index.md (3317B)
1 --- 2 title: "Social Media API Gotchas" 3 date: 2010-09-13T00:00:00+00:00 4 draft: false 5 canonical_url: https://www.viget.com/articles/social-media-api-gotchas/ 6 --- 7 8 I've been heads-down for the last few weeks developing the web site for 9 the new [PUMA Social](http://www.puma.com/social) campaign. A major part 10 of this site is a web-based game that rewards users for performing 11 activities on various sites across the internet, and as such, I've 12 become intimately familiar with the APIs of several popular web sites 13 and their various --- shall we say --- *quirks*. I've collected the most 14 egregious here with the hope that I can save the next developer a bit of 15 anguish. 16 17 ## Facebook Graph API for "Likes" is busted 18 19 Facebook's [Graph API](https://developers.facebook.com/docs/api) is 20 awesome. It's fantastic to see them embracing 21 [REST](https://en.wikipedia.org/wiki/Representational_State_Transfer) 22 and the open web. That said, the documentation doesn't paint an accurate 23 picture of the Graph API's progress, and there are aspects that aren't 24 ready for prime time. Specifically, the "Like" functionality: 25 26 - For a page (like 27 [http://www.facebook.com/puma](https://www.facebook.com/puma)), you 28 can retrieve a maximum of 500 fans, selected at random. For a page 29 with more than 2.2 million fans, this is of ... *limited* use. 30 31 - For an individual item like a status update or photo, you can 32 retrieve a list of the people who've "liked" it, but it's a small 33 subset of the people you can view on the site itself. You might 34 think this is a question of privacy, but I found that some users who 35 are returned without providing authentication information are 36 omitted when authenticated. 37 38 - For individual users, accessing the things they've "liked" only 39 includes pages, not normal wall activity or pages elsewhere on the 40 web. 41 42 ## Facebook Tabs retrieve content with POST 43 44 Facebook lets you put tabs on your page with content served from 45 third-party websites. They're understandably strict about what tags 46 you're allowed to use --- no `<script>` or `<body>` tags, for example 47 --- and they typically do a good job explaining what rules are being 48 violated. 49 50 On the other hand, I configured a Facebook app to pull in tab content 51 from our Ruby on Rails application and was greeted with the unhelpful 52 "We've encountered an error with the page you requested." It took a lot 53 of digging, but I discovered that Facebook retrieves tab content with 54 `POST` (rather than `GET`) requests, and what's more, it submits them 55 with a `Content-Type` header of "application/x-www-form-urlencoded," 56 which triggers an InvalidAuthenticityToken exception if you save 57 anything to the database during the request/response cycle. 58 59 ## Twitter Search API `from_user_id` is utter crap 60 61 Twitter has a fantastic API, with one glaring exception. Results from 62 the [search 63 API](http://apiwiki.twitter.com/Twitter-Search-API-Method:-search) 64 contain fields named `from_user` and `from_user_id`; `from_user` is the 65 user's Twitter handle and `from_user_id` is a made-up number that has 66 nothing to do with the user's actual user ID. This is apparently a 67 [known 68 issue](https://code.google.com/p/twitter-api/issues/detail?id=214) that 69 is too complicated to fix. Do yourself a favor and match by screen name 70 rather than unique ID.