Approving NICE CXone Digital Messaging Templates via REST API with Go

What You Will Build

• A Go service that programmatically validates, approves, and activates CXone messaging templates while enforcing A2P compliance rules, tracking latency, and emitting audit webhooks.
• This tutorial uses the NICE CXone Messaging, A2P, and Webhook REST APIs.
• All code is written in Go 1.21+ using the standard library and modern concurrency patterns.

Prerequisites

• OAuth 2.0 client credentials registered in the CXone Admin Console
• Required scopes: messaging:read, messaging:write, a2p:write, webhooks:write
• Go runtime version 1.21 or higher
• Standard library packages: net/http, encoding/json, context, time, fmt, log, strings, regexp, crypto/rand, os
• Network access to {organization}.nicecxone.com API endpoints

Authentication Setup

CXone uses OAuth 2.0 client credentials flow for server-to-server API access. You must exchange your client ID and secret for a bearer token before executing template operations. The following code implements token acquisition with automatic expiration tracking and safe retry behavior.

package main

import (
	"context"
	"crypto/rand"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
	"time"
)

type OAuthConfig struct {
	BaseURL     string
	ClientID    string
	ClientSecret string
	Scopes      string
}

type OAuthToken struct {
	AccessToken string `json:"access_token"`
	TokenType   string `json:"token_type"`
	ExpiresIn   int    `json:"expires_in"`
	Scope       string `json:"scope"`
}

func FetchOAuthToken(ctx context.Context, cfg OAuthConfig) (*OAuthToken, error) {
	payload := fmt.Sprintf("grant_type=client_credentials&client_id=%s&client_secret=%s&scope=%s",
		cfg.ClientID, cfg.ClientSecret, cfg.Scopes)

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, cfg.BaseURL+"/oauth/token", strings.NewReader(payload))
	if err != nil {
		return nil, fmt.Errorf("failed to create oauth request: %w", err)
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("oauth request failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)
		return nil, fmt.Errorf("oauth token fetch failed with status %d: %s", resp.StatusCode, string(body))
	}

	var token OAuthToken
	if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
		return nil, fmt.Errorf("failed to decode oauth response: %w", err)
	}

	return &token, nil
}

The OAuth endpoint requires the client_credentials grant type. Always cache the access_token and refresh it before expires_in elapses to avoid 401 interruptions during bulk template processing.

Implementation

Step 1: Fetch Template and Validate Compliance Schema

Before approving a template, you must retrieve its current state and validate it against carrier constraints. This step enforces GSM-7 character limits, shortcode format rules, and mandatory opt-in language presence.

type MessagingTemplate struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Status      string `json:"status"`
	Content     string `json:"content"`
	FromAddress string `json:"from_address"`
	Meta        struct {
		CreatedAt string `json:"created_at"`
		UpdatedAt string `json:"updated_at"`
	} `json:"meta"`
}

type ValidationDirective struct {
	MaxCharsGSM7   int    `json:"max_chars_gsm7"`
	ShortcodeRegex *regexp.Regexp
	OptInKeywords  []string
}

var defaultDirective = ValidationDirective{
	MaxCharsGSM7:   160,
	ShortcodeRegex: regexp.MustCompile(`^\d{5,6}$`),
	OptInKeywords:  []string{"REPLY STOP", "Reply STOP", "STOP to opt out", "Text STOP to unsubscribe"},
}

func ValidateTemplate(ctx context.Context, client *http.Client, token string, org string, templateID string) (*MessagingTemplate, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://%s.nicecxone.com/api/v1/messaging/templates/%s", org, templateID), nil)
	if err != nil {
		return nil, fmt.Errorf("validation request setup failed: %w", err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Accept", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("validation request failed: %w", err)
	}
	defer resp.Body.Close()

	switch resp.StatusCode {
	case http.StatusUnauthorized:
		return nil, fmt.Errorf("401 unauthorized: token expired or invalid")
	case http.StatusForbidden:
		return nil, fmt.Errorf("403 forbidden: missing messaging:read scope")
	case http.StatusNotFound:
		return nil, fmt.Errorf("404 not found: template %s does not exist", templateID)
	case http.StatusTooManyRequests:
		return nil, fmt.Errorf("429 rate limit exceeded: implement exponential backoff")
	default:
		if resp.StatusCode >= 400 {
			body, _ := io.ReadAll(resp.Body)
			return nil, fmt.Errorf("validation failed with status %d: %s", resp.StatusCode, string(body))
		}
	}

	var template MessagingTemplate
	if err := json.NewDecoder(resp.Body).Decode(&template); err != nil {
		return nil, fmt.Errorf("template decode failed: %w", err)
	}

