WhatsApp Chatbot for Legal Practices: Key Use Cases, Compliance Boundaries, and How to Get Started
Updated at Jul 22, 2026
7 min to read
Is your WhatsApp Business API setup stuck even after you followed Meta’s review steps?
This usually happens when account review, permissions, WhatsApp Business Account (WABA) access, and API error codes start overlapping.
A delayed review may point to missing validation. A failed API request may reveal a token, template, permission, or setup issue. For teams preparing to launch WhatsApp automation, these blockers can delay approval, testing, and deployment.
This guide covers the main causes of WhatsApp Business account review delays, how to interpret common WhatsApp Business API error codes, and how to decide on the next fix.
What Causes WhatsApp Review Delays?
WhatsApp review delays usually happen when the app setup, permissions, or WhatsApp Business assets cannot be fully validated during the Meta review.
This can happen when Meta cannot validate the app’s API readiness, permissions, WhatsApp Business Account (WABA) access, or required test calls.
Below are the main review blockers teams should check first.
API Errors Prevent Meta from Validating the App
API errors can delay review if Meta cannot confirm that the app’s WhatsApp functionality works correctly.
Check for:
- Failed Meta API requests
- Error subcodes in the API response
- Missing or unclear fbtrace_id, which is Meta’s tracking ID for the failed request
- Failed access to the API function being tested
- Meta WhatsApp error codes tied to permissions or WhatsApp assets
These errors indicate that something in the setup still needs to be corrected before the review can proceed.
Required API Test Calls Are Not Detected
Important API test calls may stay undetected when Meta cannot connect the call to the submitted review flow.
Check whether the call was made with the correct:
- Meta app
- Access token
- WhatsApp Business Account (WABA)
- Requested permission
- Business asset, such as the right WhatsApp account, phone number, or template
- Reviewer instructions, test environment, webhook events, and demonstration flow submitted for validation
This is why a review checklist can remain incomplete even after the team has run the calls.
Permission Access Is Missing or Misaligned
Permission issues in WhatsApp Business platform API happen when the requested permission does not match the app’s actual API activity.
Check for:
- Missing whatsapp_business_management permission
- Missing whatsapp_business_messaging permission
- Advanced Access approval not granted by Meta
- Incorrect WhatsApp Business Account (WABA) permission
- Missing access to the right business asset
- Incorrect business user or system user role
- Access tokens without the required permission scope
- API calls being tested in Development Mode instead of Live Mode
These permission issues in the WhatsApp Business Platform API can make the app look unready for approval.
WABA, Phone Number, or Template Setup Is Incomplete
WhatsApp Business API setup issues can delay approval when required WhatsApp assets, messaging components, or app connections are incomplete or misconfigured.
Check whether these match the WhatsApp Business API documentation:
- WhatsApp Business Account (WABA) configuration
- Phone number ID
- Message template status
- Subscribed app connection
- Webhook subscription, which sends WhatsApp updates back to your system
- Business asset linkage between the app, WABA, and phone number
When these blockers are removed, the review path becomes clearer. To understand these review blockers more clearly, it helps to separate business verification issues from technical WhatsApp API and app review errors.
Business Verification Issues vs Technical API Errors: Understanding the Difference
Business verification issues and technical API errors can both delay Meta review, but they require different fixes.
Use this table to separate account-level blockers from error codes from WhatsApp Cloud API before deciding the next action.
This distinction helps teams avoid treating every delay like a technical error when some blockers need account-level action first.
Once the blocker is identified as technical, the next step is to read the API response correctly. That’s exactly what the next section talks about.
How to Read WhatsApp API Error Responses Correctly
WhatsApp API errors should be read as diagnostic signals before any fix is applied. A failed request can indicate a token issue, a permission gap, invalid request data, a delivery failure, or a policy restriction.
Reading the full response helps teams avoid guessing and fix the right layer first. Use this sequence:
- Start with the error code: Check the main error code first. This shows the broad category, such as authentication, permission, rate limit, template, or request-format issues.
- Read the error message: The message explains what the API could not process. Do not rely on the code alone, because the message often gives the first usable clue.
- Check error_data or error details: This field may explain the exact cause, such as a missing field, an invalid value, a template issue, or an asset access problem behind the failed request.
