WhatsApp API Account Restricted: Causes, Error 368, Appeals

On Monday your templates send. On Tuesday every API call comes back with error 368, the WhatsApp Manager banner says your account has been restricted, and the order updates customers rely on have stopped. A WhatsApp API account restricted notice is one of the most stressful things to hit a team that runs operations on WhatsApp, mostly because nobody explains what happens next.

Restriction is a stage in a published enforcement process, not a random event. Meta tells you which policy you broke, how long the block lasts and whether you can appeal, through WhatsApp Manager, email and a webhook.

This guide covers how the enforcement ladder works, how to read the signals in code, the usual causes and how to appeal.

What "restricted" means on the platform

A restriction is a time-limited block on some or all sending, applied to a WhatsApp Business Account (Meta's docs now call it a Messaging account) that has repeatedly broken the WhatsApp Business Messaging Policy, the Commerce Policy or the Business Terms. Meta's policy enforcement guide describes the ladder:

1. Warning. A notice explaining which policy you violated.
2. 1 or 3 day block on sending marketing, utility and authentication templates, and on adding phone numbers.
3. 5, 7 or 30 day block on sending any messages, and on adding phone numbers.
4. Account lock. An indefinite block on all sending that can only be removed through an appeal.
5. Permanent disable from the platform, if the business doesn't change after multiple warnings and blocks.

For severe harm (child exploitation, scams, terrorism, sale of illegal drugs) Meta skips the ladder and offboards immediately. It also says it may limit or offboard a business that receives excessive negative feedback from users.

Don't confuse restriction with neighbouring problems. A paused template is a quality issue, covered in how the WhatsApp quality rating works. A cap on how many people you can reach is a messaging limit. And a ban on a number used in the regular WhatsApp Business app follows a different process, covered in how to unban a WhatsApp number.

Reading the signals in code

Most teams find out from an angry customer. You can find out from your own systems first.

Error codes. These are the ones that point at enforcement or look like it:

The account_update webhook. Subscribe to it. Three events matter here:

• ACCOUNT_VIOLATION with violation_info.violation_type (for example ADULT or SCAM).
• ACCOUNT_RESTRICTION with a restriction_info array of restriction_type and expiration (a Unix timestamp).
• DISABLED_UPDATE with ban_info.waba_ban_state set to DISABLE, SCHEDULE_FOR_DISABLE or REINSTATE.

Restriction types tell you exactly what still works. RESTRICTED_BIZ_INITIATED_MESSAGING stops you starting conversations, RESTRICTED_CUSTOMER_INITIATED_MESSAGING stops replies to customers, and RESTRICTED_ADD_PHONE_NUMBER_ACTION blocks new numbers. There are also utility-template and calling variants. Route them to the people who own those flows:

from datetime import datetime, timezone

def handle_account_update(value: dict) -> None:
    event = value.get("event")
    if event == "ACCOUNT_VIOLATION":
        page_oncall(f"Policy violation: {value['violation_info']['violation_type']}")
    elif event == "ACCOUNT_RESTRICTION":
        for r in value.get("restriction_info", []):
            until = datetime.fromtimestamp(r["expiration"], tz=timezone.utc)
            if r["restriction_type"] == "RESTRICTED_BIZ_INITIATED_MESSAGING":
                pause_campaigns(until)          # templates to new conversations
            elif r["restriction_type"] == "RESTRICTED_CUSTOMER_INITIATED_MESSAGING":
                switch_support_to_fallback(until)  # email or SMS for replies
            page_oncall(f"{r['restriction_type']} until {until.isoformat()}")
    elif event == "DISABLED_UPDATE":
        page_oncall(f"Account ban state: {value['ban_info']['waba_ban_state']}")

The health status check. Before any big send, ask Meta whether it will work. Request health_status on a phone number, Messaging account or template. Use the current Graph API version from Meta's changelog in place of v23.0:

curl "https://graph.facebook.com/v23.0/PHONE_NUMBER_ID?fields=health_status" \
  -H "Authorization: Bearer $WHATSAPP_TOKEN"

The response gives an overall can_send_message of AVAILABLE, LIMITED or BLOCKED, plus a breakdown for the phone number, Messaging account, business portfolio and app. Blocked entities include an errors array with a description and a possible solution. Meta's error reference points to it for more insight into account locks.

