I have a Facebook Messenger integration in a custom product. How it works is basically, you can add a Facebook Page and set up webhooks to receive messages from that page. Messages from that FB page are then received in the product and an agent can then reply to those customer messages through the product.
The issue is that whenever I try to resolve a user's PSID to their first and last names (to be able to know from whom I am receiving messages), I get an error from the API:
Unsupported get request. Object with ID '8475274972503852' does not exist, cannot be loaded due to missing permissions, or does not support this operation. Please read the Graph API documentation at https://developers.facebook.com/docs/graph-api
Here is a full breakdown of what I do:
{"object":"page","entry":[{"time":1727708065167,"id":"12345","messaging":[{"sender":{"id":"8475274972503852"},"recipient":{"id":"12345"},"timestamp":1727708064292,"message":{"mid":"m_wGCmVNoTvuOt9oyov
DB-ZDZSu-pLQbCbu9WRwE8k8PVoJNmbIudFCILhMVlP96czmjqIQgexg-2kBpputocASA","text":"Test message"}}]}]}
The x-hub tokens match. The recipient page id matches (12345). So I grab the PSID received from the webhook from the sender field: 8475274972503852. Now I make the following API call with the TOKEN generated for the FB page that received the message from Messenger (12345):
curl -i 'https://graph.facebook.com/v19.0/8475274972503852?access_token=TOKEN&fields=first_name,last_name'
HTTP/2 400
vary: Origin
vary: Accept-Encoding
x-business-use-case-usage: {"12345":[{"type":"messenger","call_count":1,"total_cputime":1,"total_time":1,"estimated_time_to_regain_access":0}]}
content-type: application/json; charset=UTF-8
www-authenticate: OAuth "Facebook Platform" "invalid_request" "Unsupported get request. Object with ID '8475274972503852' does not exist, cannot be loaded due to missing permissions, or does not support this operation. Please read the Graph API documentation at https://developers.facebook.com/docs/graph-api"
access-control-allow-origin: *
facebook-api-version: v19.0
strict-transport-security: max-age=15552000; preload
pragma: no-cache
cache-control: no-store
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-fb-request-id: A3xBDeow31HMiuwDR5-9iMy
x-fb-trace-id: HUaCDkY000U
x-fb-rev: 1016912314
x-fb-debug: +8jy+3sKN3LzIwaK8qKSuI49ivVDO68lLnbb2/NNpQQjYi4nmq8XtTyjB34ft3gJLGzaoGpy/jfeTgRK0+BOow==
date: Mon, 30 Sep 2024 14:44:15 GMT
proxy-status: http_request_error; e_proxy="AcIQhZwFm5eKuDwlV1w7ILQgT_t86WSKPL_QFBzeQCECvr_QJhfFQfzdWOWnH2HQS9LmJe8E9--8vSYMhbG2"; e_fb_binaryversion="AcICkQloX2DOa3HcYt6bnKKWPwBVmJfg4V7j8yVXdN6kJu680AwyTtkjziS3kIvrWlhwGwxbOT9Xtm5o86YL_AUEA8oomia9szU"; e_fb_httpversion="AcLmdHKrfYk6cKAWq9mXn1pixNgprtuf5ORbyM8osStg3yZdmn2_CingMiF5"; e_fb_responsebytes="AcKDaXfDb_cuZMj7oD8FCgOj0haDD-SLqiqlVNxKFb7Pc00Ik9GZKjrp1Lba"; e_fb_requesttime="AcKcP4-osZ7oRF2An1r4gqMzwzvTEg4IEq4P0V-JuZ9VqLME4rlgrEiFZWjlSLQLJ4Wae-l97Q"; e_fb_requesthandler="AcIu4z10Rrl_yzMsPP6zK9R4HWoSgZ4suq0SUsRizhilboY-fu7y79XSKSa2NHStzZPt4ZmH6aQ"; e_fb_hostheader="AcIC2Leap8MPhgBSEJ5HmExNtL65KaZL7YJzI60uXijlCYLlVfV8fPLTu0Od1jtKC8nu_SVkmGX1dPxM"; e_fb_requestsequencenumber="AcK36-_t_JmjBOjeu4RFHkgsHq1WOTVcIsLS6qHmqw1hJfF9IdhwbVJNn-rWeg"; e_upip="AcIs7ZKaRj5N3fk9zg3GcjKjPSjGEV9vESke7LCHoSAPbeKitccrHZyJuzX7vRGxyunNENtNbubiqLTzyhzlw7H2GI55l4OksWHqzYk"; e_fb_builduser="AcKa6ZMoNFUqKm127Ycmout8Iqt87hDRbsknEcKVsqGvH80ENQZ7Hnk1WTli7wlF9J8"; e_fb_vipport="AcL4NvuRnD2Kz4u7p3MEIlWznP9Swfq-JDKTCgTHA31I_i18Ve7S47DKarVC"; e_clientaddr="AcKW-AXP6dxOzl-vwz5wWndqd_xeFO0fWkjKtXvdSuB3Wc1vK_bkysEPEfFp7kyWBLpi0hwt6Ej0YMExIuKHREl0tz8LK0ojxJC_miWbBgglArLkQw"; e_fb_vipaddr="AcKpljfxfrLWaxIzoFiUaEYxsnqmogn1LLHKT8ezq93PfNx6HvDHVfIL--st5vfMLCGnb9cr3SfaAR6Qz54D5jElyRVXEgp7JA"; e_fb_configversion="AcJPeF65GqqxGcjrtiyxkSdthGOvUofJhj7Np-kbzaYe6O_oq3pCnG3YISDSUSa4WaX2rHPRWwvUxxERtHLKXyOoKHxc4jdEkSU", http_request_error; e_fb_configversion="AcIpMRhNSZdx3XXBxIJ9SnfsdI0NVGvRKFWHzkMZRWa_b0bNE-hFtMu5g60lwA"; e_clientaddr="