360dialog WhatsApp API + MCP vs Wati

360dialog WhatsApp API + MCP 8

No changelog or release notes found. The Usernames and BSUID page dates Meta's rollout of business-scoped user IDs by month (in webhooks March to April 2026, Meta's Contact Book April 2026, sending from early July 2026), and the Messages reference, which follows Meta's Cloud API payloads, carries the recipient field for it. These are Meta's Cloud API changes carried through 360dialog's proxy, not a dated change 360dialog made to its own API, so they don't set recency (0, as on 1 October). No dated API change since 6 August. The marketing message price cap ("Open Beta since 1 October 2026") is a beta and doesn't count, and Direct Send's move to general availability carries no date (0). Closed service with a support response-time page and no public changelog (8 of 15). No official SDKs (0). No packages to assess (0). 0+0+8+0+0 = 8.

Wati 62

The API reference, authentication and error pages were updated on 3 November 2026 under documentation version 2.6, read as the last published API change (30). No changelog; the MCP registry entry moved to 1.1.0 on 9 October and the repository changed on 15 and 20 October, which count for half (10 of 20). Closed service with a public roadmap and support by plan; GitHub issue replies weren't sampled (6 of 15). io.github.wati-io/wati-mcp is in the official MCP registry under a verified GitHub namespace, with no official SDKs (12 of 15). The repository holds setup docs for a hosted server, with a registry publish workflow (4 of 10). 30 + 10 + 6 + 12 + 4 = 62.

360dialog WhatsApp API + MCP 75

Status page at status.360dialog.com on Instatus, with 10 360dialog components, 3 Meta ones and subscriptions (20). In the 90 days from 6 August the page posts one incident, "Some disruptions to Messaging" from 16 October 17:12 to 17 October 07:11 UTC (13 hours 59 minutes), with customers reporting authorisation errors on sends after Meta changed messaging permissions on one of 360dialog's applications, worked around the same day. Read as partial by its label and scope (minor, 20); as a major outage the line would be 10. August, September and November show no notices. Throughput is published, up to 80 messages a second on standard plans and 1,000 on the Higher Throughput tier (15). The error list maps the endpoint rate-limit error to request throttling or exponential backoff, with no Retry-After and no idempotency key for sends, so backoff guidance alone (10, this run's settled value for that reading; 8 on 1 October). No SLA. The support page sets first-response targets and nothing commits to uptime (0, per the 2 October check). The Messaging API is generally available (10). 20+20+15+10+0+10 = 75.

Wati 55

Read with the hosted lines. status.wati.io is a Site24x7 StatusIQ page with components for the API, webhooks and inbox on each regional host (20). Its incident history is drawn by script and wasn't readable by our reader, so the record is scored as unreadable (5). Request limits are published only for legacy V1 operations, by plan; V3 limits are account-specific and unpublished (8 of 15). The docs say to honour Retry-After when present, use bounded backoff and reconcile unknown writes before resending, with no idempotency keys (10 of 15). The pricing page names a basic or standard SLA by plan, with no SLA document or uptime figure (2 of 10). The V3 API is the documented default (10). 20 + 5 + 8 + 10 + 2 + 10 = 55.

360dialog WhatsApp API + MCP 35

No x402, MPP or L402 (0). Channel plans are public at €49, €99 or €249 a number a month, and Meta's per-message fees pass through at cost on Meta's rate card, plus 7 per cent on marketing sent through /messages (15 of 20). A sandbox key arrives by WhatsApp after sending START to a number, with 200 test messages to one recipient and no card (20). Production needs a Hub signup and Meta business verification, and even the sandbox needs a person's WhatsApp (0).

Wati 20

No x402, MPP or L402 (0). Public plan prices only, plus Meta's fees by reference (10 of 20). A 7-day free trial whose card rule isn't stated (10 of 20). A person signs up and connects a WhatsApp Business account (0). 0 + 10 + 10 + 0 = 20.

