Instagram Automation API & DM Bot

The only Instagram DM API on Apify. Send, read, and automate Direct Messages programmatically. Plus: scrape private profiles you follow, automate likes, comments, follows, and more. 43 endpoints. Instant responses.

No browser. No headless Chrome. No Selenium. Just authenticated HTTP endpoints that act as your account.

43 endpoints. DMs, scraping, engagement, sessions. All through one REST API.

92% open rate. Instagram DMs outperform every other channel. Send, read, react, manage threads programmatically.

Private profiles. Logs in as your account. Scrape anything a logged-in user can see.

Login once. Sessions persist for days. Multi-account. No token management.

 

What You Can Do

Direct Messages (8 endpoints)

Endpoint	Method	Description
/send-dm	POST	Send DM to a user (auto-creates thread)
/send-message	POST	Send to existing thread
/react	POST	React with emoji
/unreact	POST	Remove reaction
/unsend	POST	Unsend a message
/mark-read	POST	Mark thread as read
/typing	POST	Typing indicator
/delete-thread	POST	Delete a thread

Read Data (15 endpoints)

Endpoint	Method	Description
/user-info	GET	Profile lookup (username, URL, or ID)
/user-info-by-id	GET	Profile by numeric ID (legacy)
/followers	GET	Paginated follower list
/following	GET	Paginated following list
/posts	GET	Posts with images, videos, captions, locations
/comments	GET	Post comments (paginated)
/comment-replies	GET	Threaded replies
/stories	GET	Active stories
/stories-tray	GET	Accounts with active stories
/highlights	GET	Highlight reels
/highlight-items	GET	Items within a highlight
/search	GET	Search users, hashtags, places
/media-info	GET	Detailed post/reel metadata
/inbox	GET	DM inbox threads
/thread	GET	Messages in a DM thread

Automate Actions (17 endpoints)

Endpoint	Method	Description
/like	POST	Like a post or reel
/unlike	POST	Unlike
/save	POST	Save to collections
/unsave	POST	Remove saved post
/follow	POST	Follow a user
/unfollow	POST	Unfollow
/remove-follower	POST	Remove from your followers
/block	POST	Block a user
/unblock	POST	Unblock
/restrict	POST	Restrict a user
/unrestrict	POST	Unrestrict
/comment	POST	Post a comment (supports replies)
/comment-like	POST	Like a comment
/comment-unlike	POST	Unlike a comment
/comment-delete	POST	Delete your comment
/story-like	POST	Like a story or highlight item
/story-unlike	POST	Unlike a story

Auth & Session (3 endpoints)

Endpoint	Method	Description
/login	POST	Login with email/password (2FA supported)
/verify-2fa	POST	Submit verification code
/session-status	GET	Check session health

 

Quick Start

1. Login

curl https://zen-studio--instagram-automation-api.apify.actor/login \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "your@email.com", "password": "...", "country": "US"}'

2FA enabled? You'll get "status": "pending_2fa". Submit the code:

curl .../verify-2fa \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "your@email.com", "code": "123456"}'

2. Call Any Endpoint

Read a profile:

curl ".../user-info?email=your@email.com&user=zuck" \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN"

Like a post:

curl .../like \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "your@email.com", "media_id": "3584147232977032258"}'

Send a DM:

curl .../send-dm \
  -H "Authorization: Bearer YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "your@email.com", "user": "zuck", "text": "Hello!"}'

Every request includes email to identify which account to use. Multiple accounts, one API.

 

Sessions

Login once. The session persists across all requests.

• Persist across requests and restarts
• Auto-refreshes on activity
• Multi-account: each email gets its own isolated session
• Check health anytime via /session-status

Sessions are tied to the proxy country you set at login. All subsequent requests for that account route through the same region.

 

Stealth: Proxy Country Routing

Instagram tracks geographic consistency. Logging in from the US, then making requests from Germany, raises flags.

