Xenon Social Public API

With the Xenon Social Public API you can extend your workflows beyond Xenon Social by integrating with its publishing engine. You can give each of your customers their own workspace, let them connect their social accounts on a page we host, send content directly into Xenon Social from your own product or marketing stack, and get a signed webhook the moment a post goes live or fails.

Building an integration needs someone on your team who’s comfortable with REST APIs. Every endpoint is described in the interactive API reference, and our team can help if the API doesn’t behave as documented.

Use cases

To better understand how to use the API, here are a few common use cases.

Publishing inside your product – Think of a platform for restaurants that wants to let each restaurant schedule posts to Instagram and Facebook. It creates a workspace for every restaurant, keyed on its own customer ID, sends owners to a hosted page to connect their accounts, and publishes through the API, without building OAuth flows, media processing or retry logic itself.

Draft posts from your content tools – Think of a marketing team that plans campaigns in a project management or content tool. A small integration sends approved copy and images into Xenon Social as drafts, ready for the social team to review, tailor for each network and schedule.

Event-driven posts – Think of an online store that announces new products. When a product goes live, its catalog schedules a post for the next morning in the store’s time zone, with a clientRequestId so the same product is never posted twice.

Status in your own systems – Think of an agency dashboard that shows clients what went out this week. Webhooks update it as each post publishes, with a link to the live post, or flag a failure that needs attention.

Creating API keys

Once you’re an Owner or Admin of your organization, you can create API clients and keys in the Xenon Social dashboard. To do this:

1. Open your workspace and go to Settings → API & integrations.
2. Click New client. Give it a name, choose its Workspace access (selected workspaces, or all workspaces in the organization) and add the Allowed return origins your users may be sent back to after connecting accounts.
3. Click New key on the client, choose the key’s scopes and an optional expiry, then click Create key.
4. Copy your new API key. This is the only time the full key is shown, so store it in your secret manager.

Send the key as a bearer token on every request:

curl "$XENON_API/api/v1/workspaces" \  -H "Authorization: Bearer $XENON_API_KEY"

Revoking a key takes effect on the next request, and disabling a client revokes all of its keys at once.

Included data

Let’s break down what you can access and do with the API.

For workspaces, you can:

• Create a workspace per customer, keyed on your own ID (externalRef). Creating one with an externalRef that already exists returns the existing workspace, so provisioning is safe to repeat
• List, look up and update workspaces, including their name and time zone

For social accounts, you can:

• Create hosted connect sessions: a single-use page where your user approves access on the network’s own screen and picks the accounts to connect
• List connected accounts with their network, username, display name and status, including whether an account needs reconnecting
• Reconnect or disconnect accounts

For media, you can:

• Upload files or import them from a URL
• Follow processing: images are re-encoded without location and camera metadata, and Instagram-ready versions are created automatically
• List and delete media

For posts, you can:

• Create drafts, schedule posts for a time and time zone, or publish immediately to several accounts in one request
• Set a different caption or network settings per destination, such as who can reply on Threads or who can see a LinkedIn post
• Validate content against every destination’s rules without saving it
• Edit, reschedule, unschedule, cancel, duplicate and retry posts
• Read each destination’s publication, including:
  • Status, attempt count and the time it was published
  • The post’s ID and URL on the network
  • A stable error code and message if it failed

For webhooks, you can create endpoints, choose event types, read delivery logs, resend deliveries and rotate signing secrets.

How it works

Publishing is available for Instagram, Facebook, Threads and LinkedIn. The API is the same engine that runs the Xenon Social dashboard: it validates every post against each network’s rules, publishes each destination separately, retries temporary errors with backoff and checks with the network before retrying a publish whose outcome was unclear.

Requests and responses are JSON over HTTPS under /api/v1. Every request needs an API key, and a key can only do what its scopes allow:

A few conventions apply across the API:

• Idempotency. Send an Idempotency-Key header on any POST to replay the original response if you retry.
• Rate limits. Limits apply per API key and per address. Every response reports the remaining quota, and a 429 includes Retry-After.
• Errors. Every error uses one envelope with a stable code to branch on and, for validation failures, the path of each field that failed.
• Pagination. Posts, media and webhook deliveries are paginated with opaque cursors.

Here’s a post scheduled to two accounts, one of them with its own settings:

curl -X POST "$XENON_API/api/v1/workspaces/$WORKSPACE_ID/posts" \  -H "Authorization: Bearer $XENON_API_KEY" \  -H "Content-Type: application/json" \  -H "Idempotency-Key: 7c0e8d64-1b7a-4e0e-9a51-2f6c2f1b9f10" \  -d '{    "caption": "Fresh croissants every morning",    "mediaIds": ["48dd7fc5-5d34-4781-912f-ce0c43e42e0e"],    "destinations": [      { "accountId": "97abc78d-45fa-4acc-970a-38145b4269fb" },      {        "accountId": "c3d4e5f6-0a1b-4c2d-8e3f-4a5b6c7d8e9f",        "options": { "replyControl": "followers_only" }      }    ],    "action": "schedule",    "schedule": { "localDateTime": "2027-05-04T09:30", "timezone": "America/New_York" }  }'

Contact us for access to the API reference.

Webhooks

Webhooks are signed with the Standard Webhooks scheme (HMAC-SHA256), retried with backoff if your endpoint is unavailable, and logged so you can inspect or resend any delivery. Payloads never include access tokens. Events include post.published, post.partially_published, post.failed, publication.published, publication.failed, account.connected, account.reconnect_required and connect_session.completed.

{  "id": "cfe2d0de-c1e8-4865-a2c8-22b511508d40",  "type": "publication.published",  "timestamp": "2026-10-11T21:17:23.780Z",  "workspaceId": "867ffd3b-46d0-4e69-b40e-f6e6b9fc2993",  "externalRef": "customer_1234",  "data": {    "postId": "46340236-a74b-4544-b22b-b28be70dd579",    "publication": {      "provider": "FACEBOOK",      "status": "PUBLISHED",      "providerUrl": "https://www.facebook.com/…",      "attemptCount": 2,      "publishedAt": "2026-10-11T21:17:23.780Z"    }  }}

What the API doesn’t include

The API doesn’t include:

• Follower counts, analytics summaries or audience insights (each publication does include its latest post statistics)
• Comments, direct messages or an inbox
• Paid or ad account data
• Listening data (Listening is coming soon)
• Member, invitation, audit log and API client management (dashboard only)