WhatsApp API Error 368: Recover a Restricted Account

Error 368 is the code that stops a business, not a request. Meta documents it as "Temporarily blocked for policies violations" with an HTTP status of 403 and a recommended action of reviewing the Policy Enforcement documentation to understand and resolve the violations (Meta for Developers, WhatsApp error codes reference, retrieved 2026-08-17). Independent BSP documentation states it more bluntly: the WhatsApp Business Account associated with the app has been restricted or disabled for violating a platform policy

The word "temporarily" in Meta's description does real work, and it is where most of the panic comes from. A restriction is usually reversible. But the clock on reversal is measured in days, not minutes, and what you do in the first hour materially changes the outcome.

This guide covers what triggers 368, the enforcement ladder it sits on, exactly what to do in the first hour, how the appeal actually works, and how to prevent a second restriction, which is far harder to lift than a first. For the wider failure surface, our WhatsApp Business API error codes reference indexes the rest.

What Triggers Error 368

A 368 is rarely a surprise to your data, even when it surprises your team. It is the end of an escalation, and the signals were visible earlier.

The underlying causes cluster into four groups.

Messaging people who did not meaningfully opt in. This is the dominant cause. Purchased lists, contacts scraped from other channels, consent collected for email and reused for WhatsApp, and opt-ins so buried that recipients do not remember granting them all produce the same outcome: recipients block the business or report it as spam. Our WhatsApp opt-in guide covers what Meta actually requires.

Content that breaks the Commerce or Business Policy. Prohibited categories, misleading claims, or content that does not match the template's approved category.

Systematic template category misuse. Sending marketing content through templates approved as utility. This has its own dedicated enforcement path in error 131064, and persistent misuse escalates.

Sustained low quality rating. Blocks and spam reports accumulating until the account crosses an enforcement threshold. See WhatsApp quality rating for how the rating is built.

Note what is not on this list: sending volume by itself. High volume to an engaged, properly opted-in audience does not trigger 368. Volume only accelerates whatever your consent quality already is.

The Enforcement Ladder

Meta's enforcement is progressive rather than binary, which is why a 368 is best understood as a position on a ladder.

One important 2026 correction, because most published guidance on this is out of date. The "Flagged" phone number status has been removed, and messaging limits no longer automatically decrease when a quality rating drops (respond.io, Turn.io, both retrieved 2026-08-17). Meta's current messaging-limits documentation likewise no longer describes an automatic downgrade mechanism. Practically, this means a falling quality rating gives you less early warning than it used to: instead of a visible limit reduction, the first hard consequence may be the restriction itself. Monitoring quality proactively matters more now, not less.

The First Hour: What to Do

Order matters here. Steps two and three are frequently done in the wrong sequence, which destroys the evidence you need for the appeal.

1. Stop all outbound sending immediately. Pause campaigns, disable automated sends, and hold queued messages durably. Continued attempts against a 403 accomplish nothing and demonstrate exactly the disregard for enforcement you are about to tell Meta you do not have.

2. Capture the current state before anything changes. Screenshot WhatsApp Manager: account status, quality rating per number, template statuses, and any policy notification. Export your recent send logs. Restrictions change what the interface shows, and you will want the before picture.

3. Read the actual notification. Meta usually posts a policy violation notice in WhatsApp Manager or Business Manager naming the violated policy. Generic advice about "policy violations" is useless; the specific policy cited determines your entire remediation. Check the account-level notifications, not just the messaging dashboard.

4. Query the Health Status API. Meta's error reference notes that the Health Status API can provide additional insight into account-level problems. It gives you a machine-readable view of what is blocked and why, which is often more specific than the dashboard.

5. Identify the trigger in your own data. Look at the 7 to 14 days before the restriction. Which campaign went out? Did a new list get imported? Did block or spam-report rates spike on a particular template? You need a specific, honest answer, because the appeal turns on it.

How the Appeal Works

An appeal is a business submission, not a support ticket, and it is assessed on whether Meta believes your future behaviour will differ from your past behaviour.

Submit through Business Manager's support or appeals flow, or through your provider if you are on a BSP, which is generally faster because the BSP has an escalation path and has seen the pattern before.

What a successful appeal contains:

• A specific acknowledgement of what happened. Name the campaign, the list, or the template. Vagueness reads as either ignorance or evasion.
• The root cause, honestly stated. "We imported a list where consent had been collected for email only" is a stronger submission than "we may have inadvertently contacted some users."
• Concrete remediation already completed. Not planned. Completed. The list has been suppressed, the template withdrawn, the double opt-in shipped.
• The control that prevents recurrence. A consent field enforced at collection, a frequency cap, a pre-send review step, a monitoring alert on quality rating.
• Evidence. Screenshots of the new opt-in flow, the suppression list, the changed template.

What weakens an appeal: disputing the violation while asking for reinstatement, blaming a vendor or an employee, submitting repeatedly within hours, or promising improvements without showing the change.

Expect days rather than hours. During the wait, do not create a new WABA to route around the restriction. Meta associates business assets, and evasion converts a recoverable restriction into a durable problem across your business portfolio.

Preventing a Second Restriction

A first 368 is usually survivable. A second on the same violation is where businesses lose the channel, so the recovery window is the moment to fix the practice rather than the symptom.

Fix consent at the source. Record where, when, and how each contact opted in specifically to WhatsApp, and be able to produce that record per contact. If you cannot, that segment is a liability regardless of how it performs.

Monitor quality rating as an operational metric with an owner. Given that limits no longer decrease automatically as an early warning, quality rating needs a named owner, a dashboard, and an alert threshold. Green is not a target to admire; a drop to medium is an incident.

Enforce frequency caps yourself. Meta's own per-user marketing limits exist for a reason and are enforced through error 131049. Sending until Meta stops you is a strategy that ends at 368.

Categorise templates honestly. Marketing content in a utility template is one of the clearest paths onto the enforcement ladder. See template categories and what happens when Meta reclassifies a template.

Give the account an accountable owner. 368 is a compliance and RevOps problem, not an engineering problem, but it usually lands on an engineer because it arrives as an API error. Someone in the business needs to own WABA health, review campaigns before they go out, and hold authority to stop a send. Our guide to WhatsApp API compliance covers the controls worth putting in place.

Frequently Asked Questions

Why is my WhatsApp Business Account restricted?

Meta restricts a WABA for platform policy violations. In practice the common triggers are messaging recipients who did not meaningfully opt in, which generates blocks and spam reports, content that breaks the Commerce or Business Policy, and systematic misuse of template categories. A restriction is normally the end of an escalation rather than a first response, so the signals were usually visible in your quality rating beforehand.

How long does a WhatsApp account restriction last?

Meta describes error 368 as a temporary block but does not publish a fixed duration, because the outcome depends on the violation and your appeal rather than on a timer. Plan in days. What shortens it is a specific, evidenced appeal showing the root cause fixed; what lengthens it is a vague submission, repeated resubmissions, or continued send attempts.

How do I appeal a WhatsApp Business Account restriction?

Submit through Business Manager's appeals flow or via your BSP. Include a specific acknowledgement of what happened, the honest root cause, remediation you have already completed rather than planned, the control that prevents recurrence, and evidence such as screenshots of a corrected opt-in flow. Meta is assessing whether your future behaviour will differ, so completed changes matter more than commitments.

Can I create a new WhatsApp Business Account instead of appealing?

No. Meta associates business assets across a portfolio, and creating a new WABA to route around enforcement is treated as evasion. It converts a recoverable restriction into a durable problem that can affect other assets in your business portfolio. Appeal the existing account.

Does error 368 affect all my phone numbers?

Yes. Error 368 is an account-level enforcement returning HTTP 403, so every number on the restricted WhatsApp Business Account stops sending. This is what separates it from number-level codes such as 131048, which restricts a single phone number's throughput.

Will my quality rating warn me before a restriction?

Less reliably than it used to. Independent BSP documentation now states that the Flagged status has been removed and that messaging limits no longer automatically decrease when quality drops, which removes a visible intermediate warning that many teams relied on. Monitor quality rating directly with an alert on any drop from high, rather than waiting for a limit change you may no longer receive.

Treat the Restriction as the Deadline It Is

Error 368 is the only error in this cluster where your response in the first hour changes the outcome. Stopping the sender, capturing state before it changes, and reading the specific policy notice puts you in a position to file an appeal that succeeds. Retrying, guessing at the cause, or spinning up a replacement account puts you in a much worse one.

The uncomfortable part is that a restriction is almost always earned by list quality rather than by bad luck, and the recovery window is the only time a business reliably has the authority to fix that. Teams that use it to fix consent collection rarely see a second 368. Teams that use it to get sending again as fast as possible usually do.

Need a partner who watches account health before it becomes a 403? Helo.ai is a Meta Partner and monitors quality rating, template status, and WABA health for enterprise programmes, with campaign review built into the send path. Talk to an expert.

Next: error 131031 if your account is locked rather than restricted, or error 131048 for the number-level spam rate limit that often precedes a 368.