API documentation

# Confirms the Bearer token is valid and the organization subscription is active before calling other endpoints.
# HTTP 200: token OK. 401: missing/invalid token. 403: subscription inactive.

curl -X GET \
https://whapier.com/api/verify \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Optional query: ?page=1&per_page=10 (per_page max 100).
# Newest first. Response: data (contact objects), links and meta (current_page, last_page, per_page, total).
# A contact: id, uuid, phone, first_name, last_name, email, address, metadata, groups (uuid, name), source, opted_in_at, opted_out_at, created_at, updated_at.
# Search filters, combined with AND: phone (any format the organization's country can read; 400 when it is not a number), email (exact, case-insensitive), q (2 to 128 characters, matched against name, email and number), group (a contact-group uuid; 400 when unknown), opted_out (true | false), updated_since (a date, UTC), source (api, manual, import, entry point...).

curl -X GET \
"https://whapier.com/api/contacts?page=1&per_page=10" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# The contact object of Get contact list plus unread_messages, last_message_at and ticket (status, assigned_to: name, email).
# ticket is null while ticketing is off under Settings > Tickets, or when the conversation has no ticket yet. 404 when the uuid is unknown, deleted or belongs to another workspace.

curl -X GET \
https://whapier.com/api/contacts/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# JSON body fields:
#   phone (required) — international number; validated and stored as E.164. Must be unique per organization (400 if duplicate).
#   first_name, last_name, email (optional) — omit, null, or "" for contacts without names.
#   street, city, state, zip, country (optional) — stored in address JSON.
#   metadata (optional) — arbitrary JSON-serializable value.
#   group (optional) — array of contact-group UUID strings.
#   marketing_opt_in (optional, boolean) — true records marketing consent on the contact (GDPR consent trail, source: api); false records an opt-out. Omit to leave consent unchanged.
# Responses: 200 success { statusCode, id, message }; 400 validation; 403 subscription inactive or contact limit reached.
# Accepts an Idempotency-Key header (see Before you start).

curl -X POST \
https://whapier.com/api/contacts \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "first_name": "Ana",
    "last_name": "Pop",
    "email": "ana@example.com",
    "group": [
        "d746e4c5-db24-4fb2-be03-590421344d69"
    ],
    "marketing_opt_in": true
}'

# contacts (required, 1 to 500 objects) with the fields of Add contact per row. A row whose phone the workspace already has is updated with the fields present (as Edit contact does); a new number is created.
# Each row stands alone: one bad row fails alone and the others go through. Response: { statusCode, created, updated, failed: [ { index, phone, errors } ], limit_reached, message }.
# Creating stops at the plan's contact limit: limit_reached is true and the rows that did not fit are listed in failed. Updates never count against the limit. Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/contacts/bulk \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "contacts": [
        {
            "phone": "+40721000001",
            "first_name": "Ana",
            "last_name": "Pop",
            "email": "ana@example.com"
        },
        {
            "phone": "0721 000 002",
            "first_name": "Ion",
            "group": [
                "d746e4c5-db24-4fb2-be03-590421344d69"
            ]
        },
        {
            "phone": "not-a-phone",
            "first_name": "Nobody"
        }
    ]
}'

# Same JSON fields as Add contact. Path {uuid} is the contact id returned when created.
# phone is optional on an update; if you change it, the new number must not belong to another contact (400 duplicate).
# Updating with the same phone as this contact is allowed.
# Fields you leave out keep their value; send a field as null or "" to clear it. metadata keys you send are merged into the stored ones, the others are kept.
# marketing_opt_in (optional, boolean) — true records marketing consent (source: api), false records an opt-out; omitted leaves consent unchanged.
# 404 when the uuid is unknown, deleted or belongs to another workspace.

curl -X PUT \
https://whapier.com/api/contacts/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "first_name": "Ana",
    "last_name": "Popescu",
    "metadata": {
        "plan": "platinum"
    }
}'

# Soft-deletes the contact; it leaves every list at once. 404 when the uuid is unknown or already deleted.
# Response: { statusCode, id, message }.

