Organizations, roles and keys

An organization owns everything in Wabi: WhatsApp accounts and numbers, conversations, contacts, templates, agents, webhooks, API keys, the plan and its usage. You get one when you first sign in. A person can belong to several organizations and switches between them from the dashboard sidebar.

Roles

Roles go viewer < member < admin < owner:

An organization always keeps at least one owner. Nobody can give a role above their own, and admins only change roles below admin. A call above your role answers 403 forbidden with required_role. Each op's minimum role is in the API reference.

Inviting people

Owners and admins invite from Settings → Members with an email address, a role and optional teams. The invitation link works once and expires after 7 days; the invitee joins by signing in with the invited address. Inviting, removing members and changing roles are done by a person in the dashboard, never by an API key; agents can read the list with list_members.

Teams

Teams group members to share WhatsApp accounts and agents with, and to route conversations to. Members create them in Settings → Teams (or with create_team) and become their maintainer; maintainers, admins and owners add and remove people (set_team_member, remove_team_member).

Sharing WhatsApp accounts and agents

Every WhatsApp account and AI agent has a visibility (set_resource_visibility):

• org (the default): every member sees it at their role.
• restricted: only its creator, owners and admins, and the teams and people it is shared with. Everyone else gets 404 not_found.

share_resource gives a team or a person read (see it and its conversations), write (send from the account, edit the agent) or admin (also its settings and who it is shared with). A viewer never gets past read. list_resource_access shows who has what.

npx @meterapp/wabi set_resource_visibility --json '{"resource_type":"whatsapp_account","resource_id":"…","visibility":"restricted"}'npx @meterapp/wabi share_resource --json '{"resource_type":"whatsapp_account","resource_id":"…","team":"support","access":"write"}'

API keys and scopes

• An API key belongs to the organization and acts with the role of the person who created it (an owner's key acts as admin). It keeps working if that person leaves; admins see and revoke every key, members their own. The full key is shown once.
• Narrow a key with scopes. Without scopes it may call everything its role allows. With scopes, each op needs one of:
  • <group>:read for the read ops of a group, such as messages:read or templates:read;
  • <group>:write for its writes (and its reads), <group>:* for both;
  • *:read for every read op;
  • billing:purchase to change the plan on the saved card. Nothing else implies it: a key that may buy must say so.
• A scoped key cannot create a key with wider scopes than its own. list_api_keys returns every scope a key can have.
• npx @meterapp/wabi login and OAuth connectors ask which organization to use when you belong to several. With a session or OAuth token, x-wabi-org: <slug> picks one per request.

Audit log

Membership, role, team, invitation, API key, billing, settings and sharing changes are recorded with who made them (a person, an API key or an OAuth client). Owners and admins read it in Settings → Audit or with list_audit_log. Day-to-day actions (sends, replies, edits) are in the activity log (list_activity).