- Save the fbtrace_id: The fbtrace_id is Meta’s tracking ID for the failed request. It helps when the issue needs to be escalated to Meta, a Business Solution Provider, or an internal engineering team.
- Identify where the error came from: Some Meta WhatsApp error codes appear directly in the API response. Others appear later through webhook delivery updates, which are status updates WhatsApp sends back after processing a message.
- Match the source to the likely fix: API response errors usually indicate issues with setup, permissions, tokens, or request data. Webhook errors usually point to delivery, recipient, template, or policy conditions.
At this point, the error response is no longer just a warning. It becomes a map of where the failure sits. The next section turns that map into action by breaking down the most common WhatsApp Business API error codes and fixes.
Common WhatsApp API Error Categories and How to Fix Them
A common WhatsApp Business API error becomes easier to fix when teams first identify the type of failure.
Most errors fall into a few clear groups. Some point to access issues. Some point to permission gaps. Others come from templates, sending limits, message quality, request details, or delivery failures.
Use this WhatsApp Business platform error codes list as a quick starting point before moving into the fixes.
These WhatsApp Business errors and fixes help teams move from code lookup to action. The sections below explain what each code usually signals and what to fix first.
1. Authentication and Access Token Errors: Code 190
Authentication and access token errors usually appear as Code 190 when Meta cannot verify the access token used in the API request.
An access token works like a login key for the API. If it is expired, invalid, connected to the wrong Meta app, or missing the right permission, the request fails.
To fix this:
- Confirm the token belongs to the same Meta app.
- Check whether the token is linked to the correct business and WhatsApp Business Account.
- Review whether the token has expired.
- Confirm the token includes the permission needed for that API action.
- Replace temporary tokens with the correct long-term business token.
After that, retry the request with the regenerated token.
2. WhatsApp Business Management Permission Errors: Codes 10, 200, and 299
Permission and business management errors usually appear as Codes 10, 200, or 299 when the app attempts an action it is not authorized to perform.
Code 10 indicates a missing permission for the requested action, Code 200 signals permission or access denial, and Code 299 points to the app lacking advanced access or an approved permission scope.
Therefore, these errors often happen when the app lacks WhatsApp Business Management access, WhatsApp Business Messaging access, Advanced Access approval, or access to the right business asset.
To fix this:
- Match each requested permission to its corresponding API action.
- Confirm whether the app has WhatsApp Business Management access.
- Confirm whether the app has WhatsApp Business Messaging access.
- Check whether Advanced Access is approved.
- Make sure the app, token, WhatsApp Business Account, phone number, and business are all part of the same setup.
- Recheck this alignment if the Meta App Review does not detect the required API test calls.
These mismatches can cause API failures or prevent Meta from validating the review flow correctly.
3. Message Window and Template Errors: Code 131047
Message window and template errors usually appear as Code 131047 when the business tries to send a normal message after the 24-hour customer service window has closed.
A normal message is one typed or sent freely, without using a pre-approved WhatsApp template. Once the 24-hour window closes, that type of message is no longer allowed.
To fix this:
- Check when the user last messaged the business.
- Confirm whether the 24-hour customer service window has closed.
- Use an approved WhatsApp message template.
- Match the correct template language.
- Check the template category.
- Confirm that all template variables are filled correctly.
Do not retry the same free-form message if the conversation window has already closed.
4. Rate Limit and Throughput Errors: Code 130429
Rate limit and throughput errors usually appear as Code 130429 when the app or phone number sends more messages than the Cloud API can process at that moment.
Throughput is the number of messages the API can handle per unit time. When the sending volume crosses that limit, requests may fail even if the message content is valid.
To fix this:
- Reduce the sending speed.
- Queue outgoing messages before retrying.
- Avoid repeated instant retries.
- Spread high-volume sends over time.
- Separate urgent transactional messages from bulk campaigns.
- Monitor whether failures increase during sending spikes.
The goal is to reduce request pressure before retrying.
5. Spam, Quality, and Policy Errors: Code 131048
Spam, quality, and policy errors usually appear as Code 131048 when WhatsApp detects poor engagement, spam risk, or account quality concerns.
This is not only an API issue. It usually indicates how messages are sent, who receives them, and whether users find them relevant.
To fix this:
- Review whether users clearly opted in.
- Check block and report patterns.
- Reduce message frequency if engagement is weak.
