WhatsApp error 200-299: API Permission

Codes in the 200 to 299 range are the Graph API's family of permission errors. Meta documents them as a block rather than individually because they share one cause: the token's permissions do not cover what you asked for, either because they were never granted or because they have since been removed. On the Cloud API, the code you will actually see most often is 200, frequently with a message such as "Permissions error" or a note that the user is not an admin on the WABA.

Where code 10 usually points at a missing scope on the token, the 200-series most often reflects a missing role: the System User behind the token has no assignment, or an insufficient one, on the specific WhatsApp Business Account or phone number. The token can carry both WhatsApp scopes and still hit 200 if the underlying user is not allowed to act on that asset.

The token itself is valid and not expired; this is about what it is allowed to touch.

Keep asset assignments for production System Users under change control and audit them whenever Business Manager roles are edited. A monitoring check that lists the WABA via the production token once an hour will catch a revoked assignment quickly. For multi-client setups, rely on Embedded Signup so permissions are granted in a consistent, repeatable way. See code 10 for the missing-scope variant and 190 for dead tokens; the authorization triage sequence is summarized in the error-code guide.