Facebook — save user access token

Overview

Validate a Facebook user access token via the Graph API debug endpoint and, if valid, persists the FB user details for the company. Used before selecting a page to connect.

Prerequisites

• Either a bearer token in the Authorization header, or the invite hash this endpoint accepts in place of one.

Base URL

Endpoint

POST /api/v1/facebook/access-token/save

Authentication

• A bearer token is optional here. Send one to act as a signed-in user, or supply the documented hash instead.

• Use a bearer token (scoped by an ownership check on company_id).

• OR use an invite hash (no token; company_id is then omitted).

Rate limit

• 30 requests/min per IP (public).

Request body

{
  "user_access_token": "EAABsbCS...userToken",
  "company_id": "<accountId>"
}

How it works

• 200 with a positional message. The payload uses an unusual shape: status plus a numeric-0 message key — {data:{status:"success","0":"User token has been saved successfully!"}}.

Response

200 OK · 200

{
  "data": {
    "status": "success",
    "0": "User token has been saved successfully!"
  }
}

200 Invalid token (empty body) · 200

When the token fails Facebook's validation, the API records the failure and returns an empty 200 response — no JSON body. Treat an empty body as "token rejected".

200 Save failed · 200

{
  "data": {
    "status": "error",
    "0": "Something went wrong!"
  }
}

422 Validation error · 422

{
  "message": "The user access token field is required.",
  "errors": {
    "user_access_token": [
      "The user access token field is required."
    ]
  }
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/api/v1/facebook/access-token/save" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"user_access_token": "EAABsbCS...userToken", "company_id": "<accountId>"}'