Skip to content

Graph API Explorer

Meta's browser tool for generating a test access token with chosen permissions and running live Graph API calls against your WhatsApp objects.

Also called: Graph Explorer · Meta Graph API Explorer · Graph API Explorer tool

Reviewed

Interactive lab

Hands on: use the controls to explore. Anything that plays on its own pauses while you are working inside it.

Read a WABA response the way the Explorer shows it

8 / 8
{
  "name": "Demo Textile Exports",
  "currency": "INR",
  "phone_numbers": {
    "data": [
      {
        "display_phone_number": "+91 98250 12345",
        "verified_name": "Demo Textiles",
        "quality_rating": "GREEN",
        "code_verification_status": "VERIFIED",
        "id": "106540352242922"
      }
    ],
    "paging": {
      "cursors": {
        "before": "QVFIUjRZAZA",
        "after": "QVFIUjRZAZB"
      }
    }
  },
  "id": "102290129340398"
}
The JSON an Explorer query on a WABA returns with phone numbers expanded. Step through the fields to see what each one tells you and where the paging cursors live.

Field 8: id — The WABA ID you queried — always returned, even when not in fields.

01What is the Graph API Explorer?

The Graph API Explorer is a web tool at developers.facebook.com/tools/explorer that lets a developer call the Graph API from a browser. You choose one of your Meta apps, request a User Access Token with the permissions you tick, pick a version and an HTTP method, type a path such as {WABA_ID}/phone_numbers, and press Submit. The JSON response appears immediately, with a field picker beside it for adding properties and expanding edges.

For WhatsApp work it is the quickest way to answer practical questions without writing code: which WhatsApp Business Accounts can this token see, what is this number's quality rating and health status, which templates are approved, is our app subscribed to this WABA's webhooks. Because it runs real calls against real objects, POST and DELETE requests made in the Explorer — sending a message, deleting a template — have real effects.

It is often confused with the Access Token Debugger. The Explorer makes calls and can mint a short-lived test token; the debugger (developers.facebook.com/tools/debug/accesstoken) only inspects a token you paste in — its app, user, scopes, expiry and validity — and makes no calls on your data. A Postman Collection is the other common companion: better for saved, shareable request suites, while the Explorer is better for quick, permission-aware exploration.

Key takeaways

  • The Graph API Explorer is Meta's browser tool for running live Graph API calls with a token it generates for you.
  • Pick your app, tick permissions such as whatsapp_business_management, generate a user token and query any object it can access.
  • Explorer tokens are short-lived user tokens that expire within hours — fine for testing, wrong for production sending.
  • POST and DELETE calls from the Explorer act on real objects: a test send is a real WhatsApp message.
  • Get Code turns a working query into a cURL or SDK snippet; the Access Token Debugger inspects the token itself.

02 · How it works, step by step

How does the Graph API Explorer work?

  1. Step 1

    Choose the app

    Select the Meta app that has the WhatsApp product in the Meta App dropdown. You need a role on that app — admin, developer or tester — to generate tokens for it.

  2. Step 2

    Add permissions and generate a token

    Tick whatsapp_business_management to read accounts, numbers and templates, whatsapp_business_messaging to send, and business_management for portfolio-level calls, then Generate Access Token and approve the dialog.

  3. Step 3

    Pick version, method and path

    Set the version (v26.0 is current), the method (GET, POST or DELETE) and a path relative to graph.facebook.com, such as me/businesses or {PHONE_NUMBER_ID}.

  4. Step 4

    Shape the response

    Use the field picker or type ?fields= to choose properties, and use Field Expansion to nest edges, for example phone_numbers{display_phone_number,quality_rating} on a WABA.

  5. Step 5

    Submit and read the result

    The JSON response, or an error object with code and fbtrace_id, appears in the result pane. An expired Explorer token shows up as error 190.

  6. Step 6

    Export the working call

    Get Code turns the query into cURL or SDK snippets. Before reusing it, move the token out of the URL and swap in your production token from a secret store.