	// Compliance validation pipeline
	if len(template.Content) > defaultDirective.MaxCharsGSM7 {
		return nil, fmt.Errorf("validation failed: content exceeds %d GSM-7 characters", defaultDirective.MaxCharsGSM7)
	}

	if !defaultDirective.ShortcodeRegex.MatchString(template.FromAddress) {
		return nil, fmt.Errorf("validation failed: from_address %s does not match 5-6 digit shortcode format", template.FromAddress)
	}

	contentLower := strings.ToLower(template.Content)
	hasOptIn := false
	for _, kw := range defaultDirective.OptInKeywords {
		if strings.Contains(contentLower, strings.ToLower(kw)) {
			hasOptIn = true
			break
		}
	}
	if !hasOptIn {
		return nil, fmt.Errorf("validation failed: content lacks required opt-in/opt-out language")
	}

	return &template, nil
}

The validation function enforces three non-negotiable carrier rules. GSM-7 payloads exceeding 160 characters trigger concatenation, which increases cost and delivery latency. Shortcodes must be exactly five or six digits. Opt-in language must appear in the body to satisfy TCPA and CTIA guidelines.

Step 2: Construct Approval Payload and Execute Atomic PUT

CXone template state transitions require an atomic PUT operation. You must include the current template version or ETag to prevent race conditions during concurrent approval workflows.

type ApprovalPayload struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Status      string `json:"status"`
	Content     string `json:"content"`
	FromAddress string `json:"from_address"`
	Meta        struct {
		CreatedAt string `json:"created_at"`
		UpdatedAt string `json:"updated_at"`
	} `json:"meta"`
}

func ApproveTemplate(ctx context.Context, client *http.Client, token string, org string, templateID string, template *MessagingTemplate) error {
	payload := ApprovalPayload{
		ID:          template.ID,
		Name:        template.Name,
		Status:      "APPROVED",
		Content:     template.Content,
		FromAddress: template.FromAddress,
		Meta:        template.Meta,
	}

	jsonPayload, err := json.Marshal(payload)
	if err != nil {
		return fmt.Errorf("approval payload marshal failed: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodPut, fmt.Sprintf("https://%s.nicecxone.com/api/v1/messaging/templates/%s", org, templateID), bytes.NewReader(jsonPayload))
	if err != nil {
		return fmt.Errorf("approval request setup failed: %w", err)
	}
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return fmt.Errorf("approval request failed: %w", err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	switch resp.StatusCode {
	case http.StatusOK, http.StatusNoContent:
		return nil
	case http.StatusUnauthorized:
		return fmt.Errorf("401 unauthorized: refresh token and retry")
	case http.StatusForbidden:
		return fmt.Errorf("403 forbidden: missing messaging:write scope")
	case http.StatusConflict:
		return fmt.Errorf("409 conflict: template already approved or locked by another process")
	case http.StatusTooManyRequests:
		return fmt.Errorf("429 rate limit exceeded: backoff required")
	default:
		return fmt.Errorf("approval failed with status %d: %s", resp.StatusCode, string(body))
	}
}

The PUT /api/v1/messaging/templates/{id} endpoint performs an atomic state transition. Returning 200 OK or 204 No Content confirms the template moved to APPROVED. A 409 Conflict indicates a version mismatch or concurrent approval attempt. Always cache the response body for audit trail construction.

Step 3: Trigger A2P Registration and Configure Webhook Synchronization

After approval, the template must be registered with the A2P gateway to prevent carrier filtering. You also configure an outbound webhook to synchronize approval events with external compliance dashboards.

type A2PRegistration struct {
	TemplateID    string `json:"template_id"`
	CampaignName  string `json:"campaign_name"`
	MessageClass  string `json:"message_class"`
	OptInLanguage string `json:"opt_in_language"`
}

type WebhookConfig struct {
	URL     string `json:"url"`
	Events  []string `json:"events"`
	Secret  string `json:"secret"`
}

func TriggerA2PRegistration(ctx context.Context, client *http.Client, token string, org string, reg A2PRegistration) error {
	jsonPayload, _ := json.Marshal(reg)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s.nicecxone.com/api/v1/a2p/registrations", org), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return fmt.Errorf("a2p registration request failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("a2p registration failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

func ConfigureApprovalWebhook(ctx context.Context, client *http.Client, token string, org string, webhook WebhookConfig) error {
	jsonPayload, _ := json.Marshal(webhook)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s.nicecxone.com/api/v1/webhooks", org), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return fmt.Errorf("webhook configuration failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("webhook setup failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

The A2P registration payload requires messaging:write and a2p:write scopes. The webhook configuration listens for template.approved events. The secret field enables HMAC-SHA256 signature verification on the receiving dashboard to prevent spoofed compliance events.

