Private Reply Window

The Private Reply Window is the seven-day grace period the Instagram Graph API gives a Business or Creator account to send a direct message to anyone who left a public comment on its media. It is the only sanctioned mechanism for sending the very first DM to a user who has not initiated the conversation — every legitimate comment-to-DM funnel runs through it.

Under the hood, the call is POST /{ig-user-id}/messages with a recipient block of {"comment_id": "<id>"}. Meta clocks the seven days from the comment's creation timestamp, not from when your webhook received it, so a backlogged worker can blow the window even though the user just commented. The platform allows exactly one private reply per comment — additional attempts return error subcode 2534014. For Instagram Live, the window collapses to the duration of the broadcast itself.

Why it matters

The window is the legal-and-technical foundation of comment-triggered DMs. Without it, sending a DM to a non-following commenter would be cold outbound and policy-violating. With it, the same DM is treated as a contextual reply. Rate limits scale accordingly: the Graph API permits roughly 750 private replies per hour per professional account on regular posts and Reels, and 100 per second during a Live.

Gotchas

• The seven days are calendar days, not business days, and start from created_time on the comment object.
• If the commenter deletes the comment before you call messages, the window slams shut immediately — the recipient handle disappears.
• Once the user replies inside the DM thread, you flip onto the 24-hour messaging window, which is a different rule set with different message tags allowed.
• Comment replies in the public thread are a separate API surface (POST /{ig-comment-id}/replies) and don't consume the private reply allowance.

For a tactical walkthrough, see how to automate Instagram DMs legally.