Customer-owned REST API keys and permissions
Business developers need versioned endpoints, independent application keys, an explicit scope list, predictable pagination, tenant separation, rotation and revocation. The private TryDataverse API supports customer app keys and scopes for contacts, templates, messages, usage and other workflows. Never put a secret API key in browser JavaScript or public code.
WABA, phone number IDs and WhatsApp Cloud API
Every outbound API request must be associated with a business-authorized WABA and phone number. Merely supplying an ID does not prove permission. Meta approvals, template language, phone quality, customer consent and signed delivery callbacks are required for real service.
Template sends, idempotency and message events
Message submissions should have idempotency keys so client retries do not create unexpected duplicates. Responses are typed, with blocking reasons when a requirement is missing. Meta provider acceptance, delivery, read status and ambiguous network failures are separate outcomes. The public Meta delivery path is not live.
Mia and Leo standing authorization with customer control
The private backend supports an OAuth-style authorization-code flow with PKCE S256, exact registered HTTPS redirect URIs, 15-minute access tokens, rotating refresh tokens and a consent screen for the correct customer workspace. Customers select permissions and daily action limits once, then can revoke all credentials at any time. Public Buzz chat callback integration is still pending.
API access for CRMs, ERP, websites and automations
Integration designs can include customer contact import, opt-in capture, template synchronization, campaign drafting, inbox read, webhook-driven reporting and wallet visibility. These use cases require real user authorization and cannot bypass WhatsApp policies. API examples, scopes and availability are documented on the developer portal.
Pricing, rate limits and production endpoint availability
The private API has bounded quotas and sends remain disabled until authorized Meta connections and payment controls are verified. No production endpoint, global uptime guarantee or unlimited-message pricing has been published. The public documentation explains what has actually been tested.