Use client-managed OAuth 2.1/PKCE. Never request or expose a token, API key, authorization header, client ID, or secret. Before a mutation, surface the active organization and Sender Profile from the connection context; if either is unavailable, use
to inspect the authorized scope. Reauthorize in the client to change scope.
Mask phone numbers where practical. Return only the contact fields needed for the task, and do not repeat contact data after it has been reviewed. Number presence or messaging history does not establish consent.
Read-only calls do not require mutation confirmation.
Never call
without a preview and explicit confirmation immediately before the call. Treat every retry as a new mutation with a fresh preview and new explicit confirmation.
Never call
without fetching the target and obtaining explicit confirmation immediately before the call. Every retry requires another fetch, a fresh preview, and new explicit confirmation.
Report counts and stable identifiers, not full contact records. If a create or delete outcome is ambiguous, do not assume success and do not retry automatically. Re-read the exact target when possible, explain the uncertainty, and require a new confirmation before any further mutation.