Exhibit A
Which jobs need management, and which need messaging?
Overlap
In both sets
111% of everyone
Only the onboarding worker needs both: it lists the new WABA's numbers and subscribes the app (management), then registers the number (messaging). Every other job gets a token with just one permission, so a leak or a bug stays inside that job.
| Audience | Total | Only here |
|---|---|---|
| Jobs needing whatsapp_business_management | 5 | 4 |
| Jobs needing whatsapp_business_messaging | 5 | 4 |
| In both | 1 | |
| Unique people | 9 |
Highlighting In both sets: 1. Only the onboarding worker needs both: it lists the new WABA's numbers and subscribes the app (management), then registers the number (messaging). Every other job gets a token with just one permission, so a leak or a bug stays inside that job.
What is the whatsapp_business_management permission?
The WhatsApp Business Management Permission, whatsapp_business_management, is one of the Graph API permissions (scopes) an app can request, and it lets the app read and manage the WhatsApp assets a business owns or has shared with it. Meta's permission reference lists those assets as WhatsApp Business Accounts (WABAs), business phone numbers, message templates, QR codes and their associated messages, and webhook subscriptions. In practice it unlocks the WhatsApp Business Management API: the fields of /{WABA_ID}, the Template Management API on its message_templates edge, the phone_numbers edge, the subscribed apps endpoint (/{WABA_ID}/subscribed_apps) that connects webhooks, analytics, and the configuration fields of each phone number.
A permission is granted, not built in. For a business's own integration it is ticked when a system user access token is generated, or approved by a person through Facebook Login; for a Tech Provider it is granted by each customer in Embedded Signup. Each grant is tied to specific accounts: inspecting the token with debug_token shows whatsapp_business_management in scopes and, under granular_scopes, the target_ids — the WABA IDs it applies to. A token without the permission gets a permissions error (code 200) on management calls; a token whose grant does not cover that WABA typically gets error 100, because the object cannot be loaded.
It sits between two neighbours. whatsapp_business_messaging lets an app send messages, handle media and register numbers, but not manage templates or subscriptions. business_management covers the business portfolio itself — system users, asset assignment, partner sharing and listing a portfolio's WABAs. An integration that onboards accounts and also sends usually needs both WhatsApp permissions; a reporting dashboard or a template editor needs only this one.
Key takeaways
- whatsapp_business_management lets an app read and manage WhatsApp assets: WABAs, phone numbers, templates, QR codes and webhook subscriptions.
- It does not send messages; sending needs whatsapp_business_messaging, and most production integrations hold both.
- It is granted per WABA: debug_token's granular_scopes lists the WABA IDs each grant covers.
- Managing your own business's assets works with standard access; managing other businesses' assets needs advanced access through App Review.
- business_management is a different permission, covering the business portfolio, system users and asset sharing rather than WhatsApp objects.
How does the whatsapp_business_management permission work?
Decide whether the job manages
Templates, phone number settings, webhook subscriptions, analytics and account fields all need this permission. Pure sending does not.
Get the right access level
An app that touches only its own business's WABAs works with standard access. An app that manages other businesses' accounts needs advanced access through Meta App Review, with a screencast showing the feature in use.
Put it on a token
Tick it when generating a system user access token, include it in your Facebook Login for Business configuration, or receive it through Embedded Signup.
Confirm the target WABAs
Call
debug_token, or open the token in the Access Token Debugger, and check thatgranular_scopeslistswhatsapp_business_managementwith exactly the WABA IDs you expect.Read errors precisely
Code 200 means the permission is missing. Error 100 on a WABA you know exists usually means the grant or asset assignment does not cover it. Fix the grant, not the code.
Common mistakes with the whatsapp_business_management permission
Granting it to send-only services
A sender holding management rights can delete templates and unsubscribe webhooks. Leave it off tokens that only send.
Assuming the grant covers every WABA
A grant lists specific WABA IDs. An account added later must be assigned or granted before calls on it succeed.
Confusing it with business_management
Creating system users or listing a portfolio's WABAs needs
business_management. This permission manages what is inside a WABA.An App Review screencast that skips the feature
Reviewers need to see your app create a template or manage a number using this permission. Record the flow end to end, for example against your test WABA.
The whatsapp_business_management permission in code
curl -G "https://graph.facebook.com/v26.0/debug_token" \-d "input_token={TOKEN_TO_CHECK}" \-d "access_token={APP_ID}|{APP_SECRET}"
Why does the whatsapp_business_management permission matter?
Permissions are where least privilege actually happens on Meta's platform. Give whatsapp_business_management to a service that only sends and it gains the power to delete templates or unsubscribe webhooks; withhold it from a template editor and every call fails. Knowing exactly what this permission covers, and that App Review gates it for apps that serve other businesses, lets teams issue narrow tokens, pass review the first time, and diagnose "permissions error" responses in minutes instead of days.
Example: Two narrow tokens at a Bengaluru skincare brand
A Bengaluru D2C skincare brand runs a template editor built by its marketing team and a separate order-notification sender. After a security review it creates two system users: the editor's token holds only whatsapp_business_management, and the sender's only whatsapp_business_messaging. Months later a bug makes the sender loop; it sends duplicate notifications until it is stopped, but it cannot edit or delete a single template. When the editor's token turns up in a support screenshot, it is replaced without touching message delivery at all.
whatsapp_business_management FAQs
What does the whatsapp_business_management permission allow?+
Do I need whatsapp_business_management to send WhatsApp messages?+
What is the difference between business_management and whatsapp_business_management?+
Do I need App Review for whatsapp_business_management?+
Best practices for the whatsapp_business_management permission
- Write down, for each service, which of the three permissions it holds and why.
- Re-run debug_token after every onboarding to confirm the new WABA ID appears in target_ids.
- Pair permission errors with the token's debug output in your logs so the fix is obvious.