LinkedIn API guide
LinkedIn Posts API guide: access, permissions, uploads and versions
LinkedIn's Posts API (POST https://api.linkedin.com/rest/posts) creates text, image, video, document, article, multi-image and poll posts. Posting as a member needs the w_member_social permission, which the self-serve Share on LinkedIn product grants; posting as a Company Page needs w_organization_social, which comes with the Community Management API that LinkedIn opens only to registered legal organizations with a commercial use case. Every call carries a Linkedin-Version header. This guide sums up LinkedIn's own developer pages, read on 15 October 2026.
- Sources read on
- Checked on
Which LinkedIn API posts content
The Posts API at POST https://api.linkedin.com/rest/posts "facilitates the creation and retrieval of organic and sponsored posts", and LinkedIn says it "replaces the ugcPosts API". Every call needs two headers: Linkedin-Version with a YYYYMM version and X-Restli-Protocol-Version: 2.0.0. [L1]
The self-serve Share on LinkedIn page still documents the older calls, POST https://api.linkedin.com/v2/ugcPosts and /v2/assets?action=registerUpload. Build new work on the Posts API. [L9, L1]
| Content | Organic post | Sponsored post |
|---|---|---|
| Text only | Yes | Yes |
| Images | Yes | Yes |
| Videos | Yes | Yes |
| Documents | Yes | Yes |
| Article | Yes | Yes |
| Carousels | No | Yes |
| MultiImage | Yes | No |
| Poll | Yes | No |
| Celebration | Yes | No |
Sources: [L1]
Member posts, Company Page posts and who gets access
- Member posts: w_member_social, "Post, comment, and like posts on behalf of an authenticated member." You get it by adding the Share on LinkedIn product on your app's Products tab; the page describes no review for it. [L1, L9]
- The author of a member post is a Person URN, urn:li:person:{id}. Share on LinkedIn points to Sign In with LinkedIn using OpenID Connect (scopes openid, profile and email) to find it: GET https://api.linkedin.com/v2/userinfo returns the member's id as sub. [L2, L9, L10]
- Company Page posts: w_organization_social, "Post, comment, and like posts on behalf of an organization." The signed-in member must hold one of the Page roles ADMINISTRATOR, DIRECT_SPONSORED_CONTENT_POSTER or CONTENT_ADMIN, and the permission comes with the Community Management API (and the Advertising API). [L1, L12]
- Who qualifies for the Community Management API: LinkedIn says it is "only available to registered legal organizations for commercial use cases only". You need a verified business email ("Personal email addresses won't pass the vetting process"), a verified organization, website and domain, the app verified by a super admin of the organization's LinkedIn Page, and no LinkedIn or Microsoft names or logos in the app. [L11]
- One product per app: "The Community Management API requires that it be the only product associated with a developer application due to legal and security constraints." If the app has other products, the request button is greyed out; the fix is a new app for the same Page. [L15]
- If LinkedIn rejects the request, you create a new app and submit a new Development tier request; the same app cannot apply again. LinkedIn also "reserves the right to review applications and select partners at its discretion". [L11, L12]
- Review time for the Community Management API: not listed. The vetting survey must be completed within 21 days; the "up to 30 business days" on the support page is for Advertising API tier upgrades, not this one. [L11, L15]
- Reading members' posts is harder still: LinkedIn calls r_member_social "a closed permission". [L14]
Community Management tiers: Development and Standard
Development is "the default tier provisioned": 500 API calls per app and 100 per member in 24 hours, no BATCH_GET calls, and push notifications off for social-action webhooks. It is for building, and the clock runs: "If you don't apply for Standard tier within twelve months, we'll remove your API access due to inactivity." [L12, L11]
Standard has "No restrictions". You apply with a form, a high-resolution, downloadable screen recording of every use case, test credentials, a valid privacy policy, and compliance with LinkedIn's data storage requirements. Two-legged (app-only) authentication is "not available for marketing use cases". [L12, L14]
Sign-in and tokens
- LinkedIn uses the 3-legged OAuth 2.0 authorization code flow: authorize at https://www.linkedin.com/oauth/v2/authorization and exchange the code at https://www.linkedin.com/oauth/v2/accessToken. Redirect URLs must be absolute HTTPS and cannot include a #. The authorization code has a 30-minute lifespan. [L16]
- "Currently, all access tokens are issued with a 60-day lifespan." Without a refresh token you run the authorization again; LinkedIn skips the consent screen while the member is signed in to linkedin.com and the current token has not expired. [L16]
