Record WhatsApp opt-in

Outcome

Record that the contact opted in to WhatsApp messages from this organization at their current phone, with where the opt-in came from (source, e.g. the form or call) and the evidence (what they agreed to and when). Appended to the consent evidence log and audited. Requires a phone (409 phone_required) and an active contact (409 state_conflict). WhatsApp steps send only approved templates to opted-in contacts that also pass suppression and caps.

Before you start

• Verify the intended environment, signed-in credential, authorized organization and the action permission workspace:write.
• Discover and select an authorized canonical Engage workspace. Pass resourceType=workspace and resourceId separately from action input.
• Review the exact effects and obtain approval before CLI --confirm or MCP confirm:true. A local capture does not authorize a live mutation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_engage.contacts.whatsapp_optin.record --json
topolo workspaces list topolo-engage --json

Set ENGAGE_WORKSPACE_ID to the identifier of the selected authorized workspace.

Input contract

Validate, plan and execute

Build payload.json from the current schema and discovered identifiers. The action description above defines its behavior, limits, side effects and declared errors.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions validate app_topolo_engage.contacts.whatsapp_optin.record --data @payload.json --json
topolo actions plan app_topolo_engage.contacts.whatsapp_optin.record --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

Review the plan and approve its exact effects before executing the unchanged request.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions call app_topolo_engage.contacts.whatsapp_optin.record --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

For MCP, use topolo_get_action, topolo_validate_action, topolo_plan_action and topolo_call_action. Pass resource context separately where required; confirm:true is required for mutations.

Captured successful requests and responses

Captured HTTP 200 · the runner on a WhatsApp template step > holds as whatsapp_not_permitted when Nexus refuses Engage, for a day, and surfaces it in ops holds

Action input

{
  "id": "contact_1",
  "source": "Webinar form",
  "evidence": "Ticked the WhatsApp box"
}

Actual local response

{
  "whatsapp": {
    "contactId": "contact_1",
    "phone": "+447700900123",
    "optIn": {
      "status": "opted_in",
      "source": "Webinar form",
      "evidence": "Ticked the WhatsApp box",
      "recordedAt": "2026-10-06T08:30:00.000Z",
      "recordedBy": "user_1"
    }
  }
}

Source test: the runner on a WhatsApp template step > holds as whatsapp_not_permitted when Nexus refuses Engage, for a day, and surfaces it in ops holds. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 200 · contact phone and WhatsApp opt-in > records and revokes an opt-in as consent evidence for the current phone

Action input

{
  "id": "contact_1",
  "source": "Webinar form",
  "evidence": "Ticked the box"
}

Actual local response

{
  "whatsapp": {
    "contactId": "contact_1",
    "phone": "+447700900123",
    "optIn": {
      "status": "opted_in",
      "source": "Webinar form",
      "evidence": "Ticked the box",
      "recordedAt": "2026-10-06T08:30:00.000Z",
      "recordedBy": "user_1"
    }
  }
}

Source test: contact phone and WhatsApp opt-in > records and revokes an opt-in as consent evidence for the current phone. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Effects and response meaning

• Record that the contact opted in to WhatsApp messages from this organization at their current phone, with where the opt-in came from (source, e.g. the form or call) and the evidence (what they agreed to and when). Appended to the consent evidence log and audited. Requires a phone (409 phone_required) and an active contact (409 state_conflict). WhatsApp steps send only approved templates to opted-in contacts that also pass suppression and caps.

Verify the outcome

• Check the response against the declared output schema and the requested operation. For mutations, use the action-specific read described in the action description before any dependent operation.

Recover

For an uncertain result, inspect current retained state with a read action before retrying. Do not replay a mutation unless its contract explicitly guarantees idempotency.

Refused requests

Captured HTTP 409 · contact phone and WhatsApp opt-in > records and revokes an opt-in as consent evidence for the current phone

Action input

{
  "id": "contact_1",
  "source": "Webinar form",
  "evidence": "Ticked the box"
}

Actual local response

{
  "error": {
    "code": "phone_required",
    "message": "Set the contact's phone before recording WhatsApp consent."
  }
}

Source test: contact phone and WhatsApp opt-in > records and revokes an opt-in as consent evidence for the current phone. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 403 · contact phone and WhatsApp opt-in > refuses readers, other organizations, unknown and archived contacts

Action input

{
  "id": "contact_1",
  "source": "Webinar form",
  "evidence": "Ticked the box"
}

Actual local response

{
  "error": {
    "code": "permission_denied",
    "message": "The credential lacks workspace:write.",
    "details": {
      "requiredPermission": "workspace:write"
    }
  }
}

Source test: contact phone and WhatsApp opt-in > refuses readers, other organizations, unknown and archived contacts. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Error recovery

• HTTP 409 phone_required: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.
• HTTP 403 permission_denied: Stop and inspect the current credential and selected resource. It needs workspace:write; do not broaden access or switch organization automatically.

Related actions

• List prospect contacts
• Create prospect contact
• Resolve prospect contact id
• Get prospect contact
• Update prospect contact
• Archive prospect contact
• Qualify contacts with AI
• Get contact qualification
• Get contact WhatsApp state
• Set contact phone
• Revoke WhatsApp opt-in
• Import contacts from TopoloCRM
• Export contact data
• Erase contact data

Evidence and limits

• /api/contacts/{id}/whatsapp-optin

• Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

• Widget/bootstrap use actual app handler but mocked worker runtime and app identity.

• No gateway execution, live permissions, external delivery or deployed proof.

These are local route captures with synthetic identity and simulated dependencies. They do not prove live authorization, gateway execution, production state, or external delivery.