<area>:read) or read and write (<area>:write, which includes reading it). * is every area, now and the ones added later.
A permission is a ceiling, never a grant of its own. The token acts as the person who made it: it can never do more than their role allows in the console, whatever its permissions say. A token with members:write made by a member who may not add people still cannot add people (403 forbidden, with a human_action that asks the owner by name); a token without members:write cannot, even for the owner (403 insufficient_permission, with the permission it lacks in needs and a human_action that links the person to the token’s page to allow it).
Reads use the area’s read permission, everything else its write. GET /v1/me and GET /v1/operations need none: any working token may ask who it is and what it may call.
The areas
The console lists the same areas under Choose per area when you create a token.
clients and integration_apps do something only for a partner account, and only for a person the console lets into those places.
Choosing
- Everything you can do (
*): an agent that sets up and runs the account with you. Its consequential calls still wait for you: with Ask me first (the default) you approve each one in the console (Approvals), and through an assistant’s sign-in to the MCP server its chat shows you a preview and waits for your yes. - Read only (every area’s
read): a report, a monitor, an agent that answers questions about the account. - Choose per area: a script with one job, such as
whatsapp:writefor templates, oremail:writefor sending domains.
404 not_found, wherever the request names it. Such a token reads the account’s members with their access to those applications only, and may not change the account’s members (403 token_narrowed). A partner’s client applications are the clients area’s, and the token’s choice of applications does not narrow them.
Reading a permission from the API
GET /v1/me answers the token’s permissions as stored (["*"], or a list such as ["whatsapp:write", "email:read"]; a read is left out when its area’s write is there). Every operation in GET /v1/operations and in the reference names the permission it needs: permission in the search, x-permission in the OpenAPI document. A search lists every matching operation, with allowed (whether this token may call it) and, when it may not, needs, the permission to add. The MCP server’s search_tawked_api marks them the same way.