- Programmatic refresh tokens are for "a limited set of partners", meaning approved Marketing Developer Platform partners. A refresh token lasts 365 days and refreshing does not extend it (LinkedIn's example: a TTL of 306 days after 59 days). After that the member authorizes again; an expired or revoked token answers 400 invalid_request. [L16, L17]
- Asking for a different scope than the one already granted invalidates every earlier access token for that member. [L16]
- LinkedIn's sign-in page also accepts Google, Apple or a passkey on desktop and Android web, and elsewhere with enable_extended_login=true. Since when: not listed. [L16]
Versions and the Linkedin-Version header
- Send Linkedin-Version: YYYYMM and X-Restli-Protocol-Version: 2.0.0 on every call. LinkedIn releases a version each month, supports each for at least one year, and says "the latest version is not applied by default": you pick it. [L18, L1]
- On 15 October 2026 the latest version was October 2026, 202610. [L18]
- No header: 400 VERSION_MISSING, "A version must be present. Please specify a version by adding the Linkedin-Version header." A sunset version: 426 NONEXISTENT_VERSION, "Requested version yyyymmdd is not active". [L21]
- Sunset dates in LinkedIn's migration table on 15 October 2026: 202510 on 15 October 2026 (listed as deprecated), 202511 on 16 November 2026, 202601 on 15 January 2027 and 202610 on 15 October 2027. [L19]
Posting a text post, step by step
- Find the author: urn:li:person:{id} for a member (from the sign-in), or urn:li:organization:{id} for a Company Page on which the member holds one of the roles above. [L2, L10]
- Send POST /rest/posts with author, commentary (the text), visibility PUBLIC, distribution.feedDistribution MAIN_FEED, lifecycleState PUBLISHED and isReshareDisabledByAuthor. [L1]
- Read the post id from the answer's header, not its body: LinkedIn returns "a 201 response and the response header x-restli-id contains the Post ID", a urn:li:share or urn:li:ugcPost URN. [L1]
- Use that URN, URL-encoded, for later calls; DELETE /rest/posts/{encoded URN} removes the post, answers 204 and is idempotent. [L1]
curl -X POST 'https://api.linkedin.com/rest/posts' \
-H 'Authorization: Bearer {access_token}' \
-H 'Linkedin-Version: 202610' \
-H 'X-Restli-Protocol-Version: 2.0.0' \
-H 'Content-Type: application/json' \
-d '{
"author": "urn:li:person:{id}",
"commentary": "We opened a second studio this week",
"visibility": "PUBLIC",
"distribution": { "feedDistribution": "MAIN_FEED" },
"lifecycleState": "PUBLISHED",
"isReshareDisabledByAuthor": false
}'Images, videos, documents and other post types
- Image: POST /rest/images?action=initializeUpload with the owner returns uploadUrl, uploadUrlExpiresAt and an image URN. Upload the file to uploadUrl, then post with content.media.id set to the urn:li:image and an optional altText. LinkedIn notes that "SYNCHRONOUS_UPLOAD is not supported". [L4]
- Video: POST /rest/videos?action=initializeUpload with owner, fileSizeBytes, uploadCaptions and uploadThumbnail. Cut the file into 4 MB parts at the byte ranges uploadInstructions gives (the first is 0 to 4194303), PUT each part and keep the ETag it returns, then POST /rest/videos?action=finalizeUpload with the video, the uploadToken and the uploadedPartIds "in the same order as the order of parts in the upload instructions". Post with the urn:li:video. [L5]
- Video upload URLs typically expire 30 days after the upload was initialized; an expired one answers 401 or EXPIRED_UPLOAD_URL. [L5]
- Document: POST /rest/documents?action=initializeUpload, upload the file, then post with the urn:li:document and a title, which LinkedIn marks as a required field for documents. [L6, L2]
- Several images: content.multiImage.images with a minimum of 2 and a maximum of 20, for organic posts only. Organic carousels are not supported ("Organic carousel is currently not supported"); carousels are for sponsored posts. [L7, L1]
- Article: "The Posts API does not support URL scraping for article post creation". You send source, thumbnail (an image URN), title and description yourself; LinkedIn builds no preview from the link. [L1]
Media specs
| Item | LinkedIn's rule |
|---|---|
| Image formats | JPG, GIF and PNG; a GIF up to 250 frames |
| Image size | Less than 36,152,320 pixels |
| Image alt text | Up to 4,086 characters; LinkedIn recommends under 120 |
| Video format | MP4 |
| Video length | Three seconds to 30 minutes |
| Video file size | The specs say "Between 75kb and 500MB"; the same page's fileSizeBytes row says "Maximum allowed Videos size is 5GB" |
| Captions | One caption file per video, English only |
| Documents | PPT, PPTX, DOC, DOCX or PDF, up to 100 MB and 300 pages |