Set country at login to pin all traffic to a residential proxy in that region:

{"email": "your@email.com", "password": "...", "country": "DE"}

The country code sticks with the session. Every request after login automatically routes through the same proxy region.

Supports any country available in Apify's residential proxy pool.

Rule of thumb: match the proxy country to where the account normally logs in.

 

Response Format

Every endpoint returns a consistent envelope:

{
    "success": true,
    "data": {
        "id": "314216",
        "username": "zuck",
        "full_name": "Mark Zuckerberg",
        "follower_count": 13200000,
        "is_verified": true
    },
    "session": {
        "status": "active",
        "email": "your@email.com",
        "idle_seconds": 2,
        "session_age_days": 3.5,
        "country": "US"
    }
}

Paginated endpoints (/followers, /following, /posts, /comments, /inbox, /thread) return items with a cursor:

{
    "success": true,
    "data": {
        "items": [ ... ],
        "next_cursor": "abc123"
    },
    "session": { ... }
}

When next_cursor is empty, there are no more pages.

Errors include the same session object so you always know the session state:

{
    "success": false,
    "error": "rate_limited",
    "error_code": 429,
    "message": "Rate limited by Instagram, slow down",
    "session": {
        "status": "active",
        "email": "your@email.com",
        "idle_seconds": 2,
        "session_age_days": 3.5,
        "country": "US"
    }
}

Error Codes

Error	Code	Meaning
session_not_found	404	No active session, login first
login_required	401	Session expired, login again
account_suspended	403	Account has been suspended by Instagram
rate_limited	429	Too many requests, slow down
timeout	504	Request timed out, retry immediately
dm_delivery_failed	422	Couldn't send message to this user (DM restrictions, blocked, etc.)
ig_error	varies	Instagram rejected the request
missing_param	400	Required parameter missing
internal_error	500	Unexpected server error

Session Status

The session.status field tells you whether you need to re-login or just wait:

Status	Meaning	Action
active	Session is valid	Safe to retry (after backoff for rate limits)
expired	Session is dead	Must call /login again
not_found	No session exists	Must call /login first
pending_2fa	Awaiting 2FA code	Submit code via /verify-2fa

When session.status is active on an error response (like rate_limited, timeout, or dm_delivery_failed), the session is fine. The error is temporary or specific to that action. For rate_limited, back off and retry. For timeout, retry immediately.

Pagination

Paginated endpoints accept an optional cursor query parameter. Pass the next_cursor value from a previous response to fetch the next page.

# First page
curl "https://<actor-url>/followers?email=you@email.com&user=zuck&limit=200"
# → {"data": {"items": [...], "next_cursor": "abc123"}, ...}

# Next page
curl "https://<actor-url>/followers?email=you@email.com&user=zuck&limit=200&cursor=abc123"
# → {"data": {"items": [...], "next_cursor": "def456"}, ...}

# Last page (no more results)
# → {"data": {"items": [...], "next_cursor": ""}, ...}

Each page is billed as one ig-read event ($0.001). Fetching 1,000 followers at 200 per page = 5 calls = $0.005.

Tip: When paginating large lists, deduplicate results by user/post ID on your end to ensure clean data.

 

Use Cases

Workflow Automation (n8n, Make, Zapier)

Standard HTTP request nodes. No custom code.

• Auto-reply to DMs based on keywords
• Like and comment on posts from a target list
• Follow/unfollow sequences with delays
• Forward new inbox messages to Slack

Custom Code Integration

Any language. Any framework. If it can make HTTP requests, it works.

• Sync Instagram DMs with your helpdesk
• Scrape profiles, then auto-follow matches
• Track competitor posts on a schedule
• Bulk operations across managed accounts

Scheduled Batch Runs

Not everything needs Standby. Apify's Scheduler can trigger normal Actor runs for recurring tasks:

{"action": "unfollow", "email": "your@email.com", "user": "zuck"}

Cheaper than keeping Standby alive 24/7 for infrequent jobs.

