Design WhatsApp sends around recipient permission and outcome truth

Choose the sender product before composing content

An official business sender and an App-linked account are not interchangeable. They may differ in onboarding, recipient rules, templates, conversation context, history, groups, and provider risk. DewEngine has no approved send adapter. Scraping, provider-limit evasion, anti-detection, and simulated human behavior are excluded. The implementation must first select a permitted product and document its exact message categories, account eligibility, and customer use case.

A routable number does not prove contact is appropriate

The calling product should maintain recipient identity, purpose, opt-in or relationship evidence where required, prior responses, suppression, and the customer decision authorizing each send. DewEngine can validate that an eligibility reference exists and enforce transport safeguards, but it cannot infer permission from imported contact data. Wrong-recipient reports, opt-out, human pause, and provider feedback must stop pending actions before another worker attempts dispatch.

Validate message category and media explicitly

Text, approved template references where applicable, reply context, files, images, and other supported content need typed inputs and size limits. The adapter should not rewrite a rejected free-form message into another category or choose a template without customer intent. Unsupported product behavior returns a capability error. Media handling needs encrypted temporary custody, safe fetch rules, content-type validation, and deletion after its documented purpose completes.

Commit idempotency before contacting WhatsApp

The API stores the workspace, account, recipient, content reference, purpose, and idempotency key transactionally before queueing work. A worker records each provider attempt and advances accepted, acknowledged, failed, suppressed, or indeterminate state. A network timeout after dispatch must not trigger a blind resend. Safe reconciliation through an authorized provider read or deterministic reference is preferable; otherwise an operator decides how to resolve uncertainty.

Report only the recipient state the provider proves

A native message identifier can prove provider acceptance or creation, not necessarily delivery or reading. Later callbacks may add supported recipient state and can arrive late or more than once. Canonical events deduplicate by account-scoped provider evidence and preserve occurrence time. Documentation should state which observations are available for the selected product and never convert callback silence into a successful delivery claim.

Exercise consent, policy, ambiguity, and shutdown

Release requires approved sender onboarding, recipient-purpose controls, suppression, message-category enforcement, every advertised content fixture, provider feedback, quotas, ambiguous outcome reconciliation, duplicate events, account restriction, reconnect, export, retention, revocation, deletion, and a fast kill switch. Tests use consented recipients and eligible accounts. Public examples and SDK calls appear only after that evidence, with the correct WhatsApp product named throughout.

• Recheck recipient suppression after leasing and immediately before dispatch
• Keep message bodies outside command metadata, metrics, and billing ledgers