Why accounts get restricted

The causes Meta names, and the ones we see most:

• Spam and negative feedback. Messaging people who didn't opt in, or messaging them too often, produces blocks and reports. Meta calls out sending spam as a repeat violation. Clean consent is the fix; see the WhatsApp Business API opt-in policy.
• Template misclassification. Submitting promotional content as a utility template to pay the lower rate. Meta lists this explicitly, and error 131064 is its sharp end. Our guide to WhatsApp template categories shows where the lines are.
• Restricted verticals. Meta's violations list includes adult products, alcohol, tobacco, drugs, gambling, weapons, dating, unsafe supplements, certain healthcare products, digital subscriptions, real or fake currency, scams and third-party infringements. Its MISLEADING category lists examples such as multilevel marketing, payday loans and debt collection. Some entries mix allowed and disallowed examples, so read your category's row before assuming you're covered or excluded.
• Political use. The Business Messaging Policy prohibits political parties, politicians, candidates and campaigns from using the platform.
• Unexpected automation. The policy lets you automate replies inside the 24-hour window only if people have a prompt, clear escalation path to a human or another support channel. AI-specific rules are in our guide to the WhatsApp AI chatbot policy.

How to appeal

If you believe you complied, request a review in Business Support Home. Meta's steps:

1. Sign in to Meta Business Suite, open All tools, then Business Support Home, then Account Overview.
2. Select the affected Messaging account.
3. Pick the violation and click Request Review.
4. Add supporting details and submit. The case moves to the In Review tab.
5. Wait for the decision in Business Manager. Meta says it typically takes 24 to 48 hours, and the violation ends up Unchanged or Reversed.

A reversed violation returns the account to its previous status. Two caveats from Meta: not every spam violation can be appealed, and sometimes you have to wait out the restriction period. You can also acknowledge a violation instead of appealing it.

A useful appeal is specific. Show how you collected consent (the form wording and where it lived), what the template was for, the volumes involved and what you've changed since. "We are a genuine business" without evidence rarely moves anyone.

Prevention checklist

• Subscribe to account_update and alert a human on every ACCOUNT_VIOLATION, not just restrictions.
• Keep admin details in Business Manager current; Meta emails violation notices to all admins.
• Run a health_status check as the first step of every campaign job.
• Categorise templates honestly, and expect Meta to recategorise them if you don't.
• Store opt-in proof per contact, with the wording they agreed to.
• Watch template and number quality daily, and halt campaigns on RED.
• Read the Business and Commerce policies for your vertical before you launch, not after the warning.
• Keep a fallback channel (email or SMS) for anything customers can't do without, like delivery updates or one-time codes.

For how enforcement fits into the bigger picture, see the complete guide to the WhatsApp API.

Where Tenashi fits

Tenashi is not a way around Meta's enforcement, and we'd tell anyone restricted for spam the same thing: moving the same campaign to another tool or number usually gets that number banned too. WhatsApp's rules apply to every account, on the API or not.

Where Tenashi helps is the day-to-day conversation work that rarely gets anyone restricted: answering customers, following up on quotes and coordinating in groups, from the number you already use. It links that number by QR scan (it isn't Meta's official API and isn't a Meta partner), gives your team one shared inbox with a CRM under every chat, and paces anything sent through its API: one message every 4 to 12 seconds, 50 new chats a day per number, and identical text to 5 chats within 10 minutes is paused. That reduces ban risk; it doesn't guarantee against it. Plans start from $18/mo.

See every feature · Get started

FAQ

What does WhatsApp error 368 mean?

Error 368 means the WhatsApp Business Account linked to your app has been restricted or disabled for violating a platform policy. Check Business Support Home in Meta Business Suite for the specific violation, the restriction and its duration, then fix the cause. If you believe you complied, request a review from the same page.

How long does a WhatsApp API restriction last?

It depends on how often you've violated policy. Meta's ladder runs from 1 or 3 day blocks on template messages, to 5, 7 or 30 day blocks on all messages, to an indefinite account lock that only an appeal removes. The account_update webhook includes an expiration timestamp for each active restriction.

How long does a WhatsApp Business Platform appeal take?

Meta says decisions on violation appeals typically arrive within 24 to 48 hours, delivered through Business Manager. The violation is either left unchanged or reversed, and a reversal returns the account to its previous status. Some spam violations can't be appealed, so you may have to wait for the restriction to expire.

Can I still reply to customers while restricted?

Sometimes. The restriction_type in the account_update webhook says what's blocked. RESTRICTED_BIZ_INITIATED_MESSAGING stops you starting conversations but not replies, while RESTRICTED_CUSTOMER_INITIATED_MESSAGING blocks replies too. Meta's 5, 7 and 30 day blocks stop all messages. A health_status request shows whether your number can send right now.

Should I move to a new number or provider after a restriction?

Fixing the cause matters more than the account. Enforcement follows behaviour, and repeating it elsewhere risks the same result, while Meta can permanently disable businesses that don't change after warnings. Change your consent, targeting and template categories first, appeal if you complied, and only then reconsider how your stack is set up.

---

Restrictions are recoverable when you catch them early and change what caused them. If most of your WhatsApp is conversation rather than campaigns, see how Tenashi works on the number you already have.