 

API Integration

Python

import requests

BASE = "https://zen-studio--instagram-automation-api.apify.actor"
HEADERS = {"Authorization": "Bearer YOUR_APIFY_TOKEN"}

# Read a profile
resp = requests.get(f"{BASE}/user-info",
    params={"email": "your@email.com", "user": "zuck"},
    headers=HEADERS)
print(resp.json()["data"])

# Like a post
resp = requests.post(f"{BASE}/like",
    json={"email": "your@email.com", "media_id": "3584147232977032258"},
    headers=HEADERS)

JavaScript

const BASE = "https://zen-studio--instagram-automation-api.apify.actor";
const headers = { Authorization: "Bearer YOUR_APIFY_TOKEN" };

// Read a profile
const resp = await fetch(
    `${BASE}/user-info?email=your@email.com&user=zuck`,
    { headers }
);
const { data } = await resp.json();

// Send a DM
await fetch(`${BASE}/send-dm`, {
    method: "POST",
    headers: { ...headers, "Content-Type": "application/json" },
    body: JSON.stringify({
        email: "your@email.com",
        user: "zuck",
        text: "Hello!",
    }),
});

 

---

Pricing - Pay Per Event (PPE)

You only pay for what you use. No subscriptions, no minimum spend.

Event	Endpoints	Per call	Per 1,000
ig-read	All GET endpoints (profiles, posts, inbox, etc.)	$0.001	$1
ig-action	Like, follow, comment, react, etc.	$0.005	$5
dm-sent	Send DM, send message	$0.015	$15
auth-action	Login, 2FA verification	$0.10	$100

/session-status is always free.

Example

Look up 10 profiles, like 5 posts, send 3 DMs: 10 × $0.001 + 5 × $0.005 + 3 × $0.015 = $0.08

Reads charge per request, not per item returned. One /followers call returning 200 results = 1 read event. Paginating with cursor counts as a new request.

---

 

Technical Details

• Memory: 256 MB
• Proxy: Apify residential, per-account country routing
• Retries: 3 attempts on transient errors
• Sessions: KV Store, persist across runs
• Standby: Always warm, zero cold starts

 

FAQ

Do I need an Instagram account? Yes. You authenticate via /login. The API acts on behalf of your account.

Can I manage multiple accounts? Yes. Each email gets its own session. Pass email on every request.

How long do sessions last? They auto-refresh on activity. Inactivity triggers a refresh on the next request. If the session fully expires, re-login via /login.

What about 2FA? Fully supported. /login returns "pending_2fa", then submit the code via /verify-2fa.

Is there rate limiting? No rate limits from the API itself. Instagram's own limits apply. Residential proxies help, but too many actions too fast will trigger temporary blocks. When this happens you get rate_limited (429) with session.status: "active", meaning the session is fine but you need to back off. These blocks are temporary (typically 30-60 minutes).

Rate limit persists after waiting? In rare cases, Instagram flags the session itself (not just the account). If you're still getting rate_limited after waiting, re-login via /login to get a fresh session.

What proxy country should I use? Match the account's normal login location. German account = "country": "DE". Geographic consistency avoids challenges.

Can I use this with n8n / Make / Zapier? Yes. HTTP request node + Bearer auth header + any endpoint.

/send-dm vs /send-message? /send-dm takes a user (username, URL, or ID), finds or creates the thread, sends the message. /send-message requires a thread_id you already have. Use /send-dm for convenience.

What's Standby mode? Always-on HTTP server. No queue, no cold start. Apify keeps it warm and routes requests directly.

 

Support

Have a bug to report, a feature request, or an idea for a new endpoint? Open an issue in the Issues tab. All feedback is welcome.

---

Disclaimer

This actor provides tools for Instagram automation. Users are responsible for complying with Instagram's Terms of Service. Use at your own risk.

---

Full Instagram automation through one REST API. Login, scrape, engage, message.