sent-profile-provisioning

Executes the Sent Sender Profile lifecycle over the API — creating profiles with the right inheritance, sharing, billing, and WhatsApp options, driving profile completion and its callback, managing 10DLC campaigns per profile, and administering users and roles. Use when calling POST /v3/profiles, handling a completion callback or unclear profile status, choosing inherit or dedicated resources, wiring per-tenant onboarding, or inviting and role-managing users.

79starsUpdated 8/20/2026

API Development #messaging #multi-tenancy #provisioning #api-integration #whatsapp

Security Assessment

Safe(93/100)

Security Score93/100

About sent-profile-provisioning

Sent Profile Provisioning executes the Sent Sender Profile lifecycle over the API - creating profiles with the correct inheritance, sharing, billing, and WhatsApp options, driving profile completion and its callback, managing 10DLC campaigns per profile, and administering users and roles. It is the execution counterpart to profile architecture: once the tenancy boundary is decided (with the companion sender-profile-architect skill), this skill drives the actual REST calls that make a profile able to send.

It lays out an eight-step provisioning sequence: confirm an organization admin credential (profile-scoped keys cannot create profiles), decide inheritance and sharing flags before the call because they are awkward to unwind, create the profile (validating with sandbox first), attach or inherit WhatsApp via exactly one of three paths, register US SMS campaigns, complete the profile with a reachable webhook URL, reconcile status from the once-only callback or by polling, and invite users with least-privilege roles. The skill carefully distinguishes inheritance (pulling the organization's contacts, templates, brand, and campaigns inward, defaulting to true) from sharing (pushing this profile's resources outward), warning that silent inheritance can let one tenant read another's data. A lifecycle reference documents the full operation catalog, field rules, billing models, WhatsApp attachment paths, completion callback, status vocabulary, and error codes.

It targets engineers wiring per-tenant onboarding, calling POST /v3/profiles, handling completion callbacks or unclear status, choosing inherited vs. dedicated resources, and inviting or role-managing users. Its handling of sensitive data is explicitly safe: payment_details card fields are described as ephemeral, forwarded to the payment processor, and must never be logged, echoed, stored, or committed - a defensive posture rather than any exfiltration behavior.

FAQ

What credential is required to create a profile?

An organization API key whose owning email holds the admin role. Profile-scoped keys cannot create profiles, and a profile key sending x-profile-id receives a 403.

What is the difference between inheritance and sharing flags?

Inheritance pulls the organization's contacts, templates, brand, and campaigns inward (and defaults to true), while sharing pushes this profile's resources outward. They are independent directions; for tenant isolation you must set inherit_contacts and inherit_templates to false explicitly.

How is the completion callback handled?

The completion call needs a reachable webHookUrl and the callback (profileId, success, status, timestamp) is delivered once with no retry, so the receiver must be reachable beforehand, idempotent, and reconcilable by polling if the callback is missed.

How does it treat payment details?

payment_details card fields are ephemeral and forwarded to the payment processor; the skill instructs never to log, echo, store, or commit them - a defensive data-handling rule.