- Improve campaign targeting.
- Review whether the template matches user intent.
- Avoid scaling the same campaign without changes.
If quality signals are weak, reduce volume and improve message relevance before scaling again.
6. Parameter, Phone Number, and Media Errors: Code 100
Parameter, phone number, and media errors usually appear as Code 100 when the API request contains missing, invalid, unsupported, or incorrectly formatted data.
This is usually a request setup issue. The message may fail due to an incorrect phone number ID, an incorrect recipient format, a missing template variable, an unsupported media type, or an incorrect data format.
To fix this:
- Check the phone number ID.
- Confirm the recipient number format.
- Review required fields.
- Match the template variable count.
- Use a supported media file type.
- Compare the request data with the API requirement for that action.
After correcting the request data, retry with a clean request instead of reusing the failed one.
7. Message Delivery Errors: Code 131026
Message delivery errors usually appear as Code 131026 when WhatsApp accepts the request but cannot deliver the message.
This means the first API request may look successful, but the message still fails later. That failure may appear through a delivery update, also called a webhook status update.
To fix this:
- Review the message delivery status.
- Check webhook delivery updates.
- Confirm the recipient number is valid.
- Check whether the user can receive WhatsApp messages.
- Review message eligibility.
- Look for delivery restrictions.
This error is usually diagnosed from message status logs, not just from the first API response.
Other Less Common WhatsApp API Error Codes to Know
Less common WhatsApp API errors can still affect templates, phone registration, ecosystem limits, or message sending.
Verify these codes against the Meta documentation before applying broad fixes.
- 131049: Ecosystem health limit
- 132000 or 132001: Template mismatch issue
- 133010: Phone number registration issue
- 135000: Generic message send error
Once these error categories are clear, the next issue to address is more specific: what to do when API calls complete but Meta’s review checklist still does not update.
Let's find out in the next section.
Why Meta Review Test Call Checkboxes Stay Grey
Meta App Review test call checkboxes can stay grey even when the API calls have technically been run.
In most cases, the issue is not only whether the call worked. It is whether Meta can treat that call as valid evidence for the permission under review.
This is common during WhatsApp Business Account Review, especially for permissions that involve managing WhatsApp assets. The sections below explain what the grey checkbox usually signals and what to verify before resubmitting.
What the Grey Checkbox Usually Means
A grey checkbox usually indicates that the test activity has not yet been accepted as evidence for review. This can happen when the API call does not match the permission being reviewed.
For example, WhatsApp Business Management should show management-related activity, such as reading WABA details, phone numbers, templates, or subscribed apps.
It can also happen when the dashboard needs time to sync after valid test calls.
What to Check Before Waiting or Resubmitting
Before waiting or resubmitting, confirm that the test evidence connects clearly to the review request. Check whether:
- The calls were made from the same Meta app under review.
- The access token includes the requested permission.
- The WhatsApp Business Account (WABA) is part of the same business setup.
- The phone number and business assets are correctly assigned.
- The screencast clearly shows the relevant management action.
- The response payload and fbtrace_id are saved.
- The reviewer notes explain which API actions were completed.
If these match and the checkbox still stays grey, wait briefly for sync. Then resubmit with clearer evidence of permission, rather than changing unrelated settings.
However, if the checkbox remains grey after these checks, teams should not keep changing settings at random. The next section provides a WhatsApp API errors & troubleshooting guide to verify.
Checklist for Troubleshooting WhatsApp Business API Error Before Escalating
A final troubleshooting checklist helps teams confirm whether the issue is technical, operational, or ready for escalation.
Use this checklist to separate API-side issues from business setup issues.
Technical Checks for Developers
Developers should confirm whether the API request, permission setup, and error evidence are complete. Check:
- Full API response with error code and fbtrace_id
- Access token permissions
- API request data and required fields
- Correct API function or URL being used
- Webhook URL and callback verification
- Retry behavior after failed requests
- Request logs from the failed test
These checks support faster debugging and stronger evidence for escalation.
Business and Operational Checks
Business teams should confirm whether the WhatsApp account is ready for approval, sending, and customer-facing use. Check:
- Business verification status
- Account quality rating
- Billing status
- Phone number status
- Template approval status
- Recent message delivery issues
- Impact on support, sales, or automation workflows
These checks show whether the issue is caused by account readiness, sending quality, or operational setup.
