, host them and distribute them via our API. This is particularly useful for media-first social channels, eg. TikTok or Instagram.
• Docs can be found here: https://www.outstand.so/docs/get-upload-url

Added:

• Support for tenant_id in the Social Accounts. Now you can attach a tenant id in the social accounts connected via the API and thereafter filter social accounts based on this id. This is a feature primarily interesting for white-labeling and BYOK customers.

Added:

• API-first authentication flow for social channels which include a profile selection step (Facebook and LinkedIn until now)
• • https://www.outstand.so/docs/get-pending-connection-details
  • https://www.outstand.so/docs/finalize-pending-connection
  • Visualized API-first auth flow for LinkedIn and Facebook

Updated:

• Fixed X authentication URLs within our Dashboard UI which led to incorrect state passed down to X API

Updated:

• Rolled out the revamped Facebook integration - now available for BYOK. Using Graph API v24.0 and officially supporting all functions for posts, metrics, statistics and engagement.

Added

• An API endpoint to list the social accounts connected in your organization account. The endpoint is GET /v1/social-accounts.
• Docs for the new endpoint: https://www.outstand.so/docs/list-connected-social-accounts

Today we have a big announcement which caters for all our customers, especially the ones that rely on white labeling solutions: we are introducing a crucial API endpoint which allows you to generate authentication URLs that you can safely share with your customers and maintain your own branding throughout the whole process.

The new API endpoint is documented here: https://www.outstand.so/docs/get-social-network-authentication-url

Added

• YouTube Integration: Full support for YouTube posts and Shorts publishing
• • OAuth authentication handling with minimal permissions required
  • Full video support with listing visibility, tags, categories and age level.
  • Shorts support
  • View docs for BYOK