Every existing guide to the WhatsApp Business API is, understandably, not written for research. The top-ranking pages cover customer support bots, marketing automations, and order-status pings. They explain templates in terms of promotional blasts, not survey invitations, and they never touch the questions that actually block a study: which template category a participation request falls under, how the 24-hour messaging window reshapes a seven-day diary study, or whether an ethics board will accept Cloud API data handling at all. This guide answers those questions, term by term.

Quick answer: setting up the WhatsApp Business API for research means creating a WhatsApp Business Account (WABA) inside a Meta Business Portfolio, choosing Cloud or On-Premises hosting, completing Meta Business Verification, getting message templates approved, and building your study logic around the 24-hour messaging window. Most research teams do this through a Business Solution Provider or a purpose-built research platform rather than building the webhook and template-management layer themselves.

Why researchers need a different setup guide

Researchers ask different questions than the marketers most API guides are written for. Which template category does a study invitation fall under. How does a 24-hour messaging window affect a week-long diary study. Can an ethics board approve Cloud API data handling, or does the study need on-premises hosting with regional data residency. None of that is covered by a guide built around cart-abandonment reminders.

The evidence for WhatsApp as a research channel holds up under scrutiny. A field experiment run by Stanford's Immigration Policy Lab, testing WhatsApp against IVR and SMS surveys among Venezuelan migrants in Colombia and the United States, found WhatsApp reaching a 55% response rate, 27 percentage points above SMS at 28%, with a 92% completion rate once someone started, against 82% for SMS. WhatsApp messages also carry open rates around 98%, compared with the 15 to 25% many teams see from an embedded email survey, falling further once a click-through to an external link is required. Our own 2026 response-rate benchmarks by channel break this down in more depth.

Capturing those gains, though, means understanding the infrastructure underneath. Here is every concept a research team actually needs.

Core infrastructure terms

The WhatsApp Business API is a programmatic interface that lets an organisation send and receive WhatsApp messages at scale through software rather than manual typing. Meta introduced it in August 2018 for medium and large businesses, and its capabilities map cleanly onto research operations: automated question delivery, response collection, media capture, and integration with data pipelines. It differs fundamentally from the free WhatsApp Business App, which is built for one person running a small business from their phone. The API has no interface of its own; it connects to external systems, survey platforms, custom-built pipelines, that handle what gets sent and when. In practice, that means programmatically sending questions one at a time, collecting voice notes and images as responses, triggering follow-ups based on answers, and exporting structured data, all inside a chat interface participants already know. Our guide to designing chat-friendly questions covers what to do with that flexibility.

A WhatsApp Business Account (WABA) is the container holding your phone numbers, templates, and messaging settings inside Meta's infrastructure, effectively your organisation's identity on the platform. At least one WABA is required to use the API; within it you register phone numbers, submit templates for approval, and configure messaging limits. Research organisations running studies across multiple countries can manage several numbers under a single WABA.

Meta offers two hosting options, and the choice matters more to researchers than to most commercial users because ethics boards care where participant data lives. The Cloud API is hosted on Meta's own servers: setup takes minutes rather than weeks, and Meta's infrastructure carries SOC 2 and ISO 27001 certifications. The tradeoff is that message data passes through Meta's systems, which typically means Standard Contractual Clauses for any cross-border transfer under GDPR. The On-Premises API runs on servers you or your hosting provider control, giving direct authority over data residency, which makes it easier to satisfy a board requiring EU or South African data to stay in-region, at the cost of more technical complexity and ongoing maintenance.

Most research teams resolve this by using a Business Solution Provider or research platform that handles the decision for them, offering configurable data residency without requiring anyone to manage server infrastructure directly. Yazi, for example, gives clients a choice of EU or South African hosting.

Every business asset, WABA, ad accounts, pages, user permissions, lives inside the Meta Business Portfolio (formerly Business Manager), the admin hub you need before accessing the API and the place where Meta Business Verification begins. If your university or agency already runs Facebook ads or a Page, a Portfolio likely already exists; otherwise, creating one is free but requires an admin-level Facebook account.