After these checks, the issue should no longer feel like a vague API failure. The team should know whether the blocker sits in the request, the permission setup, the account, or the review flow.
At this stage, it’s worthwhile to understand how to choose the right troubleshooting path: fix it internally, escalate it, or use a managed platform.
When to Fix Internally, Escalate, or Use a Managed Platform
If the issue is caused by request setup, permissions, or configuration, the implementation team can usually fix it. If the issue sits with Meta review, account restrictions, or policy enforcement, escalation is the better path.
Use the sections below to choose the right next action.
Fix Internally for Configuration-Based Errors
Configuration-based errors should usually be fixed by the internal implementation team first. These issues are often caused by setup mistakes that the team can directly change and retest.
Fix internally when the issue involves:
- Wrong or expired access token
- Incorrect permission setup
- Request data errors
- Template parameter mismatch
- Webhook setup gaps
- Wrong API function or URL
- Retry logic issues
This gives the implementation team enough context to test the fix more quickly and avoid repeating the failed setup.
Escalate for Review, Policy, or Account Restrictions
Escalation is the right path when the issue cannot be resolved by changing the API request alone. This includes delayed Meta review, business verification issues, account restrictions, policy blocks, low account quality, or unresolved permission approval problems.
However, before escalating, collect:
- Error code
- fbtrace_id
- Screenshots
- Reviewer notes
- Request logs
- Proof of completed test calls
- Account or policy warning details
This helps Meta support, BSP support, or developer support review the blocker faster.
Use a Managed Platform When API Maintenance Slows Growth
A managed platform is useful when repeated API setup, review, permissioning, and troubleshooting tasks start to slow down launch or support operations.
This path makes sense, especially when the team wants:
- Faster WhatsApp automation setup
- Less manual API maintenance
- Lower dependency on repeated developer troubleshooting
For example, a platform like BotPenguin helps teams build WhatsApp automation on the Official WhatsApp Business API, with no hidden cost, no markup on Meta charges, and a Free Forever plan.
This makes BotPenguin a practical fit when the goal is not only to fix a single API error but also to reduce recurring setup, review, and maintenance effort for WhatsApp automation.
Conclusion
WhatsApp API errors and Meta reviews become easier to resolve when every blocker is traced to its real cause.
For instance, review delays, grey checkboxes, failed API calls, and message errors often look connected, but they do not always need the same fix. Some need a cleaner permission setup. Some need a corrected token, template, or request format. Others need stronger evidence before escalation.
The goal is to stop guessing and move with proof.
Once teams understand what the error points to, they can decide whether to fix it internally, escalate it, or simplify the workflow.
For teams that want fewer setup delays and less manual API maintenance, a support platform like BotPenguin, which provides easy access to the official WhatsApp Business API, is worth exploring.
Frequently Asked Questions (FAQs)
Why is the checkbox in my Meta App Review API test call still grey?
The checkbox may stay grey if Meta cannot link the test call to the same app, token, WABA, permission, or review request.
What does WhatsApp Business API error code 131047 mean?
Error 131047 means the 24-hour customer service window has closed. Use an approved template message to restart the conversation.
How do I fix permission errors in the WhatsApp Business Platform API?
Check the requested permission, advanced access, WABA access, business asset assignment, token scope, and whether the API action matches the permission.
Where can I find Meta WhatsApp Cloud API Error Codes?
Use Meta’s official WhatsApp Business Platform documentation first. Then compare the code with your API response, error details, and fbtrace_id.
Should I wait or resubmit if the WhatsApp account review is delayed?
Wait briefly if all test calls, screencast, permissions, and reviewer notes are correct. Resubmit if the evidence is unclear or mismatched.
Why do WhatsApp API calls fail even when the setup looks complete?
API calls can fail when the token, WABA, phone number, permission, template, or request data does not match the approved setup.
When should I escalate a WhatsApp API issue to Meta or a BSP?
Escalate when the issue involves review delays, policy restrictions, account blocks, business verification, or unresolved permission approval after technical checks.
Can BotPenguin help reduce WhatsApp API setup and maintenance issues?
Yes. BotPenguin can help teams simplify WhatsApp Business API access and automation when repeated setup, review, permission requests, or API maintenance issues slow down implementation.
