Every Whats91 MCP OAuth scope, what it unlocks, and how to choose a minimal set.
Scopes
Summary
Every Whats91 MCP OAuth scope, what it unlocks, and how to choose a minimal set.
Prerequisites
- A Whats91 account
- A generated public API token
Related documentation
Each tool declares exactly one required scope. tools/list filters by the granted scopes, so a client that never requested a scope never even sees the tools behind it. Request the smallest set that covers your use case.
Tip
Read scopes and write scopes are separate for every domain. Start with the read scope, confirm behaviour, and add the write scope only when the client genuinely needs to change data.
Scope Reference
| Scope | Tools | Grants |
|---|---|---|
| mcp:billing:read | 1 | Read wallet balance, plan status, and message rates. |
| mcp:blacklist:read | 3 | Check and list blacklist entries. |
| mcp:blacklist:write | 5 | Add, bulk-add, and remove blacklist entries. |
| mcp:campaigns:execute | 12 | Test-send, execute, pause, resume, and cancel campaigns and recurrences. |
| mcp:campaigns:read | 7 | List and read campaigns, recipients, status, and reports. |
| mcp:campaigns:write | 2 | Create and validate campaign drafts. |
| mcp:catalogs:read | 6 | Read catalogs, products, product sets, and sync state. |
| mcp:catalogs:write | 8 | Create, update, and archive products, and drive catalog sync. |
| mcp:chatbot_flows:publish | 7 | Validate, simulate, publish, activate, disable, and archive flows. |
| mcp:chatbot_flows:read | 7 | Read flows, versions, reports, and runtime status. |
| mcp:chatbot_flows:write | 2 | Create and update chatbot flow drafts. |
| mcp:chatbots:read | 3 | List and read chatbots and runtime status. |
| mcp:chatbots:write | 7 | Create, update, enable, disable, and delete chatbots. |
| mcp:connect | 1 | Baseline connectivity and the tools-only operational guide. |
| mcp:contacts:read | 6 | Read contacts, contact books, and import status. |
| mcp:contacts:write | 12 | Add, update, remove, bulk-add, and import contacts and books. |
| mcp:conversations:read | 5 | Find conversations, read history, and check the service window. |
| mcp:forms:read | 8 | Read forms, submissions, statistics, and operations. |
| mcp:forms:write | 9 | Create, clone, update, publish, deprecate, and archive forms. |
| mcp:media:read | 5 | List and read media, usage, limits, and access URLs. |
| mcp:media:write | 6 | Upload and delete media. |
| mcp:messages:chat_send | 1 | Send a session chat message inside the customer service window. |
| mcp:messages:read | 1 | Read the outcome of a message operation. |
| mcp:messages:template_send | 1 | Send an approved WhatsApp template message. |
| mcp:orders:read | 4 | Read orders, payment readiness, and automation diagnostics. |
| mcp:orders:write | 5 | Link order items, transition status, and retry order automation. |
| mcp:reports:read | 1 | Read summarised message reporting. |
| mcp:templates:read | 5 | List, read, preview, validate, and check template sync status. |
| mcp:templates:write | 8 | Draft, update, duplicate, submit, and delete templates. |
| mcp:tools:diagnostics | 3 | Ping, tenant identity, and negotiated connection info. |
Recommended Starting Sets
| Use case | Scopes |
|---|---|
| Read-only assistant | mcp:connect, mcp:tools:diagnostics, mcp:reports:read, mcp:conversations:read, mcp:billing:read |
| Support copilot | The read-only set plus mcp:contacts:read, mcp:messages:chat_send, mcp:messages:read |
| Template author | The read-only set plus mcp:templates:read, mcp:templates:write, mcp:media:read |
| Campaign operator | The template set plus mcp:campaigns:read, mcp:campaigns:write, mcp:campaigns:execute |
Warning
mcp:campaigns:execute is the highest-impact scope on the platform. It covers HIGH_IMPACT_EXECUTION tools that send to entire audiences. Grant it only to clients that genuinely operate campaigns, and keep the approval path enabled.
Related Documentation
MCP
Connect an AI assistant to Whats91 through the Model Context Protocol and give it safe, scoped access to your WhatsApp workspace.
Connect and Authorize
Register an OAuth 2.1 client, complete the PKCE authorization flow, and obtain a scoped Whats91 MCP access token.
Protocol
The JSON-RPC methods the Whats91 MCP endpoint implements, protocol negotiation, and transport rules.
Safety and Approvals
The six safety classes, the prepare and confirm pattern, idempotency, approvals, and audit behaviour.