OAuth 2.1 authorization server metadata
curl -X GET "https://example.com/.well-known/oauth-authorization-server"{}Send a tap-to-call button message POST
Sends an interactive message carrying a call button, letting the contact start a WhatsApp call to you with one tap — the inbound counterpart to requesting permission to call them. `display_text` and `ttl_minutes` fall back to Meta's defaults ("Call Now", 10080 minutes / 7 days) when omitted. ```json { "number_id": "9d2b1f53-8c0e-4f1d-9a6b-5d3a8c47e9f0", "to": "254700000001", "text": "Need a hand with your order? Tap to call us.", "display_text": "Call support", "ttl_minutes": 1440, "payload": "order-SK-4821" } ``` Meta's reference: https://developers.facebook.com/docs/whatsapp/cloud-api/guides/calling **API-key scope:** `whatsapp.messages`.
Dynamic client registration POST
RFC 7591. Unauthenticated, and it WRITES on every hit — a client mints a new registration by calling it — so it is rate-limited per IP (20/minute). That bounds the rate of growth, not the total: stale client rows are not yet swept.