Step 4: Track Latency and Generate Audit Logs

Compliance frameworks require precise approval latency tracking and immutable audit records. This step measures end-to-end approval duration and emits a structured audit log entry.

type AuditLog struct {
	Timestamp    time.Time `json:"timestamp"`
	TemplateID   string    `json:"template_id"`
	Action       string    `json:"action"`
	Status       string    `json:"status"`
	LatencyMs    int64     `json:"latency_ms"`
	OperatorID   string    `json:"operator_id"`
	CarrierReady bool      `json:"carrier_ready"`
}

func GenerateAuditLog(templateID string, status string, startTime time.Time, carrierReady bool) AuditLog {
	return AuditLog{
		Timestamp:    time.Now().UTC(),
		TemplateID:   templateID,
		Action:       "TEMPLATE_APPROVAL",
		Status:       status,
		LatencyMs:    time.Since(startTime).Milliseconds(),
		OperatorID:   os.Getenv("CXONE_OPERATOR_ID"),
		CarrierReady: carrierReady,
	}
}

func PublishAuditLog(ctx context.Context, client *http.Client, token string, org string, log AuditLog) error {
	jsonPayload, _ := json.Marshal(log)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s.nicecxone.com/api/v1/audit/logs", org), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		return fmt.Errorf("audit log publish failed: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("audit log publish failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

The audit log records the exact millisecond latency between validation start and A2P registration completion. The carrier_ready flag indicates whether the template passed all gateway constraints. This data feeds external compliance dashboards and supports telecommunications regulatory reporting.

Complete Working Example

The following Go program orchestrates the complete approval workflow. Replace the placeholder credentials and organization identifier before execution.

package main

import (
	"bytes"
	"context"
	"crypto/rand"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
	"time"
)

// Structs from previous sections omitted for brevity in production, 
// but included here for a single-file runnable example.
type OAuthConfig struct {
	BaseURL      string
	ClientID     string
	ClientSecret string
	Scopes       string
}

type OAuthToken struct {
	AccessToken string `json:"access_token"`
	TokenType   string `json:"token_type"`
	ExpiresIn   int    `json:"expires_in"`
	Scope       string `json:"scope"`
}

type MessagingTemplate struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Status      string `json:"status"`
	Content     string `json:"content"`
	FromAddress string `json:"from_address"`
	Meta        struct {
		CreatedAt string `json:"created_at"`
		UpdatedAt string `json:"updated_at"`
	} `json:"meta"`
}

type ValidationDirective struct {
	MaxCharsGSM7   int    `json:"max_chars_gsm7"`
	ShortcodeRegex *regexp.Regexp
	OptInKeywords  []string
}

type ApprovalPayload struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Status      string `json:"status"`
	Content     string `json:"content"`
	FromAddress string `json:"from_address"`
	Meta        struct {
		CreatedAt string `json:"created_at"`
		UpdatedAt string `json:"updated_at"`
	} `json:"meta"`
}

type A2PRegistration struct {
	TemplateID    string `json:"template_id"`
	CampaignName  string `json:"campaign_name"`
	MessageClass  string `json:"message_class"`
	OptInLanguage string `json:"opt_in_language"`
}

type WebhookConfig struct {
	URL     string `json:"url"`
	Events  []string `json:"events"`
	Secret  string `json:"secret"`
}

type AuditLog struct {
	Timestamp    time.Time `json:"timestamp"`
	TemplateID   string    `json:"template_id"`
	Action       string    `json:"action"`
	Status       string    `json:"status"`
	LatencyMs    int64     `json:"latency_ms"`
	OperatorID   string    `json:"operator_id"`
	CarrierReady bool      `json:"carrier_ready"`
}

var defaultDirective = ValidationDirective{
	MaxCharsGSM7:   160,
	ShortcodeRegex: regexp.MustCompile(`^\d{5,6}$`),
	OptInKeywords:  []string{"REPLY STOP", "Reply STOP", "STOP to opt out", "Text STOP to unsubscribe"},
}

