https://graph.whats91.com/mcp
Endpoint
A single stateless JSON-RPC 2.0 endpoint. POST only.
Connect an AI assistant to Whats91 through the Model Context Protocol and give it safe, scoped access to your WhatsApp workspace.
Whats91 MCP
Summary
Connect an AI assistant to Whats91 through the Model Context Protocol and give it safe, scoped access to your WhatsApp workspace.
Prerequisites
- A Whats91 account
- A generated public API token
Related documentation
The Whats91 MCP server lets an AI assistant work inside your Whats91 workspace: read reports, draft templates, prepare campaigns, manage contacts, and send messages. It is a separate product from the REST API. Where the REST API is designed for your own backend, MCP is designed for an autonomous or semi-autonomous client that needs guard rails.
151
Tools
Registered tools across 14 groups, each with a declared scope and safety class.
OAuth 2.1
Authorization
Authorization code with PKCE, dynamic client registration, and per-scope consent.
6
Safety classes
Every tool declares one, which determines approval, preview, retry, and audit behaviour.
MCP Compared With the REST API
| REST API | MCP | |
|---|---|---|
| Audience | Your backend, written by you | An AI client acting on a user behalf |
| Base | https://graph.whats91.com/api/{version} | https://graph.whats91.com/mcp |
| Versioning | Path version: v2, v3 | Per-tool version plus a negotiated protocol version |
| Auth | Public API bearer token | OAuth 2.1 access token with granular scopes |
| Shape | REST resources, HTTP verbs | JSON-RPC 2.0 tool calls |
| Guard rails | Your code decides what is safe | Declared safety classes, prepare/confirm, approvals, audit |
Tip
Use the REST API when your own code is in control of the decision. Use MCP when a model is in control and you need the platform to enforce what it may do.
What an MCP Client Can Do
| Group | Tools | Typical use |
|---|---|---|
| Diagnostics | 4 | Connectivity, identity, negotiated capabilities, and the tools-only operational guide. |
| Messaging | 3 | Send approved templates and session chat messages, and inspect a message operation. |
| Templates | 13 | Read, validate, draft, duplicate, submit, and delete WhatsApp templates. |
| Campaigns | 21 | Build, validate, test-send, execute, pause, resume, and cancel campaigns and recurrences. |
| Contacts | 18 | Read and write contacts, contact books, memberships, and bulk imports. |
| Chatbots and Flows | 26 | Manage chatbots, and draft, validate, simulate, version, and publish chatbot flows. |
| WhatsApp Forms | 17 | Create, validate, preview, publish, deprecate, and archive forms, and read submissions. |
| Catalogs | 14 | Read catalogs and products, write product records, and drive catalog synchronisation. |
| Orders | 9 | Read orders, check payment readiness, transition order status, and retry order automation. |
| Media | 11 | List and read media, check usage and limits, upload new media, and delete media. |
| Conversations | 5 | Find conversations, read history, and check the 24-hour customer service window. |
| Blacklist | 8 | Check, list, add, bulk-add, and remove blocked recipients. |
| Reports | 1 | Summarised message reporting for an agent conversation. |
| Billing | 1 | Read wallet balance, plan status, and message category rates. |
Getting Started
- Register an OAuth client, or use a pre-provisioned client id.
- Complete the authorization code flow with PKCE and request only the scopes your client needs.
- Send initialize to negotiate the protocol version and read server capabilities.
- Call tools/list to discover the tools your granted scopes actually expose.
- Call whats91_whoami and whats91_connection_info to confirm tenant identity and operational readiness.
- Start with read-only tools, then adopt writes through the prepare and confirm pattern.
Related Documentation
Connect and Authorize
Register an OAuth 2.1 client, complete the PKCE authorization flow, and obtain a scoped Whats91 MCP access token.
Protocol
The JSON-RPC methods the Whats91 MCP endpoint implements, protocol negotiation, and transport rules.
Scopes
Every Whats91 MCP OAuth scope, what it unlocks, and how to choose a minimal set.
Safety and Approvals
The six safety classes, the prepare and confirm pattern, idempotency, approvals, and audit behaviour.