| Several images | 2 to 20 images, organic posts only |
Text, mentions and hashtags
- commentary is written in LinkedIn's "little" text format, and "All reserved characters need to be escaped with a backslash, even if those characters are not used in one of the supported elements or templates." The reserved characters are | { } @ [ ] ( ) # \ * _ ~ and the two angle brackets. An unescaped one can cut the text short. [L2, L3]
- Mentions are written @[Name](urn:li:organization:{id}). Matching is case-sensitive: an organization must match its full name, a member can match one of their names. [L1]
- Hashtags are written #tag and come back as the template {hashtag|\#|tag}. [L1, L3]
- Text length: the Posts API page names no number and lists only the error 400 FIELD_LENGTH_TOO_LONG. LinkedIn's legacy UGC Post API page says "The maximum length of the text of a UGC Post is 3,000 characters." [L1, L8]
Rate limits
- LinkedIn says "Standard rate limits are not published in documentation." Limits apply per application and per member over 24 hours, reset at midnight UTC, and show in the Developer Portal on your app's Analytics tab, only for endpoints you called that day. [L22]
- Over a limit LinkedIn answers 429. It e-mails an alert at 75 % of the application quota, about 1 to 2 hours late. [L22]
- Two numbers LinkedIn does publish: Share on LinkedIn allows 150 requests a day per member and 100,000 a day per application (UTC days); the Community Management Development tier allows 500 calls per app and 100 per member in 24 hours. [L9, L12]
Errors LinkedIn returns
| HTTP | Code | What it means |
|---|---|---|
| 400 | INVALID_URN_TYPE, INVALID_URN_ID | A URN of the wrong type, or with an invalid id. |
| 400 | MISSING_FIELD, INVALID_VALUE_FOR_FIELD, INVALID_VALUE_BLANK_FIELD | A required field is missing, blank or not allowed. |
| 400 | FIELD_LENGTH_TOO_LONG | A field, such as the text, is too long. |
| 400 | VERSION_MISSING | No Linkedin-Version header. |
| 401 | EMPTY_ACCESS_TOKEN | No access token was sent. |
| 403 | ACCESS_DENIED | A missing permission or Page role. |
| 404 | NOT_FOUND | The post or entity does not exist. |
| 409 | CONFLICT | LinkedIn says: retry the request. |
| 422 | UNPROCESSABLE_ENTITY | The request is well formed but cannot be processed. |
| 426 | NONEXISTENT_VERSION | The version in the header is sunset. |
| 429 | TOO_MANY_REQUESTS | A rate limit was reached. |
- LinkedIn's legacy UGC Post API page documents two refusals the Posts API page does not: 422 "Content is a duplicate of" a recent post ("Wait 10 minutes for the duplicate restriction to expire or modify the content"), and 429 when "the author has reached a maximum daily share limit". It also shows 400 "Unrecognized character escape" for a body with an invalid escape. [L8]
- Media: 403 "Accessing this image resource is forbidden", and the same for videos and documents; video uploads add EXPIRED_UPLOAD_URL, MEDIA_ASSET_PROCESSING_FAILED and MEDIA_ASSET_WAITING_UPLOAD. A token with only w_member_social cannot read /rest/images back, because the permission is write-only. [L4, L5, L6]
- Sign-in: 401 "Redirect_uri doesn't match", and 400 invalid_redirect_uri, which also covers an expired authorization code. [L16]
What changed in 2025 and 2026
- 202504: Buy Now and Shop Now call-to-action labels. 202506: the r_member_postAnalytics and r_member_profileAnalytics permissions. [L20]
- 202602: templateName and linkbackContext in the Videos API. 202604: new post metrics. 202605: a breaking change, metricType returned as a string in post and video statistics. [L20]
- Monthly version sunsets continue: 202510 reached its sunset date on 15 October 2026, and 202511 follows on 16 November 2026. [L19]
Gotchas developers hit
- A missing or sunset Linkedin-Version header (400 or 426), or a missing X-Restli-Protocol-Version header. [L21, L19, L1]
- Looking for the post id in the body: it is in the x-restli-id header. [L1]
- Unescaped reserved characters in commentary, and URNs that are not URL-encoded in the path. [L3, L1]
- Video part ETags sent in another order than the upload instructions. [L5]
- Expecting a link preview from an article URL, or an organic carousel. [L1]
- A greyed-out Community Management request button, because the app has other products. [L15]
- A scope change that silently ends every earlier token, and 60-day tokens with no refresh token outside approved partners. [L16, L17]
- Building on the Development tier without noticing its 500 calls a day per app. [L12]
Posting to LinkedIn through Status 200 Uploads
Status 200 Uploads posts to LinkedIn through its own LinkedIn app: you sign in on LinkedIn itself and never create a developer app or apply for any of the access above. The facts below are the ones our LinkedIn page shows, as checked on that page's own date.