AcLk7-2QKUdZQRLvD6yJr0tP0BNfwZiGWkYaaJxHtHeR4qd2K2Af2QPJwdkRdieEPEWwwmZerttgg6iiFg"; e_fb_vipport="AcL5njrjDm93KMXudkKEwC4xD9IuDoH2NZSkTHfcmN_BQHOgju9j8TAuqJjv"; e_upip="AcKVx45TKYd9ZcJJ-jbHKuO1aNvGfNLbsIUQJOj5F1OHigss8FJ44mDfwTqJWKc8dFnKH3-vQ7F_eVoXK4VI4QCgrzwk5Wq-EA"; e_fb_requestsequencenumber="AcKiflGyEtpLnTXgbcw2eQGeCiDsZEqgj7sVRQlXaHA6IZMohc6dqF9Dpg"; e_fb_hostheader="AcJ8S1gJrXigdL35er-gf1TvOsD2NQQ5z7xLcjEnddnm8gGc66Tf7ztKrae-M8PbsP6aEKmaCMULG8jR"; e_fb_vipaddr="AcJ3wAUzNzC66oCsJyWudkm0f3vJtvzraitf8xs_n0vCiNyHRViIqqitMtcjeCVb14JXgQ"; e_fb_requesthandler="AcJ9jfdHaGSY3eSp-pfJJMnqvTQ_J3JasOomfeVTm7cQlajObmVf_ulpr3oawY8GUPPYZ1qRcM8"; e_fb_requesttime="AcJgEJbJijw800duBbUAEkkC75zTy5vEcxDNUUWP-rJcmPVpFUgla8D7b_gArQdtzgbof_gCZA"; e_fb_builduser="AcLj7AueUKssgL_Gj1nwTdbDQ7A0CcyBkmuqPkKw8fRF2gAD6dZdNpc8Kmu0aDEpY5o"; e_fb_httpversion="AcIld_vDGti40AV-lnEhEwlxTG8oJRghqZZCmmN4wCh_GQCI-lMh5kewP7yf"; e_fb_binaryversion="AcIjBGb6XPHIcIXkepcTT6fQIpzSeGQ4-lwQ8Usx570gvYxyey3QD7EpVrCRf5Ske2V5VcCbs1aAEzcaEWoj9Zwb5cITG0LnO-M"; e_proxy="AcIoy-GSjrcBQB_9BVbVWojjQEaOyEYBpGyYFMz37Z-5N8DcfcSz40VXMh21d7F0iUnT_Dte94U345BS"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=10, mss=1380, tbw=3555, tp=-1, tpl=-1, uplat=165, ullat=0
alt-svc: h3=":443"; ma=86400
{"error":{"message":"Unsupported get request. Object with ID '8475274972503852' does not exist, cannot be loaded due to missing permissions, or does not support this operation. Please read the Graph API documentation at https:\/\/developers.facebook.com\/docs\/graph-api","type":"GraphMethodException","code":100,"error_subcode":33,"fbtrace_id":"A3xBDeow31HMiuwDR5-9iMy"}}
I am absolutely sure that I have all the permissions needed, since the permission to use public_profile is implicitly granted to every application (https://developers.facebook.com/docs/permissions#public_profile). I use the API correctly, with the right PSID received from the webhook, with the right access token generated for the particular FB page that received the message. I also have the FB app set to live mode. I have the business account verified, also tried to complete the App Review process, yet it did not change a thing.
Every time I try to resolve a PSID of a user that has no affiliation to the FB app / FB page (not an admin or developer), I get the error mentioned above. But I am able to resolve PSIDs of users who are a developer or admin of the FB app without issues.
I have tried numerous ways to circumvent this issue:
There is no good explanation on what is causing this issue, I don't seem to be hitting limitations (there would be a different error code - 4 - Rate Limit error: Application request limit reached.
- https://developers.facebook.com/docs/messenger-platform/error-codes)
Does anyone have a clue on what is going on? Am I doing something wrong? I have followed like 10 different documentation pages and I cannot find any useful information. There is also a ton of conflicting information about how to use the API, which permissions are needed, a lot of it no longer is even applicable as some menus/pages are missing like this one (https://developers.facebook.com/docs/messenger-platform/identity/user-profile):
I would have contacted Facebook directly but there is absolutely no way to go about it, they don't care, they don't want to support their own product:
Maybe I need to generate an App access token (https://developers.facebook.com/docs/facebook-login/guides/access-tokens)? I have no clue:
curl -X GET "https://graph.facebook.com/oauth/access_token
?client_id={your-app-id}
&client_secret={your-app-secret}
&grant_type=client_credentials"
I understand that you have done App Review, but there is a feature called Business Asset User Profile Access. This feature allows you to read information about the user.
In your Meta app developer dashboard, you should navigate to App Review > Permissions and Features, and explicitly search for the Business Asset User Profile Access feature and enable advanced access.