WhatsApp error 3: capability or permissions issue
Error code 3 means the app calling the endpoint lacks a capability or permission that endpoint requires. Meta's description is "Capability or permissions issue." The Graph API names it API Method. The fix is to inspect the token's granted permissions with the access token debugger and add whichever one the endpoint needs.
Meta's code for "Capability or permissions issue."
The name the Graph API error handling guide gives code 3.
whatsapp_business_management and whatsapp_business_messaging, the two most WhatsApp endpoints need.
What does WhatsApp error code 3 mean?
It means the request was authenticated but the app is not allowed to do what it asked.
Meta lists code 3 among the authorization errors in the Cloud API reference with the details text "Capability or permissions issue." The Graph API error handling guide, which the Cloud API inherits, calls the same code API Method and says to make sure the app has the capability or permissions needed for the call.
So the token works. Identity is not the problem, which is what separates this from codes 0 and 190. What the token is allowed to touch is the problem.
How do you check which permissions a token has?
With the access token debugger, or the debug_token endpoint, which returns the same information.
The response lists the granted permissions in its scopes property. Compare that list against the reference page for the endpoint that failed, since each reference names the permissions it requires.
For WhatsApp, two permissions cover almost everything. whatsapp_business_management is needed for account metadata, templates, phone number listings, analytics and account webhooks. whatsapp_business_messaging is needed to send any message and to receive message and status webhooks. A token holding only one of them fails on calls that need the other.
Why would a partner app see error 3 when a direct developer does not?
Because partners serving other businesses have an extra gate.
Meta's permissions guide says that a partner whose clients use its app to access their data must pass App Review and hold Advanced access for every permission the app needs. A direct developer working only with its own business data does not need App Review or Advanced access.
So the same code can run cleanly against the developer's own account and fail against a client's account. When that pattern appears, the question is not which permission is missing from the token but whether the app has been approved to use that permission on assets it does not own.
Common mistakes
- Generating a new token with the same scopes. A fresh token with the same permissions fails in the same place.
- Checking the permission name in the app settings instead of on the token. What counts is what the token was granted.
- Testing only against your own account. Partner apps need Advanced access before client accounts will accept the call.
EasyCoexistence connects each number through Meta's own Embedded Signup flow, so the business grants the permissions at onboarding and the connection's health stays visible from the dashboard afterwards.
Frequently asked questions
Is error 3 a problem with my phone number?
No. It concerns what the app's token is allowed to do. The number is not checked before the request is refused.
What is the difference between error 3 and error 10?
Code 3 is a capability or permissions issue. Code 10 says a permission was not granted or has been removed. Both are solved by checking the token's scopes.
Which permission do I need to send messages?
whatsapp_business_messaging. Meta's permissions guide says it is required to send any type of message.
Will retrying help?
No. The token's permissions do not change between attempts, so the result is the same.
Keep reading
Ready to get started?
Set up WhatsApp Coexistence in minutes, not months. The app keeps working on the phone.
Start Free TrialVerified on