Cloud API FAQs

We expect Cloud API to provide the same key features as the On-Premises API soon, including user change notifications and sticker pack management. Our goal is for the Cloud API to become the preferred platform for new features.

We will release updates monthly with new features and improvements. There is no work required to access these features - the Cloud API updates automatically.

WhatsApp develops and operates the WhatsApp Business API, which enables businesses to communicate with WhatsApp consumer users on the WhatsApp network. When using the Cloud API, Meta will host the WhatsApp Business API for you and provide an endpoint for the WhatsApp service for your incoming and outgoing WhatsApp communications.

Meta will not use WhatsApp messages to inform the ads that a person sees. However, as is always the case, businesses can use messages they receive for their own marketing purposes, which may include advertising on Facebook or other channels, like email or TV.

No, we will continue to provide the On-Premises API for now. See On-Premises API for information.

No, there is no difference in messaging prices between the Cloud API and the On-Premises API. Access to Cloud API is free, and we expect it to generate additional cost savings for developers. The two types of cost savings for the Cloud API are 1) set up cost (including server or external cloud provider cost), 2) ongoing cost of maintenance (including engineering time for API upgrades).

A Business Solution Provider can select which setup a given client should use. We recommend that the majority of clients use the Cloud API for ease of implementation and maintenance. Business Solution Providers can also continue to maintain integration with the on-premises API.

We want to make it clear what it means to message with a business on WhatsApp. Some businesses may choose to use Meta or another company to help them manage and store their messages. When a business chooses to manage their messages with another company, we will let consumers know by showing a different system message. Learn more.

The Cloud API architecture significantly simplifies the BSP’s operational and infrastructure requirements to integrate with WhatsApp Business Platform. First, it removes the infrastructure requirements to run Business API docker containers (CAPEX savings). Second, it obviates the need of operational responsibilities to manage the deployment (OPEX savings). For details, refer to the architecture diagram comparing the On-Premises and Cloud API deployments.

BSPs and direct clients do not need the WebApp and CoreApp containers that are used in the On-Premises product. Meta will manage all database data and media data on behalf of the BSP or direct client.

We will have disaster recovery and data replication across multiple regions. The expected downtime would be within our SLA and usually in the order of less than a minute to less than five minutes. We will share more information on SLAs in 2022.

As your on-premises performance depends heavily on your hardware, software, and connectivity to WhatsApp servers, if you wish to understand these differences, you can perform your own load tests on Cloud API as you might have done for your own on-premises installation. You can also refer to our performance comparison to understand more details around how the on-premise and Cloud APIs compare.

Migrating between the on-premises and Cloud APIs is seamless, and can be done bidirectionally. See migration details for more information.

Cloud API runs in the Meta data centers. Meta has data centers in North America and the E.U. At this time, we do not offer data localization.

See Cloud API Overview, Encryption.

Messages at rest are encrypted. They are automatically deleted after 30 days.

Like all other WhatsApp Business API Business Solution Providers, Meta manages the encryption and decryption keys on behalf of the business. In order to send and receive messages through Cloud APIs, Cloud API software manages the encryption/decryption keys on behalf of the business. Meta will operate the Cloud API and its terms limit its use of providing this service to delivering messages only. WhatsApp does not have access to keys nor messages.

We have obtained SOC 2 Type I certification and are pursuing SOC 2 Type II. You can refer to the Consensus Assessments Initiative Questionnaire to understand the security model.

Meta takes data protection and people's privacy very seriously and we are committed to continuing to comply with data protection laws. The Cloud API allows our customers to continue to meet their obligations under General Data Protection Regulation (GDPR). Meta complies with applicable legal, industry, and regulatory requirements as well as industry best practices. See more.

On July 16 2020, the Court of Justice of the European Union (CJEU) decided that the EU-US Privacy Shield is invalid because of concerns about the adequacy of data protection in the US. Our new Business Terms of Service now incorporates Standard Contractual Clauses (replacing the US-EU and US-Swiss Privacy Shield).

We welcome the decision of the Court of Justice of the European Union to confirm the validity of Standard Contractual Clauses for transfers of data to non-EU countries. Like many businesses, Meta uses Standard Contractual Clauses as a data transfer mechanism from the European Economic Area to the United States in the context of the services we provide to businesses - the WhatsApp Business App and the WhatsApp Business API.

We will ensure that our businesses and partners can continue to enjoy business solutions while keeping their data safe and secure.

Please view our WhatsApp Business API Status Page for Cloud API specific observability metrics.

Please view the API Status Page document for more details.

Availability is updated once a day.

There could be situations where certain user errors can be automatically counted incorrectly toward downtime. In these situations, we will override the downtime to uptime after detailed analysis within a week.

There may be issues that do not impact our global availability. In these cases, the WhatsApp Business API Status Page will have a status to reflect that there may be some disruptions that are not affecting global availability. Please submit a Direct Support ticket to investigate further.

There are the cases where downtimes in availability are not automatically tracked:

• Network issues causing requests to fail before they reach the Graph API layer (first layer).
• Network issues causing outbound webhooks not to reach business's webhook endpoint.

Any issues that surface before admission into our system after this point will appear as either error or missed success. Also issues encountered after the first attempt to emit the webhook will continue to be retried, until it is successfully delivered to the webhook endpoint.

The other cases that are reflected in the availability dashboard after manual detection are (not system error):

• Meta authentication issues like auth token (security libraries) are determined whether they are legitimate requests failing authentication or authorization.
• Validation that rejects legitimate requests.

In both cases WhatsApp will detect and account for those issues after the fact, near real time, but not real time.

We do not currently offer commercially available product service level agreements for uptime and/or latency.