- Where posts go
- To the LinkedIn member profile you sign in with. Company pages are not supported.
- What you can post
- Text on its own, or text with one image or one video. Only the first file of a post is attached.
- Largest video
- 5 GB per file. File limits of every network
- Largest image
- 10 MB per image, checked in the dashboard; through the API, LinkedIn itself decides.
- Text
- Up to 3,000 characters. You can send LinkedIn its own text while the other networks of the same post get the shared caption.
- Scheduling
- Schedule a post up to 365 days ahead, or send it now.
- Plans
- LinkedIn is on every plan, Free included. Pricing
Settings you can choose: LinkedIn text.
LinkedIn API questions
Send POST https://api.linkedin.com/rest/posts with the Linkedin-Version and X-Restli-Protocol-Version: 2.0.0 headers, an author URN, commentary, visibility, distribution and lifecycleState PUBLISHED. The post URN comes back in the x-restli-id header with a 201.
w_member_social posts as the signed-in member. w_organization_social posts as a Company Page, for a member who holds the ADMINISTRATOR, DIRECT_SPONSORED_CONTENT_POSTER or CONTENT_ADMIN role on it, and comes with the Community Management API.
For member posts, the self-serve Share on LinkedIn product grants w_member_social. The Community Management API, needed for Company Page posts, is only available to registered legal organizations for commercial use cases.
LinkedIn requires the Community Management API to be the only product on the app. Create a new app for the same Page and request it there.
A version that is not sunset. On 15 October 2026 the latest was 202610; 202510 reached its sunset that day and 202511 sunsets on 16 November 2026. A sunset version answers 426 NONEXISTENT_VERSION.
60 days. Refresh tokens last 365 days, are not extended by refreshing, and are only for approved Marketing Developer Platform partners.
Organic carousels are not supported. A MultiImage post takes 2 to 20 images.
LinkedIn's legacy UGC Post API documentation says an exact duplicate of a recent post is refused with 422: wait 10 minutes for the restriction to expire, or change the content.
More on LinkedIn
LinkedIn's own pages
Sources read on 15 October 2026.
- L1Posts API (last updated May 7, 2026)
- L2Post Schema (last updated February 13, 2026)
- L3little Text Format (last updated February 25, 2025)
- L4Images API (last updated June 19, 2026)
- L5Videos API (last updated February 12, 2026)
- L6Documents API (last updated June 19, 2026)
- L7MultiImage API (last updated June 18, 2022)
- L8UGC Post API (legacy) (last updated October 9, 2025)
- L9Share on LinkedIn (last updated February 5, 2021)
- L10Sign In with LinkedIn using OpenID Connect (last updated December 14, 2022)
- L11Community Management App Review (last updated January 10, 2023)
- L12Increasing Access (last updated July 28, 2026)
- L14Marketing API FAQ (last updated May 31, 2023)
- L15LinkedIn API Partner Support (last updated May 18, 2026)
- L16LinkedIn 3-Legged OAuth Flow (last updated November 10, 2025)
- L17Programmatic refresh tokens (OAuth 2.0) (last updated May 31, 2025)
- L18API Documentation Versioning (last updated October 15, 2026)
- L19Migrations (API migration status) (last updated October 15, 2026)
- L20Recent Marketing API Changes (last updated October 15, 2026)
- L21Updated Marketing API Error Responses (last updated March 19, 2025)
- L22LinkedIn API Rate Limiting (last updated June 18, 2025)
Post to LinkedIn without building it yourself
LinkedIn is on every plan, Free included. This page was checked on 26 October 2026.