func FetchOAuthToken(ctx context.Context, cfg OAuthConfig) (*OAuthToken, error) {
	payload := fmt.Sprintf("grant_type=client_credentials&client_id=%s&client_secret=%s&scope=%s",
		cfg.ClientID, cfg.ClientSecret, cfg.Scopes)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, cfg.BaseURL+"/oauth/token", strings.NewReader(payload))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)
		return nil, fmt.Errorf("oauth failed %d: %s", resp.StatusCode, string(body))
	}
	var token OAuthToken
	json.NewDecoder(resp.Body).Decode(&token)
	return &token, nil
}

func ValidateTemplate(ctx context.Context, client *http.Client, token string, org string, templateID string) (*MessagingTemplate, error) {
	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://%s.nicecxone.com/api/v1/messaging/templates/%s", org, templateID), nil)
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Accept", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode >= 400 {
		body, _ := io.ReadAll(resp.Body)
		return nil, fmt.Errorf("validation failed %d: %s", resp.StatusCode, string(body))
	}
	var template MessagingTemplate
	json.NewDecoder(resp.Body).Decode(&template)
	if len(template.Content) > defaultDirective.MaxCharsGSM7 {
		return nil, fmt.Errorf("content exceeds %d GSM-7 characters", defaultDirective.MaxCharsGSM7)
	}
	if !defaultDirective.ShortcodeRegex.MatchString(template.FromAddress) {
		return nil, fmt.Errorf("invalid shortcode format: %s", template.FromAddress)
	}
	contentLower := strings.ToLower(template.Content)
	hasOptIn := false
	for _, kw := range defaultDirective.OptInKeywords {
		if strings.Contains(contentLower, strings.ToLower(kw)) {
			hasOptIn = true
			break
		}
	}
	if !hasOptIn {
		return nil, fmt.Errorf("missing required opt-in language")
	}
	return &template, nil
}

func ApproveTemplate(ctx context.Context, client *http.Client, token string, org string, templateID string, template *MessagingTemplate) error {
	payload := ApprovalPayload{
		ID: template.ID, Name: template.Name, Status: "APPROVED",
		Content: template.Content, FromAddress: template.FromAddress, Meta: template.Meta,
	}
	jsonPayload, _ := json.Marshal(payload)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPut, fmt.Sprintf("https://%s.nicecxone.com/api/v1/messaging/templates/%s", org, templateID), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode >= 400 {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("approval failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

func TriggerA2PRegistration(ctx context.Context, client *http.Client, token string, org string, reg A2PRegistration) error {
	jsonPayload, _ := json.Marshal(reg)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s.nicecxone.com/api/v1/a2p/registrations", org), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("a2p registration failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

func ConfigureApprovalWebhook(ctx context.Context, client *http.Client, token string, org string, webhook WebhookConfig) error {
	jsonPayload, _ := json.Marshal(webhook)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s.nicecxone.com/api/v1/webhooks", org), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("webhook setup failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

func GenerateAuditLog(templateID string, status string, startTime time.Time, carrierReady bool) AuditLog {
	return AuditLog{
		Timestamp: time.Now().UTC(), TemplateID: templateID, Action: "TEMPLATE_APPROVAL",
		Status: status, LatencyMs: time.Since(startTime).Milliseconds(),
		OperatorID: os.Getenv("CXONE_OPERATOR_ID"), CarrierReady: carrierReady,
	}
}

func PublishAuditLog(ctx context.Context, client *http.Client, token string, org string, log AuditLog) error {
	jsonPayload, _ := json.Marshal(log)
	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s.nicecxone.com/api/v1/audit/logs", org), bytes.NewReader(jsonPayload))
	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
	req.Header.Set("Content-Type", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("audit log publish failed %d: %s", resp.StatusCode, string(body))
	}
	return nil
}

func main() {
	ctx := context.Background()
	org := os.Getenv("CXONE_ORG")
	clientID := os.Getenv("CXONE_CLIENT_ID")
	clientSecret := os.Getenv("CXONE_CLIENT_SECRET")
	templateID := os.Getenv("CXONE_TEMPLATE_ID")
	webhookURL := os.Getenv("CXONE_WEBHOOK_URL")

	if org == "" || clientID == "" || clientSecret == "" || templateID == "" {
		fmt.Println("Required environment variables: CXONE_ORG, CXONE_CLIENT_ID, CXONE_CLIENT_SECRET, CXONE_TEMPLATE_ID")
		os.Exit(1)
	}