03Example: Finding the right IDs on day one

A developer at a Surat textile exporter has a live WhatsApp number but none of the IDs her code needs. In the Explorer she selects the company's app, ticks business_management and whatsapp_business_management, and runs me/businesses to get the business portfolio ID, then {BUSINESS_ID}/owned_whatsapp_business_accounts for the WABA ID, then {WABA_ID}/phone_numbers for the phone number ID and its quality rating. Ten minutes later she has all three IDs and a confirmed list of what the token can see — and she generates a system user token for the real integration instead of reusing the Explorer's.

04 · Tips from the bench

Best practices for the Graph API Explorer

  • Keep a short list of the WhatsApp paths you use for support checks and reuse them.
  • Click the token's info icon to open it in the Access Token Debugger and confirm scopes and expiry.
  • Use the field picker to discover field names instead of guessing them in code.
  • Copy an error's fbtrace_id straight from the result pane when you open a Meta support ticket.

05Why does the Graph API Explorer matter?

Many integration bugs are not code bugs at all — they are a missing permission, a token that cannot see a WABA, an ID from the wrong node or a field name that does not exist. The Explorer isolates those in seconds: if the same call fails there with the same token, the problem is access, not your code. It also shortens onboarding, because a new developer can walk the graph from business portfolio to WABA to phone number and see real response shapes before writing a line of code, and it gives support engineers a direct way to check an account's state.

06The Graph API Explorer in code

# What the Explorer exports: token in the query string
curl -i -X GET \
  "https://graph.facebook.com/v26.0/{WABA_ID}?fields=name%2Cphone_numbers%7Bdisplay_phone_number%2Cquality_rating%7D&access_token={EXPLORER_TOKEN}"
 
# Production version: token in a header, value from a secret store
curl -G "https://graph.facebook.com/v26.0/{WABA_ID}" \
  -H "Authorization: Bearer {ACCESS_TOKEN}" \
  --data-urlencode "fields=name,phone_numbers{display_phone_number,quality_rating}"

Tokens in URLs end up in logs and browser history; move them to the Authorization header before reuse.

07The Graph API Explorer: key facts and limits

Address
developers.facebook.com/tools/explorer
Token it generates
Short-lived User Access Token (expires within hours)
Access needed
A role on the selected Meta app
Methods
GET, POST, DELETE
WhatsApp scopes
whatsapp_business_management, whatsapp_business_messaging, business_management
Export
Get Code → cURL and SDK snippets

08 · Common mistakes, and the fix

Common mistakes with the Graph API Explorer

  • Shipping the Explorer token to production

    It is a short-lived user token tied to your personal login: the integration breaks within hours and stops for good if you leave the company. Use a System User Access Token for unattended sending.

  • Forgetting that POST and DELETE are real

    The Explorer acts on live objects. A test POST to messages sends a real, billable WhatsApp message and a DELETE on a template removes it. Test with a Test Phone Number and your own handset.

  • Blaming code for a permission problem

    If an object is missing from a response, the token probably lacks one of the API Permissions the call needs, or your user has no access to that WABA. Check the granted scopes in the Access Token Debugger before changing code.

  • Testing on a different version from production

    The Explorer defaults to the newest version. If production is pinned to an older one, select the same version, or a field that works in the Explorer may behave differently in your app.

09Graph API Explorer FAQs

Can I send WhatsApp messages from the Graph API Explorer?+
Yes, if the token has `whatsapp_business_messaging`. A POST to `{PHONE_NUMBER_ID}/messages` with a JSON body sends a real message, under the same template, window and pricing rules as your app.
How long does a Graph API Explorer token last?+
Only a few hours. It is a short-lived User Access Token; exchange it for a long-lived token (about 60 days) for longer tests, and use a system user token in production.
What is the difference between the Graph API Explorer and the Access Token Debugger?+
The Explorer makes API calls and can generate a test token; the debugger only inspects a token you paste in — its app, scopes, expiry and validity — without touching any of your data.
Why doesn't the Explorer show my WhatsApp Business Account?+
Usually the token lacks `whatsapp_business_management` or `business_management`, or your Facebook user has no access to that WABA or portfolio. Add the scope, regenerate the token and confirm your role in Business Settings.

See InfiQ pricing

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms