A bot was firing Subscribe and Purchase events from Telegram straight to Meta's Conversions API, and every call came back with a 400:

"error_user_title": "Missing Messaging Channel Parameter",
"error_user_msg": "A messaging channel parameter is required when provided
                   action source is business_messaging. Valid value could be
                   messenger, whatsapp and instagram."

The payload looked fine — event_name, event_time, a hashed external_id, and action_source: 'business_messaging'. So why the 400?

The gotcha

business_messaging is not a generic "it happened in a chat" source. Meta ties it to its own messaging products, and it demands a companion messaging_channel whose only valid values are messenger, whatsapp, instagram. Telegram isn't on that list — there's no channel you can hand it — so the request can never validate.

The instinct is to try app next. Don't. app drags in a required app_data block: the extinfo array, advertiser tracking flags, the whole mobile-SDK surface. You don't have that from a bot, and you don't want to fake it.

The fix

For a self-hosted Telegram bot, the right source is plain other:

"action_source": "other"

other has no extra mandatory fields. You need event_name, event_time, action_source, and a user_data with at least one identifier. A SHA-256 hashed Telegram user id as external_id is enough to clear the 400. One-line change.

Making it actually attribute

Not crashing is the low bar. To tie a Subscribe or Purchase back to the ad that caused it, you need the click id:

• Capture fbc. Your ad sends people to a deep link — t.me/yourbot?start=.... Meta appends fbclid to that destination. Pack the fbclid into the start payload, read it on /start, and build fbc = fb.1.[unix_time].[fbclid]. Send it in user_data next to external_id. This is the single biggest lever for matching.
• Purchase needs money. Add custom_data with value and currency, or there's no ROAS to compute later.
• Verify before you trust it. Events Manager has a Test Events tab — send with a test_event_code and watch the events land and match before you point real traffic at it.
• Dedupe if a web pixel fires the same events: same event_id on both sides and Meta collapses them.

The 400 is a five-second fix. The attribution is the part that actually pays for itself.