{"id":1690,"date":"2026-09-07T08:34:15","date_gmt":"2026-09-07T08:34:15","guid":{"rendered":"https:\/\/360dialog.com\/blog\/?p=1690"},"modified":"2026-09-07T13:11:49","modified_gmt":"2026-09-07T13:11:49","slug":"bsp-integration-meta-business-agent-whatsapp","status":"publish","type":"post","link":"https:\/\/360dialog.com\/blog\/bsp-integration-meta-business-agent-whatsapp\/","title":{"rendered":"What Happens to Your BSP Integration When Meta Business Agent Is Turned On"},"content":{"rendered":"\n

When Meta Business Agent is enabled on a WhatsApp number managed through a Business Solution Provider (BSP), the partner app stops being the primary responder: Consumer messages arrive on the standby webhook field while the agent holds control, and the app regains control by sending a message or, as the configured escalation partner, by calling Thread Control with the take action.<\/strong>[1] Three webhook fields carry the traffic, two Terms of Service gate every API call, and Meta bills the business directly at $2.00 per 1 million tokens. The mechanism is documented on Meta’s developer pages and can be tested on allowlisted numbers before a real consumer reaches the agent.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Key Takeaways<\/h2>\n\n\n\n
    \n
  1. Meta Business Agent needs three webhook field subscriptions (messages, standby, and messaging_handovers), and consumer messages move to standby while the agent holds control.<\/li>\n\n\n\n
  2. Your app takes control by sending any message and keeps it until it calls Thread Control with the release action; in Meta’s words, “Stopping message sends does not release control.”<\/li>\n\n\n\n
  3. Two Terms of Service gate every API call: the client’s in WhatsApp Manager and the BSP’s in the Facebook Developer Portal.<\/li>\n\n\n\n
  4. Solution Partners and Tech Providers authenticate with a Business Integration System User (BISU) token holding both required permissions, plus the X-API-Version: 2.0.0 header.<\/li>\n\n\n\n
  5. An agent set to ai_audience ALLOWLISTED_ONLY can be turned on without a payment method, so testing with allowlisted consumers comes before billing.<\/li>\n<\/ol>\n\n\n\n

    <\/p>\n\n\n\n

    What Changes in Your Webhook Setup When Meta Business Agent Is Active?<\/h2>\n\n\n\n

    Meta Business Agent requires three webhook field subscriptions: messages, standby, and messaging_handovers, all set in the Developer Portal. Which field carries a consumer message depends on who holds control: standby while the agent holds it, messages while your app holds it. A messaging_handovers event fires whenever control changes hands, and standby is the default for new conversations once the agent is enabled.[4]<\/p>\n\n\n\n

    The standby payload contains one of three objects: standby.messages for the consumer’s inbound message, standby.message_echoes for each message the agent sends, and standby.statuses for the sent, delivered, and read receipts on those messages.[3] Inbound content uses the same payload structure as a standard incoming message webhook, and your own outbound messages are never echoed back to you.<\/p>\n\n\n\n

    Our complete Meta Business Agent guide<\/a> summarizes this routing model. For a BSP-built integration, the code change is to branch the handler on the field name, store standby context for continuity when your app becomes the active handler, and deduplicate on the message id.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    How Does Thread Control Work Between Meta Business Agent and Your App?<\/h2>\n\n\n\n

    Thread Control is the Cloud API endpoint that moves control of a conversation between Meta Business Agent and an app. Release hands the conversation back to Meta Business Agent as the automatic responder. Pass transfers control to the escalation partner configured for the phone number, or to the agent when control_pass.target_role is “ai_agent”. Both require the caller to hold control. Take acquires control from the current owner and is restricted to the configured escalation partner; other apps receive an error and take control by sending a message.<\/p>\n\n\n\n

    Meta’s Get Started page (Updated August 25, 2026) documents POST https:\/\/graph.facebook.com\/v21.0\/<\/a>\/thread_control with X-API-Version: 2.0.0 and a body of messaging_product “whatsapp”, the action, and the consumer in the to field. The Thread Control (Cloud API) reference (Updated September 4, 2026) documents the same three actions at https:\/\/api.facebook.com\/business\/whatsapp\/phone_numbers\/{phone_number_id}\/thread_control<\/a> with X-API-Version 1.0.0, so test release first against your own environment.[2]<\/p>\n\n\n\n

    Turning on Meta Business Agent pauses nothing on your side, as your app moves to the standby role, and sending any message from it immediately transfers primary control back to your app, which Meta names as the most common cause of agents that go silent in production. In Meta’s words, “Your app retains control until you explicitly release it. Stopping message sends does not release control.” An auto-reply that fires on a standby message therefore silences the agent until your app calls release.<\/p>\n\n\n\n

    When control transfers, the app that lost it receives a control_taken webhook on messaging_handovers with previous_owner_app_id, new_owner_app_id, new_owner_business_id, and the metadata string from the call; it is the only messaging_handovers payload documented on the Meta Business Agent developer pages. Meta’s pages do not yet describe how the escalation partner is configured or whether a BSP app can hold the role.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Which Terms of Service Must Be Accepted Before API Calls Work?<\/h2>\n\n\n\n

