Chapter 1 · The scenario
Example: A Lucknow lab's bad Tuesday
A diagnostics lab books home sample collection through a WhatsApp Flow, with live slots from its scheduling API. At 9:10 the Flow endpoint's response time climbs past three seconds and its breaker opens; the bot switches to a list message of the next ten slots and bookings continue. At 10:05 the scheduling API starts returning 503, so the bot asks for a preferred time and promises confirmation by message. At 11:20 the Cloud API returns server errors for twelve minutes; replies queue up and the website shows a delay banner. As each dependency recovers the bot steps back up, and by 1 pm every pending booking has been confirmed with a utility template.
Chapter 2 · What is graceful degradation?
Graceful degradation is the design principle that when part of a system fails, the rest keeps delivering the most important outcome, with reduced features, instead of the whole experience breaking. On a WhatsApp booking bot that might mean sending a plain interactive list of slots when the WhatsApp Flows booking form cannot load, taking a preferred time and confirming later when the scheduling API is down, or switching an AI assistant to a fixed menu plus a human queue when the model gateway times out.
It works by deciding, ahead of time, which features are essential and which are nice to have, and by giving each dependency a planned degraded mode. A request timeout or an open circuit breaker detects the failure quickly; a feature flag or mode switch moves the journey to its simpler path; and the system steps back up automatically when the dependency recovers. Degraded modes often use cached or stale data, clearly labelled, in place of live calls.
Even a Cloud API incident can be handled gracefully: outbound messages are queued in your own system with their useful life in mind, the website or app tells customers that WhatsApp updates are delayed, and the queue drains when Meta recovers. Templates Meta has already accepted are covered by its own time-to-live: authentication messages default to 10 minutes, and undeliverable messages are dropped when their TTL expires.
Graceful degradation is easy to confuse with its neighbours. Failover switches to a replica of the same component; a fallback channel moves the customer to SMS or another channel; load shedding rejects low-priority work entirely so critical messages get through. Degradation keeps serving the same request in the same channel, just with less.
Key takeaways
- Graceful degradation keeps the essential journey working with fewer features when a dependency fails, rather than showing an error.
- Plan degraded levels in advance: a Flow becomes a list message, live data becomes a captured request, AI replies become a menu and a human queue.
- Timeouts and circuit breakers are the triggers; without them the system waits on the broken dependency instead of degrading.
- Tell customers what changed and tell operators which mode is active; silent degradation looks like a bug.
- It degrades features inside your service, unlike failover (switch to a replica) or a fallback channel (switch the customer to SMS).
Chapter 3 · Why it matters
Why does graceful degradation matter?
Every WhatsApp journey leans on several things a business does not fully control: a Flow endpoint, a product catalogue, a payment gateway, an AI model, a CRM and Meta's API itself. If each failure becomes a dead end, overall reliability is the product of all of them, and customers meet errors several times a month. With planned degraded modes, most of those incidents become a slightly plainer conversation that still books the appointment, confirms the order or reaches a person, which is what customers and revenue actually depend on.
Chapter 4 · How it unfolds
How does graceful degradation work?
Map the journey and rank features
For each journey (booking, order tracking, support), mark what is essential (book a slot, see order status, reach a human) and what is enhancement (the Flow form, product images, AI phrasing).
Define a degraded mode per dependency
Flow endpoint down: list or reply-button message. Catalogue down: a link to the website. AI down: a menu and a human queue. CRM down: reply without personalisation. Cloud API down: queue sends and show a banner elsewhere.
Detect fast with timeouts and breakers
Give every call a timeout and wrap flaky dependencies in a circuit breaker, so the system switches to the degraded path in seconds instead of waiting on a hung request.
Switch modes visibly
Tell the customer what is different ("we'll confirm your slot by message shortly") and emit a metric or log for each active mode so operators can see the system is degraded.
Recover automatically, and rehearse
Let half-open breaker probes restore the full path when the dependency recovers, and exercise each degraded mode on purpose with feature flags so it works when needed.
Chapter 5 · Where it goes wrong
Common mistakes with graceful degradation
Degrading silently
If the bot quietly drops the Flow and nobody knows, customers see a different experience and support cannot explain it. Tell the customer what changed and record every activation as a metric with an alert on long-running modes.
No timeouts, so no trigger
A call without a timeout can hang for minutes, so the degraded path never runs. Set tight timeouts on every dependency in the conversation path and let breakers trip on repeated failures.
Fallbacks that were never run
A degraded path tested once at launch breaks quietly as templates and APIs change. Exercise each mode regularly by flipping its flag in staging, or in production during quiet hours.
Passing stale data off as live
Showing cached prices or slots as current leads to double bookings and disputes. Label cached data, prefer "we'll confirm" over a promise, and reconcile when the dependency returns.
Degrading the wrong thing first
Keeping marketing flowing while OTPs and order updates wait gets the priorities backwards. Rank journeys by importance, and pair degradation with load shedding for low-priority traffic.
Chapter 6 · In code
Graceful degradation in code
// Your Flow endpoint is your own server: if its breaker is open, a Flow would open// to an error screen, so offer the same choice as a plain interactive list instead.export async function offerSlots(to, slots) {if (breakers.flowEndpoint.isOpen()) {metrics.increment("degraded_mode", { feature: "booking", mode: "list_message" });return sendMessage(listMessage(to, slots));}return sendFlowBooking(to); // full experience}function listMessage(to, slots) {return {messaging_product: "whatsapp",recipient_type: "individual",to,type: "interactive",interactive: {type: "list",body: { text: "Pick a home-collection slot and we'll confirm it by message." },action: {button: "See slots", // up to 20 characterssections: [{title: "Tomorrow",rows: slots.slice(0, 10).map((s) => ({ id: `slot_${s.id}`, title: s.label })), // 10 rows max},],},},};}async function sendMessage(payload) {const res = await fetch(`https://graph.facebook.com/v26.0/${process.env.PHONE_NUMBER_ID}/messages`, {method: "POST",headers: { Authorization: `Bearer ${process.env.ACCESS_TOKEN}`, "Content-Type": "application/json" },body: JSON.stringify(payload),signal: AbortSignal.timeout(5_000),});if (!res.ok) throw new Error(`send failed: ${res.status}`);return res.json();}
The degraded path still books the slot. It is just plainer, and it is counted so operators know it is active.
Chapter 7 · The facts
Graceful degradation: key facts and limits
| Typical trigger | A timeout or an open circuit breaker on one dependency |
|---|---|
| List message fallback | Up to 10 rows; button label 20 characters, row title 24 |
| Reply-button fallback | Up to 3 buttons, titles up to 20 characters |
| Authentication template TTL | Default 10 minutes (30 s to 15 min) |
| Meta webhook retries | Up to 7 days if your receiver is down |
Chapter 8 · What good teams do
Best practices for graceful degradation
- Write each degraded mode into the bot's conversation design, with its own copy, not as an afterthought in code.
- Prefer simple, widely supported message types (text, reply buttons, lists) as fallbacks.
- Keep an approved utility template ready for "we're confirming your request" follow-ups.
- Show active degraded modes on the status dashboard the support team uses.
Chapter 9 · Graceful Degradation FAQs