The API would be granted access by one of the parties.

So if the business runs the API, they’d use the business’s keys to read messages.

You wouldn’t need WhatsApp to have access even then.