Use an Instagram API guide to narrow the product decision

Select the outcome before choosing endpoints

Instagram integration should start with a concrete account-owned workflow, not a desire to mirror every visible feature. DewEngine has no approved adapter. It will not use scraping, provider-control evasion, or anti-detection to close gaps. The product brief should identify the eligible account, user consent, required resource or action, event evidence, failure consequence, and authorized provider path. Anything outside that brief remains research.

Keep authorization attached to one native identity

The connected account is the boundary for provider subject, product type, permissions, health, resources, commands, events, and reconnect. Customer users and CRM contacts are separate identities. A hosted flow should protect state and redirects, request least privilege, encrypt durable grants, and verify the same subject on reconnect. A different Instagram identity creates a new account rather than inheriting the old account's data or pending work.

Normalize common fields and preserve extensions

Profiles, media, posts, conversations, and messages can share DewEngine identifiers, source account, native ID, timestamps, and observation metadata. Provider-specific relationships and unavailable fields remain explicit extensions or capability gaps. Reads need bounded pagination and freshness. The product must distinguish absent, withheld, unsupported, partial, and deleted state rather than flattening each into null or an empty list.

Commit intent before a provider-visible write

Publishing, replying, editing, or deleting requires an idempotency key, customer authority, exact capability, provider budget, and durable command record. A worker contacts the provider only after rechecking account health and policy. Acceptance, acknowledgement, visibility, delivery, and indeterminate state remain different outcomes. Safe reconciliation follows the chosen provider contract; blind retries are unacceptable when they may duplicate a post or message.

Build for duplicate callbacks and missing signals

Inbound observations require verification, account routing, deduplication, ordering rules, and bounded reconciliation. Outgoing customer webhooks need signatures, retries, dead-letter state, and replay. Documentation should identify unsupported events and expected lag. Operators need redacted account health, command attempts, checkpoints, throttle feedback, and kill switches, while private content and credentials remain outside routine metrics and support search.

Make capability state a result of evidence

An Instagram slice becomes releasable only after application approval, eligible account conformance, every advertised method and event fixture, tenant isolation, grant rotation, quotas, ambiguous outcomes, sync recovery, support, privacy, export, revocation, deletion, backup behavior, incident drills, and production operations pass. OpenAPI, SDKs, console, and site copy must derive from that record. Until then, the correct status is decision-gated research.

• Choose one complete vertical before expanding the provider catalog
• Publish limitations and account eligibility beside successful examples