WhatsApp error 131005: access denied, permission missing
Error 131005 means the access token lacks a permission the WhatsApp endpoint requires, because it was never granted or was later removed. Meta's description is "Permission is either not granted or has been removed." The fix is to inspect the token with the access token debugger, then grant the missing permission or switch to a token that has it.
Meta's code for "Permission is either not granted or has been removed."
The permission needed to send any type of message to WhatsApp users.
business_management, whatsapp_business_management and whatsapp_business_messaging, assigned when generating a system user token.
What does WhatsApp error 131005 mean?
It means the token is accepted as genuine but does not carry the permission the endpoint checks for.
Meta's Cloud API reference lists 131005 with the details text "Permission is either not granted or has been removed." Graph API error 10 carries the identical sentence. The difference is only the range: 10 is a generic Graph API code, while 131005 sits among the WhatsApp codes that start with 131.
Because the words are the same, the diagnosis is the same. Meta's remedy for both is to use the access token debugger and confirm the app holds the permissions the endpoint requires.
Which permission is usually missing?
Usually one of the two WhatsApp permissions, and which one depends on what the call does.
Meta's permissions guide splits them by job. whatsapp_business_messaging is needed to send any type of message and to receive message and status webhooks. whatsapp_business_management is needed for account metadata, template management, listing phone numbers, analytics and account webhooks.
A token generated with only the management permission can read the account and list templates, then fail the moment it tries to send. When generating a system user token, Meta's access token guide has you assign business_management, whatsapp_business_management and whatsapp_business_messaging together.
How do you fix error 131005?
Read the token first, then change only what is missing.
Call the debug_token endpoint, or paste the token into the access token debugger. The scopes property lists every permission granted. Compare it with the reference page of the endpoint that failed.
If a permission is absent, generate a new token that includes it, or have the business owner grant it again if the token comes from a partner flow. If every permission is present and the error persists, check that the system user behind the token has been given access to the specific WhatsApp Business Account, since a token can be fully scoped and still not be assigned to that asset.
Common mistakes
- Assuming the token expired. Expiry returns 190 or 0. This code means the token works but lacks a permission.
- Generating a token with management permission only, then using it to send. Sending needs whatsapp_business_messaging.
- Checking scopes and stopping there. A system user also needs access granted to that specific WhatsApp Business Account.
EasyCoexistence onboards each number through Meta's Embedded Signup, where the business grants the app its permissions, and its MCP connector reports a number's health so an assistant can check before sending.
Frequently asked questions
Is 131005 the same error as 10?
They carry the same description in Meta's reference. 131005 belongs to the WhatsApp range and 10 to the Graph API range.
Can a permission be removed after setup?
Yes. Meta's description explicitly covers permissions that have been removed, not only ones never granted.
Does error 131005 affect the WhatsApp Business app on the phone?
No. It concerns the API token. The app on the phone keeps working as before.
Should I retry after error 131005?
No. Retrying with the same token produces the same result. Fix the permission first.
Keep reading
Ready to get started?
Set up WhatsApp Coexistence in minutes, not months. The app keeps working on the phone.
Start Free TrialVerified on