api.js

var status;

window.addEventListener('message', function (event) {
    if (!event.data || !event.data.type) { return; }
    if (event.data.type === 'STATUS_API_SUCCESS') {
        status = event.data.status
    }
});
// request status API
window.postMessage({ type: 'STATUS_API_REQUEST', permissions: ["WHISPER"] });

// once approved by user
status.whisperKey //available and return data

// Other scenario

// request status API
window.postMessage({ type: 'STATUS_API_REQUEST', permissions: ["WHISPER", "CONTACTS"] });

// user only approves CONTACTS
status.whisperKey //either not there or throws
status.contacts //available and return data