Permissions

Your app declares the permissions it may ask for when you register it. The authorize link then asks for some or all of them, and the customer sees each one in plain words. A token can call only the endpoints its permissions open, and nothing else.

Ask only for what your app needs. Customers see the full list before they click Allow.
Permissions match exactly: whatsapp.contacts:write does not include whatsapp.contacts:read.
account:read is always included.
A request that mixes WhatsApp and Email permissions is refused with invalid_scope. One app works with one platform.

Tier	Meaning
Basic	Any app may ask for it.
Sensitive	Any app may ask for it. You give a reason for it when you submit the app for review.
Restricted	Only a verified app can use it. You give a reason at review.

WhatsApp permissions

Permission	What the customer sees	Tier	Endpoints
`account:read`	See your business name and account ID	Basic	`GET /api/v1/oauth/me`
`whatsapp.messages:send`	Send WhatsApp messages from your business number. Each message is charged to your wallet at your normal rates. It can also see whether its own messages were delivered.	Sensitive	`POST /api/v1/public/message`, `GET /api/v1/public/messages/:id`
`whatsapp.contacts:write`	Add and update your contacts, their tags and notes	Sensitive	`POST /api/v1/public/contacts`, `POST /api/v1/public/contacts/tags`, `POST /api/v1/public/contacts/tags/remove`, `POST /api/v1/public/contacts/notes`
`whatsapp.templates:read`	See your WhatsApp message templates	Basic	`GET /api/v1/public/templates`
`whatsapp.contacts:read`	See your contacts and their phone numbers	Restricted	`POST /api/v1/public/apis/users`
`whatsapp.reports:read`	See how your templates perform (sent, delivered and read counts)	Basic	`GET /api/v1/public/templates/insights`

Email permissions

Permission	What the customer sees	Tier	Endpoints
`account:read`	See your business name and account ID	Basic	`GET /api/v1/oauth/me`
`email.messages:send`	Send email from your verified domains. Each email is charged to your account at your normal rates. It can also see your sending domains and addresses.	Sensitive	`POST /api/v1/partner/email/send`, `POST /api/v1/partner/email/send-template`, `POST /api/v1/partner/email/send-bulk` (verified apps only), `GET /api/v1/partner/email/identities`
`email.contacts:write`	Add and update contacts in your audiences. It can also see the names of your audiences.	Sensitive	`GET /api/v1/partner/email/audiences`, `GET /api/v1/partner/email/audiences/:id`, `POST /api/v1/partner/email/audiences/:id/contacts`, `PATCH /api/v1/partner/email/audiences/:id/contacts/:email`
`email.templates:read`	See your email templates	Basic	`GET /api/v1/partner/email/templates`, `GET /api/v1/partner/email/templates/:id`, `GET /api/v1/partner/email/templates/by-name/:name`
`email.contacts:read`	See the contacts in your audiences	Restricted	`GET /api/v1/partner/email/audiences`, `GET /api/v1/partner/email/audiences/:id`, `GET /api/v1/partner/email/audiences/:id/contacts`
`email.reports:read`	See email delivery, open and bounce reports	Basic	`GET /api/v1/partner/email/emails/:message_id`, `GET /api/v1/partner/email/stats`, `GET /api/v1/partner/email/quotas`, `GET /api/v1/partner/email/events`, `GET /api/v1/partner/email/bounce-report`

The It will be able to part of the consent screen for an Email app: Send email from your verified domains with its charge line, See your email templates, and the Details toggle open with the raw permission names — How permissions read on the consent screen.

Restricted permissions and the verified badge

Restricted permissions work only while your app is verified:

The consent screen does not let a customer allow a restricted permission for an app that is not verified.
If a verified app loses its badge (see App review), restricted permissions pause at once: new tokens leave them out and calls that need them get 403 insufficient_scope. They come back as soon as we verify the app again: the next token you get from a refresh carries them. Nothing needs to be allowed again.

Asking for more later

Send the user to the authorize page again with the larger scope. The consent screen shows the new permissions and lists the old ones as already allowed. After Allow, every token of that connection carries the full set.