360dialog WhatsApp API + MCP vs Prelude

360dialog WhatsApp API + MCP 8

No changelog or release notes found. The Usernames and BSUID page dates Meta's rollout of business-scoped user IDs by month (in webhooks March to April 2026, Meta's Contact Book April 2026, sending from early July 2026), and the Messages reference, which follows Meta's Cloud API payloads, carries the recipient field for it. These are Meta's Cloud API changes carried through 360dialog's proxy, not a dated change 360dialog made to its own API, so they don't set recency (0, as on 1 October). No dated API change since 6 August. The marketing message price cap ("Open Beta since 1 October 2026") is a beta and doesn't count, and Direct Send's move to general availability carries no date (0). Closed service with a support response-time page and no public changelog (8 of 15). No official SDKs (0). No packages to assess (0). 0+0+8+0+0 = 8.

Prelude 83

@prelude.so/sdk 0.16.0 published to npm on 16 October 2026, 21 days ago, carrying API updates (30). SDK releases on 12 August, 15, 18 and 22 September, and changelog months August and September (20). Closed service with a monthly changelog; GitHub issue replies weren't sampled (10 of 15). Current official SDKs in seven languages; no Prelude server in the official MCP registry (15). The SDK repository runs CI and publish workflows (8 of 10). 30 + 20 + 10 + 15 + 8 = 83.

360dialog WhatsApp API + MCP 53

Responses follow Meta's Cloud API shapes. GET /message_templates takes a fields list for field selection and a limit (18 of 25). Cursor pagination with after and before and next and previous links on the template list. We checked that list only (15 of 20). Error codes with resolution steps an agent can act on (15 of 20). No idempotency key found, and the MCP docs don't mention tool annotations (0 of 20). No official SDKs. A send needs only the D360-API-KEY header and a Cloud API message body (5 of 15).

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

360dialog WhatsApp API + MCP 35

The Messaging API takes one key per phone number in the D360-API-KEY header. Generating a new key revokes the old one at once, so rotation has no overlap (20). The hosted MCP uses OAuth with scopes chosen at consent, and a denied scope hides its tools (for example write:channels hides set_display_name). The messaging key has no read-only variant (10 of 20). Inbound WhatsApp messages are untrusted text. Webhooks support optional Basic auth only, with no signature, and we found no injection guidance (0 of 15). No customer audit log found. The docs say the Cloud API keeps messages for at most 30 days (5 of 15). The ISO 27001 reference in the docs is Meta's, for the Cloud API. No security.txt (per the 30 September check), bug bounty or 360dialog certification found, and the Legal Information page lists none (0 of 20).

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

360dialog WhatsApp API + MCP 70

The Markdown reference pages embed an OpenAPI 3.1.0 document titled Messaging API, version 1.52.4 on 4 November (1.50.7 on 2 October), with a D360-API-KEY header scheme and response schemas. We read the Templates section in full. We found no standalone download, so an agent has to collect it page by page (20 of 25). llms.txt listing 305 pages, a .md version of every page and an ?ask= query parameter that answers questions (10). API reference pages describe endpoints and parameters, mostly following Meta's Cloud API payloads (12 of 20). Typed query parameters and response schemas in the spec, with enums not checked (10 of 15). More than 60 error codes, each with a suggested fix (13 of 15). The spec carries a version number and flags the legacy /v1/configs template endpoints as deprecated, but we found no changelog (5 of 15).

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.

360dialog WhatsApp API + MCP 75

Status page at status.360dialog.com on Instatus, with 10 360dialog components, 3 Meta ones and subscriptions (20). In the 90 days from 6 August the page posts one incident, "Some disruptions to Messaging" from 16 October 17:12 to 17 October 07:11 UTC (13 hours 59 minutes), with customers reporting authorisation errors on sends after Meta changed messaging permissions on one of 360dialog's applications, worked around the same day. Read as partial by its label and scope (minor, 20); as a major outage the line would be 10. August, September and November show no notices. Throughput is published, up to 80 messages a second on standard plans and 1,000 on the Higher Throughput tier (15). The error list maps the endpoint rate-limit error to request throttling or exponential backoff, with no Retry-After and no idempotency key for sends, so backoff guidance alone (10, this run's settled value for that reading; 8 on 1 October). No SLA. The support page sets first-response targets and nothing commits to uptime (0, per the 2 October check). The Messaging API is generally available (10). 20+20+15+10+0+10 = 75.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

360dialog WhatsApp API + MCP 49

Closed service with terms of use in the Hub (15). The privacy policy covers the website, names 360dialog GmbH in Grünwald and was updated on 10 September 2026. The Legal Information page links two English DPA files we didn't open, and the docs say the Cloud API keeps messages for at most 30 days, but we found no sub-processor list for the service (15 of 30). No deprecation policy. The OpenAPI flags deprecated template endpoints without dates (5 of 20). Website trackers are listed with locations, but service sub-processors and hosting locations aren't (0 of 20).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.