Review: checking scopes and rejection reasons

Last updated: 11 November 2026 · 7 min read

Steps

1. 1

   Before you submit

   Fill in the app settings: name and description, company name and tax ID (VOEN), privacy policy link (https://), support email, data deletion link. The “Go live” checklist on the app overview shows what is missing. Ask only for the scopes the app uses now: if reading is enough, do not ask for write.

2. 2

   Write for each scope

   • What you will do with this permission: at least 100 characters. Which data, when, why. A separate text for each scope: the same text cannot be used for two scopes.
   • Which feature uses it: the name of the screen or process, for example “Conversation list in the agent panel”.
   • Which fields you store: for example “contact name, phone, time of the last message”. If you store nothing, say so.

   A good explanation (messages:send): “In our internal agent panel an agent writes a reply to the customer, and the panel sends it to Clomni. A person always writes the message, there is no automatic sending. About 300 messages a day. On a WhatsApp Cloud number, when 24 hours have passed, the panel closes the reply box and offers to pick a template.” A weak explanation: “Needed to send messages.”

3. 3

   Data handling and testing (once)

   • Use case: what the integration does overall (required).
   • Where data is stored: country, provider, whether it is encrypted, who has access.
   • Third parties: whether you pass data to another service (for example an LLM provider).
   • Retention period (days) and incident notice (hours, at most 72).
   • Do you sell data: always “no”. The form cannot be sent with “yes”.
   • Testing: describe step by step what the reviewer should check. For an app with an interface, give a test login without 2FA that keeps working until the review ends. For high risk scopes, a link to a video that shows the feature (up to 5 minutes, in Azerbaijani or English).
   • For messages:send: who creates the message (a person, AI, an automation), about how many messages a day, and how you get consent for marketing messages. For exports:run: the purpose, the target system, how often, and how long the file is kept.
4. 4

   Statuses

   Scope: “Draft” (not sent), “In review” (waiting for a decision), “Approved” (works, you can put it on a token), “Rejected” (does not work, you can fix it and send it again). Only draft or rejected scopes can be sent. An app can have one pending review at a time. You can withdraw a sent review before the decision, and its scopes go back to draft. When you add a new scope to a Live app, the old scopes keep working and only the new scope goes to review.

5. 5

   Decision

   • Approved: every scope is approved.
   • Partially approved: some scopes are approved, some are rejected.
   • Changes requested: fix the explanation or the settings and send again.
   • Rejected: this use is not accepted.

   You get an email about the decision. You can write to the reviewer on the review page.

6. 6

   Rejection reasons

   • R01: the permission is not needed for the feature you describe. Remove it or show which feature uses it.
   • R02: the explanation is short, unclear or the same as another permission's text. Write a separate one for each permission.
   • R03: the video is missing or does not show the feature this permission is used in.
   • R04: the test login does not work or requires 2FA.
   • R05: the privacy policy does not open or does not say how Clomni data is handled.
   • R06: the retention period, or how data is deleted when the app is removed, is not stated.
   • R07: the sending volume or consent process creates a spam risk.
   • R08: the company details were not confirmed (the tax ID (VOEN) or registration document does not match).
   • R09: the name or icon could be confused with Clomni or another brand.
   • R10: the redirect URI or webhook address is not secure (no HTTPS, has a wildcard).
   • R11: the feature is not ready yet. Send it again when it is ready.
   • R12: it goes against our usage rules (selling data, tracking without permission, mass unwanted messages).
7. 7

   Public app listing

   To show the app in the Apps catalog in the dashboard, its listing must pass review too: in the review form choose “Send the listing for review too”, together with scopes or on its own. It needs: an icon (PNG or JPEG, square, 256-4096 pixels, up to 1 MB), a short and a long description, a category, an install address (install_url, https://), privacy policy and terms of use links, and at least one redirect URI. If something is missing, it cannot be sent, and the portal's “Listing” section shows the list. If the company was checked, the app gets the “Verified” badge. If the name, description, icon, category, install address or links change after the listing is approved, the app is hidden from the catalog and needs review again. Existing installations keep working.

   For questions and objections: [email protected].