WhatsApp node reference - all 54 operations, the credential it needs, and a worked example.
WhatsApp Business Cloud API (Communication). 54 operations: send every message type (text, image, video, audio, document, sticker, location, contact card, reaction, template) and every interactive message (reply buttons, list menu, call-to-action URL, location request); mark read, typing indicators and group message pinning; media upload, URL retrieval, download and delete; message template CRUD; business profile read and update; phone number reads, verification and registration; user blocking; the group plane (create, list, read, update, delete, participants, invite links, join requests); and WhatsApp Business Account reads plus webhook subscription.
Credential: WhatsApp - see Credentials.
Each operation below lists the permission it needs. Permissions are granted to the Meta access token - a System User token in Business Settings, or the token an Embedded Signup flow returns. WhatsApp has only TWO permissions for the entire platform, and the split does not follow reads-versus-writes, it follows the PLANE: whatsapp_business_messaging covers anything that touches a conversation (sending, media, read receipts, typing, blocking and the whole group plane), and whatsapp_business_management covers anything that configures the account (templates, the business profile, phone numbers, registration, the WABA and its webhook subscriptions). The trap is the business profile and the phone-number reads - they hang off the same phone number ID the sends use, so they feel like messaging, but they are management-plane calls and a send-only token gets a 403 on them with an error body that never names the missing permission. Two further things no permission can grant: the group operations additionally require the number to be an Official Business Account running on Cloud API, and a temporary token from the app dashboard expires after 24 hours whatever it was granted. If a run fails with a permission error, the node names the missing permission in the error - grant it and re-run; you do not need to rebuild the workflow.
| Operation | What it does | Permission |
|---|
sendText | Send text | whatsapp_business_messaging |
sendImage | Send image | whatsapp_business_messaging |
sendVideo | Send video | whatsapp_business_messaging |
sendAudio | Send audio | whatsapp_business_messaging |
sendDocument | Send document | whatsapp_business_messaging |
sendSticker | Send sticker | whatsapp_business_messaging |
sendLocation | Send location | whatsapp_business_messaging |
sendContacts | Send contact card | whatsapp_business_messaging |
sendReaction | React to a message | whatsapp_business_messaging |
sendTemplate | Send template | whatsapp_business_messaging |
| Operation | What it does | Permission |
|---|
sendInteractiveButtons | Send reply buttons | whatsapp_business_messaging |
sendInteractiveList | Send list menu | whatsapp_business_messaging |
sendCtaUrl | Send call-to-action URL button | whatsapp_business_messaging |
sendLocationRequest | Ask for the user's location | whatsapp_business_messaging |
| Operation | What it does | Permission |
|---|
markRead | Mark message as read | whatsapp_business_messaging |
sendTypingIndicator | Show typing indicator | whatsapp_business_messaging |
pinMessage | Pin a group message | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API — pinning is a groups feature, admin-only, max 3 pinned per group) |
unpinMessage | Unpin a group message | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API — pinning is a groups feature, admin-only) |
| Operation | What it does | Permission |
|---|
uploadMedia | Upload media | whatsapp_business_messaging |
getMediaUrl | Get media URL | whatsapp_business_messaging |
downloadMedia | Download media | whatsapp_business_messaging |
deleteMedia | Delete media | whatsapp_business_messaging |
| Operation | What it does | Permission |
|---|
listTemplates | List message templates | whatsapp_business_management |
getTemplate | Get message template | whatsapp_business_management |
createTemplate | Create message template | whatsapp_business_management |
updateTemplate | Edit message template | whatsapp_business_management |
deleteTemplate | Delete message template | whatsapp_business_management |
| Operation | What it does | Permission |
|---|
getBusinessProfile | Get business profile | whatsapp_business_management |
updateBusinessProfile | Update business profile | whatsapp_business_management |
| Operation | What it does | Permission |
|---|
listPhoneNumbers | List business phone numbers | whatsapp_business_management |
getPhoneNumber | Get business phone number | whatsapp_business_management |
requestVerificationCode | Request verification code | whatsapp_business_management |
verifyCode | Verify code | whatsapp_business_management |
registerPhoneNumber | Register phone number | whatsapp_business_management |
deregisterPhoneNumber | Deregister phone number | whatsapp_business_management |
setTwoStepPin | Set two-step verification PIN | whatsapp_business_management + whatsapp_business_messaging (Meta documents both for this call) |
| Operation | What it does | Permission |
|---|
blockUsers | Block users | whatsapp_business_messaging |
unblockUsers | Unblock users | whatsapp_business_messaging |
listBlockedUsers | List blocked users | whatsapp_business_messaging |
| Operation | What it does | Permission |
|---|
createGroup | Create group | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
listGroups | List active groups | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
getGroup | Get group info | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
updateGroup | Update group settings | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
deleteGroup | Delete group | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
removeGroupParticipants | Remove group participants | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
getGroupInviteLink | Get group invite link | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
resetGroupInviteLink | Reset group invite link | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
listGroupJoinRequests | List group join requests | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
approveGroupJoinRequests | Approve group join requests | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
rejectGroupJoinRequests | Reject group join requests | whatsapp_business_messaging (and the number must be an Official Business Account on Cloud API) |
| Operation | What it does | Permission |
|---|
getWaba | Get WhatsApp Business Account | whatsapp_business_management |
listSubscribedApps | List apps subscribed to webhooks | whatsapp_business_management |
subscribeApp | Subscribe app to webhooks | whatsapp_business_management |
unsubscribeApp | Unsubscribe app from webhooks | whatsapp_business_management |
Open a conversation with a template, because you usually may not just message someone
Outside a 24-hour customer service window WhatsApp refuses free-form messages — the only way to start a conversation is an approved template. So sendTemplate, not sendText, is the operation most workflows actually need first, and getting this wrong looks like the integration randomly failing for some recipients.
Set Operation to sendTemplate, then fill in:
| Field | Value | Notes |
|---|
phoneNumberId | {{ vars.whatsappPhoneNumberId }} | The business phone number id (PNID) the message is sent from |
to | {{ myTrigger.phone }} | E.164, no leading + |
templateName | order_shipped | Must be an approved template in the WABA |
templateLanguage | en_US | Must match the approved template's locale exactly |
templateParams | {{ myTrigger.orderId }}, {{ myTrigger.carrier }} | Positional body variables, in template order |
Sets {{notice.messageId}}, {{notice.waId}} and {{notice.to}}. The node's Graph apiVersion is configurable and defaults to v25.0 — the old hardcoded v20.0 expires 2026-09-24.