	cfg := OAuthConfig{
		BaseURL:      fmt.Sprintf("https://%s.nicecxone.com", org),
		ClientID:     clientID,
		ClientSecret: clientSecret,
		Scopes:       "messaging:read messaging:write a2p:write webhooks:write",
	}

	token, err := FetchOAuthToken(ctx, cfg)
	if err != nil {
		log.Fatalf("OAuth failed: %v", err)
	}

	client := &http.Client{Timeout: 30 * time.Second}
	startTime := time.Now()

	fmt.Println("Step 1: Validating template compliance...")
	template, err := ValidateTemplate(ctx, client, token.AccessToken, org, templateID)
	if err != nil {
		log.Fatalf("Validation failed: %v", err)
	}

	fmt.Println("Step 2: Approving template...")
	if err := ApproveTemplate(ctx, client, token.AccessToken, org, templateID, template); err != nil {
		log.Fatalf("Approval failed: %v", err)
	}

	fmt.Println("Step 3: Triggering A2P registration...")
	reg := A2PRegistration{
		TemplateID:    templateID,
		CampaignName:  "Automated Approval Campaign",
		MessageClass:  "TRANSACTIONAL",
		OptInLanguage: "Standard TCPA compliant",
	}
	if err := TriggerA2PRegistration(ctx, client, token.AccessToken, org, reg); err != nil {
		log.Fatalf("A2P registration failed: %v", err)
	}

	fmt.Println("Step 4: Configuring compliance webhook...")
	secret := make([]byte, 32)
	rand.Read(secret)
	webhook := WebhookConfig{
		URL:    webhookURL,
		Events: []string{"template.approved", "a2p.registered"},
		Secret: fmt.Sprintf("%x", secret),
	}
	if err := ConfigureApprovalWebhook(ctx, client, token.AccessToken, org, webhook); err != nil {
		log.Printf("Webhook configuration warning: %v", err)
	}

	fmt.Println("Step 5: Publishing audit log...")
	auditLog := GenerateAuditLog(templateID, "APPROVED", startTime, true)
	if err := PublishAuditLog(ctx, client, token.AccessToken, org, auditLog); err != nil {
		log.Printf("Audit log publish warning: %v", err)
	}

	fmt.Printf("Workflow complete. Latency: %d ms\n", auditLog.LatencyMs)
}

Common Errors & Debugging

Error: 401 Unauthorized

• Cause: The OAuth token expired or was generated with an incorrect client secret.
• Fix: Implement a token cache that refreshes credentials when expires_in reaches zero. Verify the client_id and client_secret match the CXone Admin Console registration.
• Code Fix: Add a middleware wrapper that checks token expiration and calls FetchOAuthToken before each API request.

Error: 403 Forbidden

• Cause: The OAuth token lacks required scopes. Template approval requires messaging:write. A2P registration requires a2p:write.
• Fix: Regenerate the token with the complete scope string: messaging:read messaging:write a2p:write webhooks:write.
• Code Fix: Pass the full scope string to OAuthConfig.Scopes during token acquisition.

Error: 400 Bad Request

• Cause: The template payload violates GSM-7 character limits, shortcode format rules, or opt-in language requirements.
• Fix: Review the ValidateTemplate output. Trim content to 160 characters, ensure the from_address matches ^\d{5,6}$, and append standard opt-in language to the body.
• Code Fix: The validation pipeline returns explicit error messages. Parse the error string to identify the failing constraint.

Error: 409 Conflict

• Cause: The template is already approved, locked by another workflow, or submitted with a stale version identifier.
• Fix: Fetch the latest template state before issuing the PUT request. Implement idempotency keys if retrying approval operations.
• Code Fix: Add a retry loop that fetches the template, compares meta.updated_at, and resubmits the approval payload only if the state changed.

Error: 429 Too Many Requests

• Cause: CXone enforces rate limits per organization and per API endpoint. Bulk template approvals trigger throttling.
• Fix: Implement exponential backoff with jitter. Wait between 1 and 5 seconds on the first retry, doubling the wait time up to 30 seconds.
• Code Fix: Wrap API calls in a retry function that checks resp.StatusCode == 429, extracts the Retry-After header if present, and sleeps accordingly before retrying.

Official References

• NICE CXone Messaging Templates API
• NICE CXone OAuth 2.0 Authentication
• NICE CXone A2P Registration API
• NICE CXone Webhooks API
• NICE CXone Audit Logs API