| CARVIEW |
Select Language
HTTP/2 200
vary: Accept-Encoding
content-encoding: gzip
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-frame-options: DENY
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-OCGgpezY' blob: 'self' connect.facebook.net 'unsafe-eval' https://www.googletagmanager.com/gtag/js https://www.googletagmanager.com https://*.google-analytics.com https://translate.google.com *.google.com gw.conversionsapigateway.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://analytics.google.com https://*.analytics.google.com https://*.google-analytics.com https://*.googletagmanager.com https://stats.g.doubleclick.net gw.conversionsapigateway.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com https://*.google-analytics.com https://*.googletagmanager.com https://www.googletagmanager.com https://www.googleadservices.com https://googleads.g.doubleclick.net *.doubleclick.net *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ dc.ads.linkedin.com analytics.twitter.com t.co;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data: 'unsafe-eval';block-all-mixed-content;upgrade-insecure-requests;
document-policy: force-load-at-top
document-policy: include-js-call-stacks-in-crash-reports
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: unsafe-none
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
origin-agent-cluster: ?1
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: oFun1AQ7aZqjNZLn7MVxns//wDz69HmEO0wsOY+RS+qYZXIXHqZ5NdpYDxqqONxzUXft5Qlo+6/jNm1559znWQ==
date: Wed, 23 Jul 2025 08:50:52 GMT
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=10, mss=1380, tbw=3533, tp=-1, tpl=-1, uplat=3673, ullat=0
alt-svc: h3=":443"; ma=86400
Graph API Reference v23.0: Application Accounts - Documentation - Meta for Developers
If you want to learn how to use the Graph API, read our Using Graph API guide.
A list of TestAccount nodes.
For more details about pagination, see the Graph API guide.
Graph API Version
Application Accounts
Represents a collection of test users on an app.
Reading
Get a list of test users on an app.
Requirements
| Type | Requirement |
|---|---|
None |
Example
GET /v23.0/{application-id}/accounts HTTP/1.1
Host: graph.facebook.com/* PHP SDK v5.0.0 */
/* make the API call */
try {
// Returns a `Facebook\FacebookResponse` object
$response = $fb->get(
'/{application-id}/accounts',
'{access-token}'
);
} catch(Facebook\Exceptions\FacebookResponseException $e) {
echo 'Graph returned an error: ' . $e->getMessage();
exit;
} catch(Facebook\Exceptions\FacebookSDKException $e) {
echo 'Facebook SDK returned an error: ' . $e->getMessage();
exit;
}
$graphNode = $response->getGraphNode();
/* handle the result *//* make the API call */
FB.api(
"/{application-id}/accounts",
function (response) {
if (response && !response.error) {
/* handle the result */
}
}
);/* make the API call */
new GraphRequest(
AccessToken.getCurrentAccessToken(),
"/{application-id}/accounts",
null,
HttpMethod.GET,
new GraphRequest.Callback() {
public void onCompleted(GraphResponse response) {
/* handle the result */
}
}
).executeAsync();/* make the API call */
FBSDKGraphRequest *request = [[FBSDKGraphRequest alloc]
initWithGraphPath:@"/{application-id}/accounts"
parameters:params
HTTPMethod:@"GET"];
[request startWithCompletionHandler:^(FBSDKGraphRequestConnection *connection,
id result,
NSError *error) {
// Handle the result
}];Parameters
| Parameter | Description |
|---|---|
typeenum{test-users} | The type of user requested |
Fields
Reading from this edge will return a JSON formatted result:
{ "
data": [], "paging": {} }
data
A list of TestAccount nodes.The following fields will be added to each node that is returned:
| Field | Description |
|---|---|
access_tokenstring | An access token that can be used to make API calls on behalf of this user |
paging
For more details about pagination, see the Graph API guide.Error Codes
| Error | Description |
|---|---|
| 190 | Invalid OAuth 2.0 Access Token |
| 200 | Permissions error |
| 104 | Incorrect signature |
| 100 | Invalid parameter |
Creating
You can make a POST request to
accounts edge from the following paths: When posting to this edge, a TestAccount will be created.
Upon successful creation, a login_url and access_token will be returned. You can use the login URL to log in as the test user. Login URLs expire once they are used, or after one hour if they are unused. An access token will only be returned if the installed parameter was set to true at the time of the query.
You can also use this edge to associate an existing test user with a different app by using the owner_acces_token parameter.
Requirements
| Type | Requirement |
|---|---|
None |
Parameters
| Parameter | Description |
|---|---|
installedboolean | Automatically installs the app for the test user once it is created or associated |
minorboolean | Is this test user a minor |
namestring | The name for the test user. When left blank, a random name will be automatically generated |
owner_access_tokenstring | When associating existing test users with other apps, this is the app access token of any app that is already associated with the test user. The |
permissionsList<Permission> | Default value: SetList of permissions that are automatically granted for the app when it is created or associated |
typeenum{test-users} | Type |
uidint | ID of an existing test user to associate with another app. Required when associating test users, but should not be used when creating new test users |
Return Type
This endpoint supports read-after-write and will read the node represented by
id in the return type. Struct {}
id: numeric string, access_token: string, login_url: string, email: string, password: string, Error Codes
| Error | Description |
|---|---|
| 2900 | Too many test accounts |
| 190 | Invalid OAuth 2.0 Access Token |
| 195 | The name you are trying to use is invalid |
Updating
You can't perform this operation on this endpoint.
Deleting
You can dissociate a TestAccount from an Application by making a DELETE request to
/{application_id}/accounts.Requirements
| Type | Requirement |
|---|---|
None |
Limitations
At least one test user must be associated with an app. Attempting to perform this operation on an app's sole test user will result in error code 2902.
Parameters
| Parameter | Description |
|---|---|
typeenum {TEST_USERS} | Account type |
uidUID | Account UID Required |
Return Type
Struct {}
success: bool, Error Codes
| Error | Description |
|---|---|
| 100 | Invalid parameter |