Graph API v27.0: your WhatsApp bot already has an expiration date if it's still on v21 or v22

Meta released version 27.0 of Graph API and Marketing API on November 4, 2026. It brings new features, deprecations, and breaking changes. And even though the announcement is mostly about ads and pages, it matters to anyone running WhatsApp bots for a very specific reason: the WhatsApp Business platform is built on top of Graph API, so every POST to graph.facebook.com/vXX.0/<phone-number-id>/messages lives under the same version schedule. With v27.0, Meta also confirmed the retirement dates for v21.0 (January 21, 2027) and v22.0 (May 20, 2027). If your bot has one of those versions hardcoded, it already has an expiration date.

What changes for bot builders

For a WhatsApp bot, the announcement leaves four things to check.

1. Versions with retirement dates. According to Meta's blog, Graph API v21.0 retires on January 21, 2027 and v22.0 on May 20, 2027. The official version table fills in the rest of the picture: v20.0 already expired on September 24, 2026, v23.0 expires on October 8, 2027, and v24.0 on February 18, 2028. Meta's rule, according to its versioning guide, is that each version works for at least two years and stops being served two years after the next one comes out.

2. "Legacy" features banned as of now. Since November 4, new apps can't use six old Graph API features, and existing apps can't launch new use cases with them. This applies to all versions, not just v27.0. Apps that already use them can keep doing so on the older versions that are still active, but in v28.0 they stop working for everyone.

3. Disclosure of AI-generated content. Starting with v27.0, when editing a page post (POST /{post-id} and POST /{page-post-id}) you can send the optional boolean is_ai_generated: true adds the AI-generated content label, false removes it, and if you omit it, the existing value is kept. If your automation posts to Facebook in addition to replying on WhatsApp, this lets you fix the label without deleting the post.

4. A metric that gets switched off with no replacement. total_video_consumption_rate, from GET /{video-id}/video_insights, stops returning data in early November 2026 on all versions. Meta explains that its inputs (3-second viewers and video reach) were already deprecated in v26.0, and says there is no direct replacement. If your reporting dashboard queries it, remove it before your parser blows up.

Graph API v27.0 timeline: launch on November 4, 2026, v21.0 retirement on January 21, 2027, Marketing API changes on all versions around February 2027, v22.0 retirement on May 20, 2027, and the end of legacy features in v28.0, with a checklist for bots

The six legacy features going away

Meta lists them in the announcement with examples:

Feature	Parameter	What it does
Multi-ID requests	`ids`	Fetches several entities in a single call, for example `?ids=[id1,id2]`
Date format	`date_format`	Changes how dates come back in the response
HTTP method override	`method`	Turns a request into another method, for example `?method=delete`
Field aliases	`.as(...)`	Renames fields in the response
JSONP callbacks	`callback`	Wraps the response in a JavaScript function
Async batches	`asyncbatch`	Sends requests to be processed in the background

Meta clarifies that multi-ID and date format were already deprecated as of v26.0. Its instruction is straightforward: stop using them before moving to v28.0. There's no date for v28.0 yet.

In a bot that only sends and receives messages, you most likely don't use any of these. Where they do show up is in legacy code: old admin panels that call Graph from the browser with JSONP, libraries that use ?method=delete because their HTTP client didn't know how to send DELETE, or reporting scripts that gather several objects with ids. It's worth running a grep before someone bumps the version without checking.

The Marketing API stuff, in case your bot lives off ads

Many WhatsApp bots get traffic from click-to-WhatsApp ads or from lead forms, so these changes can land on you too:

More devices by default. Starting with v27.0, new sales ad sets that target specific devices or operating systems have the option to reach more people on other devices turned on if you don't send targeting.targeting_automation.individual_setting.device. To keep your targeting as is, set it to 0. It reaches all versions about 90 days later (Meta estimates February 2027, no confirmed date).
Automatic product showcase. Meta can turn this format on when it has "high confidence" that a set of products in your catalog matches the ad. You turn it off with product_extensions.enroll_status set to OPT_OUT.
Goodbye /{catalog-id}/batch. In v27.0 it no longer works and you have to migrate to /{catalog-id}/items_batch, following Meta's guide. In v26.0 and earlier it's still alive for as long as those versions exist. If your bot sells from a catalog and you sync it through the API, this is the most urgent item in the announcement.
Lookalikes without location. lookalike_spec no longer accepts country or location_spec. Meta says they never had any effect, because delivery comes from the ad sets' location. Existing audiences stay the same.
Forms with OTP. The Meta Business SDK v27 adds phone_otp_verification_type to request phone verification by code in lead forms: required, optional, or disabled. The optional setting is only available to eligible accounts.

My take: the risk is the silent upgrade

What stands out to me most isn't in the v27.0 announcement but in the versioning guide: when a version stops being served, Meta doesn't answer with an error. It redirects the call to the oldest version still available. Your bot doesn't go down on January 21: it starts running on a different version without anyone deciding it. And if it gets pushed from v21.0 to v22.0, the same thing happens again in May.

The other blind spot is unversioned calls. The same guide says a request without vXX.0 in the path uses the version configured in the app dashboard (Settings > Advanced). If nobody has touched it in years, it may be as old as the bot.

And one detail I find funny: the cURL example on the official page that introduces the WhatsApp platform still uses v17.0, which according to Meta's table expired on September 12, 2025. If you copied that example when you started your bot and never changed it, you've already been running on a different version for over a year without knowing it.

What to do this week

Look for the hardcoded version in code, environment variables, and config: grep -rn "graph.facebook.com/v" .
Check the libraries and SDKs you use. Many have the version hardcoded inside and don't always announce it.
Check the version configured in the dashboard of each Meta app, especially if you have unversioned calls.
Upgrade to a supported version, preferably a recent one, and test on a test number: text sending, templates, media, and status webhooks.
Search for ids, date_format, method=, .as(, callback=, and asyncbatch in your Graph integrations.
If you sync a catalog, migrate to /items_batch before upgrading to v27.0.
Mark January 21 and May 20, 2027 on the team calendar.

An honest note: I didn't test v27.0 with a real bot. Everything above comes from Meta's announcement and its official versioning documentation. The WhatsApp-specific changelog wasn't loading when I wrote this, so if v27.0 brings changes specific to the Cloud API, they aren't reflected here.