holon-run/whatsapp-openapi-skill

WhatsApp Cloud API Skill

Use this skill to run WhatsApp Business Platform Cloud API operations through uxc + OpenAPI.

Reuse the uxc skill for shared execution, auth, and error-handling guidance.

Prerequisites

• uxc is installed and available in PATH.
• Network access to https://graph.facebook.com/v25.0.
• Access to the curated OpenAPI schema URL:
  • https://raw.githubusercontent.com/holon-run/uxc/main/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json
• A Meta app and WhatsApp Business account with Cloud API access.
• A valid system-user or app access token that can call the target WhatsApp assets.
• At least one phone_number_id, and for phone number listing, the related waba_id.

Scope

This skill covers a compact Cloud API request/response surface:

• phone number listing
• phone number metadata reads
• business profile reads and updates
• outbound message sends

This skill does not cover:

• inbound webhook receiver runtime
• template lifecycle management
• embedded signup or broader business onboarding flows
• media upload/download lifecycle
• the full WhatsApp Business Platform surface

API Version

This skill is pinned to Graph API v25.0, based on current Meta developer examples at implementation time. Keep the base URL versioned:

• https://graph.facebook.com/v25.0

If Meta deprecates this version later, the wrapper should be revised in a follow-up update rather than assuming unversioned compatibility.

Authentication

WhatsApp Cloud API uses Authorization: Bearer <access_token>.

Configure one bearer credential and bind it to the versioned Graph API base path:

uxc auth credential set whatsapp-cloud \
  --auth-type bearer \
  --secret-env WHATSAPP_CLOUD_ACCESS_TOKEN

uxc auth binding add \
  --id whatsapp-cloud \
  --host graph.facebook.com \
  --path-prefix /v25.0 \
  --scheme https \
  --credential whatsapp-cloud \
  --priority 100

Validate the active mapping when auth looks wrong:

uxc auth binding match https://graph.facebook.com/v25.0

Core Workflow

1. Use the fixed link command by default:

   • command -v whatsapp-openapi-cli
   • If missing, create it: uxc link whatsapp-openapi-cli https://graph.facebook.com/v25.0 --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json
   • whatsapp-openapi-cli -h

2. Inspect operation schema first:

   • whatsapp-openapi-cli get:/{waba_id}/phone_numbers -h
   • whatsapp-openapi-cli get:/{phone_number_id}/whatsapp_business_profile -h
   • whatsapp-openapi-cli post:/{phone_number_id}/messages -h

3. Prefer read/setup validation before writes:

   • whatsapp-openapi-cli get:/{waba_id}/phone_numbers waba_id=123456789012345
   • whatsapp-openapi-cli get:/{phone_number_id} phone_number_id=123456789012345
   • whatsapp-openapi-cli get:/{phone_number_id}/whatsapp_business_profile phone_number_id=123456789012345

4. Execute with key/value or positional JSON:

   • key/value: whatsapp-openapi-cli get:/{phone_number_id} phone_number_id=123456789012345 fields=display_phone_number,verified_name
   • positional JSON: whatsapp-openapi-cli post:/{phone_number_id}/messages '{"phone_number_id":"123456789012345","messaging_product":"whatsapp","to":"15551234567","type":"text","text":{"body":"Hello from UXC"}}'

Operation Groups

Asset Discovery

• get:/{waba_id}/phone_numbers
• get:/{phone_number_id}

Business Profile

• get:/{phone_number_id}/whatsapp_business_profile
• post:/{phone_number_id}/whatsapp_business_profile

Messaging

• post:/{phone_number_id}/messages

Guardrails

• Keep automation on the JSON output envelope; do not use --text.
• Parse stable fields first: ok, kind, protocol, data, error.
• post:/{phone_number_id}/messages is a high-risk write. Require explicit user confirmation before execution.
• Message delivery is still constrained by WhatsApp conversation rules, template approval rules, recipient opt-in expectations, and account policy state. Auth success does not imply a send is allowed.
• This v1 skill does not manage media uploads. If you send image or document content, use already hosted URLs or existing asset references as allowed by the platform.
• Webhook subscription and verification are intentionally documented only. This skill does not configure a receiver runtime.
• Business profile update fields are partial. Only send the fields you intend to change.
• whatsapp-openapi-cli <operation> ... is equivalent to uxc https://graph.facebook.com/v25.0 --schema-url <whatsapp_openapi_schema> <operation> ....

References

• Usage patterns: references/usage-patterns.md
• Curated OpenAPI schema: references/whatsapp-cloud.openapi.json
• WhatsApp Cloud API docs: https://developers.facebook.com/docs/whatsapp/cloud-api
• Graph API access tokens: https://developers.facebook.com/docs/graph-api/overview/access-tokens/