360dialog WhatsApp API + MCP 70

The Markdown reference pages embed an OpenAPI 3.1.0 document titled Messaging API, version 1.52.4 on 4 November (1.50.7 on 2 October), with a D360-API-KEY header scheme and response schemas. We read the Templates section in full. We found no standalone download, so an agent has to collect it page by page (20 of 25). llms.txt listing 305 pages, a .md version of every page and an ?ask= query parameter that answers questions (10). API reference pages describe endpoints and parameters, mostly following Meta's Cloud API payloads (12 of 20). Typed query parameters and response schemas in the spec, with enums not checked (10 of 15). More than 60 error codes, each with a suggested fix (13 of 15). The spec carries a version number and flags the legacy /v1/configs template endpoints as deprecated, but we found no changelog (5 of 15).

Wati 79

No standalone spec file was found, but every reference page embeds the OpenAPI 3.0.4 contract for its operation, with the documentation version 2.6 (20 of 25). llms.txt and Markdown pages (10). Descriptions say when to use each route, when not to, which roles are refused and what a 200 can hide (19 of 20). Typed parameters with ranges such as batch sizes of 1 to 100 and 1 to 10,000 (12 of 15). Examples in five languages and a recovery guide; error bodies vary by endpoint and some are plain text (12 of 15). Versioned documentation and a public roadmap, but no changelog (6 of 15). 20 + 10 + 19 + 12 + 12 + 6 = 79.

360dialog WhatsApp API + MCP 53

Responses follow Meta's Cloud API shapes. GET /message_templates takes a fields list for field selection and a limit (18 of 25). Cursor pagination with after and before and next and previous links on the template list. We checked that list only (15 of 20). Error codes with resolution steps an agent can act on (15 of 20). No idempotency key found, and the MCP docs don't mention tool annotations (0 of 20). No official SDKs. A send needs only the D360-API-KEY header and a Cloud API message body (5 of 15).

Wati 48

The MCP catalogue lists 73 WATI tools plus Astra groups, some loaded on demand through list_skills and activate_skill (10 of 25). Page and page size with filters on lists, and bounded search (17 of 20). Error handling is documented per status, but bodies can be JSON, plain text or empty, so an agent can't rely on one shape (10 of 20). No idempotency keys; tag add and remove are idempotent, and the docs say to reconcile rather than retry sends (5 of 20). No official SDK; runnable examples in five languages, and region-specific hosts add setup (6 of 15). 10 + 17 + 10 + 5 + 6 = 48.

360dialog WhatsApp API + MCP 35

The Messaging API takes one key per phone number in the D360-API-KEY header. Generating a new key revokes the old one at once, so rotation has no overlap (20). The hosted MCP uses OAuth with scopes chosen at consent, and a denied scope hides its tools (for example write:channels hides set_display_name). The messaging key has no read-only variant (10 of 20). Inbound WhatsApp messages are untrusted text. Webhooks support optional Basic auth only, with no signature, and we found no injection guidance (0 of 15). No customer audit log found. The docs say the Cloud API keeps messages for at most 30 days (5 of 15). The ISO 27001 reference in the docs is Meta's, for the Cloud API. No security.txt (per the 30 September check), bug bounty or 360dialog certification found, and the Legal Information page lists none (0 of 20).

Wati 40

REST tokens carry per-endpoint read and write scopes, an expiry and revocation, and the docs forbid tokens in URLs; the MCP server's OAuth metadata lists a single all scope (25 of 30). Read-only REST tokens are possible through scopes; the MCP server has no read-only mode and relies on the client to confirm writes (10 of 20). Inbound WhatsApp and Instagram text and comments reach the agent, and no prompt-injection guidance was found (2 of 15). No operator request log found in the docs (3 of 15). The trust centre answered 403, security.txt answers 404, and no certification or disclosure policy could be read (0 of 20). 25 + 10 + 2 + 3 + 0 = 40.