A Business Solution Provider (BSP) is a company Meta has authorised to provide API access, handling webhook servers, message routing, template management, and policy compliance so you don't have to build that plumbing yourself. Going direct without a BSP only makes sense with a dedicated engineering team on staff. For research organisations, the real question is general-purpose BSP versus a platform built specifically for research that bundles BSP functionality with survey logic, analysis, and compliance features in one place.

A webhook pushes data from one system to another in real time, and in this context, delivers incoming participant messages to your server the moment they arrive. When someone answers a question or sends a voice note, the API fires a webhook to your configured endpoint, which then stores the response and triggers the next step. Configuring webhooks correctly is one of the more error-prone parts of a do-it-yourself build; a research platform handles it automatically.

Setup and verification terms

Meta Business Verification confirms your organisation is a real, legally registered entity, and it's required to unlock higher messaging limits and to apply for a verified badge. It requires legal documentation, registration certificates, utility bills, tax records, and Meta's reviewer needs to see the same legal business name across your website, your submitted documents, and your Portfolio. You can send messages before verification, but you're capped at 250 unique participants in a rolling 24-hour period, workable for a small pilot, not a full-scale study. One common blocker: Meta requires a live business website with published terms and a privacy policy on your own domain, which academic labs sometimes lack. Get those pages published before applying.

Phone number registration requires a dedicated number, mobile or landline, able to receive an SMS or voice call for verification, and it becomes your project's identity in participants' chats. A constraint that catches first-time users: a number cannot run on both the Business App and the API at once, registering it for the API disconnects it from the app, so an organisation already using the app for other purposes needs a separate number for API-based research. Meta's newer Coexistence feature, rolled out through 2025 and now live in South Africa, Nigeria, the EU, and the UK, removes that constraint for eligible accounts by letting the same number run the app and the Cloud API together, so a coordinator can send ad-hoc messages from the app while automated survey delivery runs through the API on the same number. Check current eligibility with your BSP, since rollout still varies by market.

Your display name, what participants see in the chat header, must be approved by Meta and needs to match or clearly derive from your verified business name. This matters for research credibility specifically: participants engage more readily with a recognisable institution name than a generic label, so if a lab operates under a university, use a name that makes the affiliation obvious.

The verified badge next to a business's display name, historically a green tick and now rolled out as a blue checkmark under Meta's unified verification branding, signals that Meta has confirmed the business's identity. This is a plausible trust signal for response rates: IPA's own account of running WhatsApp surveys in Colombia notes that a badge showing the organisation's name, rather than an unfamiliar number, appeared to help participants recognise and trust the source on recontact. Earning it requires completed Business Verification, a WABA at least 30 days old, and a track record of policy-compliant messaging.

Messaging rules that shape research design

A message template is a pre-approved format required to initiate any conversation; the first message to a participant can never be free-form text. Templates can include variables, a participant's name, a study title, and text, images, documents, or interactive buttons. A survey invitation, a diary prompt, or an interview-scheduling message will all be templates. The practical challenge is that templates cannot read as promotional: "Complete our exciting survey!" risks rejection, while "You're invited to participate in [Study Name]. Reply YES to begin" reads as a utility message and clears review far more reliably.

Meta sorts templates into four categories, and the category sets both the approval bar and the per-message cost. Marketing covers promotional content and is the most expensive; research invitations generally shouldn't sit here. Utility covers transactional or informational messages tied to an existing relationship, participation confirmations, status updates, appointment reminders, and it's the natural fit for most research templates. Authentication covers one-time codes, rarely relevant outside identity verification. Service messages are free-form replies sent inside the 24-hour window and carry no charge from Meta at all, which is where the actual survey questions and conversational exchange happen. Getting the category right isn't just a compliance detail, it's a cost lever: a 500-person study where every invitation gets classified as marketing instead of utility can cost meaningfully more than the same study correctly categorised.

After submission, WhatsApp typically reviews a template within minutes, occasionally up to 24 hours. Rejections for research templates usually trace to language that sounds promotional, missing opt-out instructions, or a vague purpose. The fix is specificity: say plainly what the message is for, include a way to decline, and drop exclamation marks and sales language. Each WABA can hold up to 250 templates for an unverified Portfolio, rising to as many as 6,000 once the Portfolio is verified and at least one number has an approved display name, a ceiling most single-country studies never approach but multi-language, multi-country programmes can.

Everything after the first message runs inside a 24-hour clock. Design the study around that clock, not around it as an afterthought.

The 24-hour messaging window is the single constraint that most shapes research design. When a participant messages you, it opens a 24-hour window for free-form replies at no per-message cost; once it closes, re-initiating contact requires a paid template. For a 20-question survey delivered one message at a time, a participant who stops responding after question five still has 24 hours from their last message during which the next prompt is free; after that, pulling them back costs a template send. For a seven-day diary study, keeping the window open across each day is the whole game: a well-timed automated reminder inside the window costs nothing, while a lapsed day requires a paid re-initiation. For budgeting, high-dropout or slow-responding studies cost more simply because they trigger more paid re-initiations, which is a strong argument for shorter question sets and prompt reminder logic.

A session message is any free-form message, text, image, video, document, interactive element, sent inside that 24-hour window: no template needed, no per-message charge. This is where the actual study happens, questions, probes, diary prompts, multimedia requests, provided the participant keeps responding within 24-hour intervals. A business-initiated conversation is any template sent to start or restart contact outside the window, and it's the action that triggers billing: every invitation, every reminder to a lapsed participant, and every new diary-day prompt sent after the window has closed counts as one.

Compliance and ethics terms

Setup carries obligations from two directions: WhatsApp's own policies, and data protection law like GDPR and POPIA, with a third layer, institutional ethics board approval, for academic teams. WhatsApp requires documented, affirmative consent from every recipient before any business message goes out, regardless of who initiated the conversation. For researchers this lines up naturally with informed consent, which ethics boards already require; the work is documenting the opt-in in a way that satisfies both WhatsApp and the board. Via the API, consent capture is fully automatable: a participant taps a button or replies "YES," and that interaction is logged with a timestamp, producing a more auditable record than most paper-based processes.

Multiple independent privacy reviews find that the personal WhatsApp app and the free Business App fall short of GDPR, largely because both automatically upload a user's full contact list to Meta's servers, including contacts who never consented. Only the Business API is built for GDPR-compliant use, resting on a valid legal basis (typically explicit consent for research), a Data Processing Agreement with Meta and your BSP, an up-to-date privacy notice, and a documented process for data-subject requests within a month. South Africa's POPIA runs on close to parallel principles and, for South African participants, often points toward South African data residency specifically. Our full GDPR and POPIA compliance guide walks through both frameworks; this isn't legal advice, and a specific study should still get sign-off from qualified counsel.

A Data Processing Agreement (DPA) is the contract binding your organisation, your BSP, and Meta to specific terms on what data gets collected, how it's used, retention periods, and security obligations, and it needs to exist before any research data is collected. Most BSPs and research platforms keep a standard DPA ready to sign; a do-it-yourself build means negotiating this separately with Meta and every other vendor in the data chain. Data residency, the physical location where data is actually stored, is the practical hinge for a lot of ethics-board conversations: Cloud API data passes through Meta's global infrastructure, while on-premises setups keep data on servers you control. If a board specifically requires EU-only or South Africa-only storage, confirm that capability with your BSP or platform before committing to an approach.

On encryption: personal WhatsApp is end-to-end encrypted, meaning only sender and recipient can read a message. The Business API works differently, Meta (Cloud API) or your BSP (on-premises) manages encryption keys on the business's behalf, so messages are encrypted in transit and at rest but accessible to the systems that process them, which is what makes automated survey logic and analysis possible. Worth explaining plainly to a board: the model differs from personal WhatsApp by design and meets enterprise security standards rather than personal-chat privacy expectations.

Pricing and cost terms

Meta switched from per-conversation to per-message billing on 1 July 2025, the most significant pricing change since conversation-based billing was introduced in 2022. Every template message is now billed individually at a rate set by recipient country and template category, which makes cost modelling considerably more predictable: you can estimate spend from the number of template messages you expect to send, invitations, re-engagement prompts, reminders, rather than guessing at conversation counts.

Rates vary by country and category: in the US, marketing messages run roughly $0.025 to $0.14 per delivered message depending on the specific rate card, utility messages considerably less, and authentication messages in a similar band to utility. Service messages inside the 24-hour window are free. On top of Meta's base rate, a BSP typically adds its own markup, commonly $0.003 to $0.010 per message, so the all-in cost matters more than Meta's headline figure when comparing providers; ask for the combined per-message price, not just Meta's base rate, since some platforms bundle BSP fees into a flat monthly plan instead.

The free service window is the foundation of cost-efficient WhatsApp research: once a participant messages you, your replies for the next 24 hours cost nothing. A well-designed study keeps people responding regularly, so most of the actual research conversation happens for free, and the paid template messages are really just the entry points, the initial invitation and any re-engagement after a lapse.

The most useful cost benchmark for researchers comes directly from Stanford's Immigration Policy Lab, which piloted its WhatsApp survey method with Mercy Corps and the Lutheran Immigration and Refugee Service and found a 19-question survey could cost as little as $0.32 USD per completed response on average. Costs shift by country, rates in African and South Asian markets typically run lower than in North America or Europe, but set against CATI phone interviews, in-person fieldwork, or web-panel incentives, WhatsApp survey costs are consistently on the low end.

Research-specific concepts

These terms don't show up in standard API guides because they're specific to data collection rather than customer messaging. A WhatsApp-native survey runs entirely inside the chat interface, no external link, no separate browser tab, which removes a real source of friction: no app to download, no account to create, no unfamiliar page to navigate. A conversational survey flow delivers one question at a time rather than a single long page, mimicking a natural exchange and supporting branching logic, different follow-ups depending on a previous answer, that feels like a conversation rather than a form.

Multimedia capture, the API's ability to receive voice notes, images, and video, is transformative for qualitative work: instead of describing a product in text, a participant photographs it; instead of typing a long answer, they send a voice note. This supports ethnographic-style collection at scale, shelf photos, walkthrough videos, audio diaries in a participant's own language, that a text-only form could never capture. The software layer managing all of this, sending the next question, applying skip logic, storing structured data, is the automated survey bot. Building one from scratch is where most do-it-yourself projects stall; Immigration Policy Lab's own published approach required API access, a Twilio account, Google Sheets, command-line skills, and statistical software, a combination most research teams don't have in-house.

A diary study on WhatsApp uses scheduled prompts across multiple days to capture experiences, behaviours, or reactions in context, and the 24-hour window is the defining technical constraint: each day's prompt either falls inside the window the previous response opened, or it needs a new paid template. Well-timed reminders that keep the window open are what make this affordable at scale. An AI-moderated interview goes further than a fixed-script survey bot, reading each response and generating a contextually relevant follow-up probe the way a skilled human moderator would, producing interview-depth data at survey-like scale; explore how this works on Yazi's AI interviewer.

Panel recruitment via WhatsApp can run through click-to-WhatsApp ads, QR codes in physical locations, referral links, or direct outreach to an existing contact list via template messages. Across much of Africa, where WhatsApp reaches 90% or more of internet users in leading markets like Nigeria, Kenya, and South Africa, this channel reaches populations web panels and email routinely miss, though that figure describes share of connected users, not the whole population, since overall mobile internet usage still lags well behind. Launching at scale means bulk template messaging, sending approved templates to a full participant list, typically from a CSV upload, in one go, with capacity set by your messaging tier.

The build-versus-buy decision

Quick reference: what to start with

If skipping the technical build entirely appeals more than any of the above, that's the platform path in one sentence: purpose-built tools handle the API layer so a research team can focus on study design. See how Yazi's setup works as one example.

Frequently asked questions