    Two Terms of Service gate every Meta Business Agent API call on a BSP-managed number: The client accepts the Meta Business Agent Terms of Service in WhatsApp Manager, and the Solution Partner or Tech Provider accepts the Tech Provider Terms of Service in the Facebook Developer Portal. Until both are in place Meta rejects calls with 403 Forbidden and a Terms of Service error.<\/p>\n\n\n\n

    The client-side tab appears in WhatsApp Manager only when at least one phone number in the WhatsApp Account (formerly WhatsApp Business Account, or WABA) is eligible; the eligibility checklist<\/a> covers those conditions, which include Cloud API numbers managed through a Solution Partner or Embedded Signup.[12]<\/p>\n\n\n\n

    The partner side requires Tech Provider status: a Meta app with the WhatsApp use case, business verification, App Review with two demonstration videos, and advanced access to the whatsapp_business_messaging and whatsapp_business_management permissions.[5] 360Dialog, an Official Meta Solution Partner<\/a>, runs the WhatsApp Business API infrastructure and Partner Platform that ISVs and resellers integrate against; on a number it manages, the Tech Provider acceptance is the partner-side step, and the business’s own step is the acceptance in WhatsApp Manager.<\/strong><\/p>\n\n\n\n

    <\/p>\n\n\n\n

    What Happens to BISU Tokens and System User Permissions?<\/h2>\n\n\n\n

    Solution Partners and Tech Providers authenticate Meta Business Agent Platform API calls on behalf of client WABAs with a Business Integration System User (BISU) token, while direct integrators use a system user token for their own WABA. Both token types require whatsapp_business_messaging and whatsapp_business_management. A BISU token lets one platform act for multiple client WABAs under a single credential and comes from Embedded Signup with Facebook Login for Businesses.[6] A token missing either permission returns 401, per Meta’s Quickstart.[11]<\/p>\n\n\n\n

    Every Platform API request also needs the X-API-Version: 2.0.0 header; without it requests default to 1.0.0, where the Skills endpoint is unavailable. A direct integration’s system user must hold the Admin role and have the WABA assigned with “View and manage phone numbers” enabled.<\/p>\n\n\n\n

    Ready to run Meta Business Agent on your own WhatsApp Business API number? Get API access<\/a>.<\/strong><\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Do Agent Replies Appear in Your BSP Dashboard or Inbox?<\/h2>\n\n\n\n

    Whether agent replies appear in your BSP dashboard or inbox depends on whether the BSP has wired the standby webhook field into that product. Meta delivers every agent reply to your app as an echo on standby.message_echoes, containing the exact request body passed to POST \/{phone-number-id}\/messages, with delivery and read receipts on standby.statuses. Meta documents no BSP’s inbox behavior, so ask your provider and test on an allowlisted number.<\/p>\n\n\n\n

    Human handoff on the agent’s side is governed by two Agent Settings fields: handoff.enabled controls whether the agent releases thread control after sending a handoff message, and handoff.message_selection picks DEFAULT, AGENT, or CUSTOM as the source of that message.[8] Meta’s documentation does not specify what triggers a handoff; the Agent Test endpoint’s response carries a handoff_reason field for observing it.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Which Messages Are Billed by Meta and Which by Your BSP?<\/h2>\n\n\n\n

    Meta bills the business directly for every Meta Business Agent message, including businesses that access the WhatsApp Business Platform through a Solution Provider, at one global rate of $2.00 per 1 million tokens; a typical message consumes 20,000 to 25,000 tokens, roughly 4 to 5 US cents, as one per-token charge covering agent processing and delivery.[7] The 72-hour free entry point window and the 24-hour customer service window do not exempt agent messages. A non-template message is charged either as an agent message or as a service message, never both, so a human reply after a handoff is a service message: free until October 1, 2026, then charged per message.<\/p>\n\n\n\n

    Meta will not deliver agent messages for a business without a payment method on its Business Agent account: a Meta credit line invoiced monthly or, from September 8, 2026, a Visa or Mastercard credit or debit card. Credit lines, cards, currencies, and invoices are covered in who bills you for Meta Business Agent messages<\/a>.<\/strong><\/p>\n\n\n\n

    <\/p>\n\n\n\n

    What Should You Test Before Activating Meta Business Agent?<\/h2>\n\n\n\n

    You can test a live number with agent restricted to allowlisted consumers; under the default ai_audience of EVERYONE the agent answers every consumer. Meta’s documented order is to add each test consumer with POST \/{entity_id}\/agent_config\/allowlist (one consumer_phone_number per call, E.164 format), set ai_audience to ALLOWLISTED_ONLY with PUT \/{entity_id}\/agent_config\/settings, read it back with GET, and only then set rollout.enabled to true.[9] An agent turned on with ai_audience set to ALLOWLISTED_ONLY does not require a payment method, so a BSP customer can test end to end before setting up billing; turning it on for EVERYONE, or expanding to EVERYONE later, requires one and returns a 400 until it is attached.[10]<\/p>\n\n\n\n

    Before the switch, run these checks:<\/p>\n\n\n\n