curl -X DELETE \
https://whapier.com/api/contacts/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Optional query: ?page=1&per_page=10 (per_page max 100).
# Each group: uuid, name, contacts_count (live members), created_at, updated_at.

curl -X GET \
"https://whapier.com/api/contact-groups?page=1&per_page=10" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# name (required) must be unique among the organization's groups (400 if taken).
# Response: { statusCode, id, message }. Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/contact-groups \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "name": "Lead 5"
}'

# Same body as Add contact group. 404 for an unknown uuid.

curl -X PUT \
https://whapier.com/api/contact-groups/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "name": "Lead 5"
}'

# Removes the group and its memberships; the contacts themselves are kept. 404 for an unknown uuid.

curl -X DELETE \
https://whapier.com/api/contact-groups/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Optional query: ?page=1&per_page=10 (per_page max 100).
# Each reply: uuid, name, trigger, match_criteria, response_type, response (the text, or null for media), file (name, url) or null, created_at, updated_at.

curl -X GET \
"https://whapier.com/api/canned-replies?page=1&per_page=10" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Body: name and trigger (max 255), match_criteria (exact match | contains), response_type (text | image | audio), response.
# For text, response is the reply (max 4096). For image or audio send multipart/form-data with the file as response (png/jpg up to 5 MB; mp3/aac/ogg/amr/opus/m4a up to 16 MB); without a file the request is a 400.
# Response: { statusCode, id, message }. 403 when the plan's limit of canned replies is reached. Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/canned-replies \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "name": "About Us",
    "trigger": "what do you do?",
    "match_criteria": "contains",
    "response_type": "text",
    "response": "We sell shoes"
}'

# Same fields as Add automated reply. An update without a file keeps the media it already has. 404 for an unknown uuid.

curl -X PUT \
https://whapier.com/api/canned-replies/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "name": "About Us",
    "trigger": "what do you do?",
    "match_criteria": "contains",
    "response_type": "text",
    "response": "We sell shoes and clothes"
}'

# 404 for an unknown uuid. Response: { statusCode, id, message }.

curl -X DELETE \
https://whapier.com/api/canned-replies/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Returns each line's uuid (use as whatsapp_connection on /api/send). No internal database ids.
# Each row: uuid, type, name, phone, display_phone_number and, for a WhatsApp Business line, verified_name and number_status. 403 when no line is connected.

curl -X GET \
https://whapier.com/api/whatsapp-connections \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Optional: whatsapp_connection (UUID from GET /api/whatsapp-connections). Omit to use the organization default line.
# phone (required) — any format; normalised to E.164 with the organization's country. A new number becomes a contact (first_name, last_name, email optional).
# message (required, max 4096); header and footer (optional, max 60); buttons (optional, up to 3 of { id, title }).
# Free-form messages need an open 24-hour window: 422 when the customer's last message is older than a day. 403: subscription, plan limit, trial daily allowance or an account under review.
# Response: 200 { statusCode, data: { success, data: { chat: { uuid, wam_id, status, type, created_at, contact } } } }. A refusal by WhatsApp is 200 with data.success false and data.data.error on /api; an HTTP 422 on /api/v2.
# Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/send \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "message": "Hello Ana, how are you?",
    "whatsapp_connection": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "header": "Example Shoes",
    "footer": "Reply STOP to opt out",
    "buttons": [
        {
            "id": "yes",
            "title": "Fine"
        },
        {
            "id": "no",
            "title": "Not well"
        }
    ]
}'

# Optional: whatsapp_connection (UUID from GET /api/whatsapp-connections). Omit to use the organization default line.
# media_type (image | video | audio | document | sticker); media_url (https, a public host; checked with one HEAD request against WhatsApp's size and type caps - 400 with the reason otherwise); caption (optional, not for audio); file_name (required for document).
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/media \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "media_type": "image",
    "media_url": "https://cdn.example.com/offers/october.jpg",
    "caption": "Our October offers"
}'

# Optional: "whatsapp_connection": "<uuid>" for a specific WABA line (UUID from GET /api/whatsapp-connections).
# template.name and template.language ("en" or { "code": "en" }) are required; components follow WhatsApp's own shape (header, body, button parameters).
# Works outside the 24-hour window. A contact who opted out (STOP) is not sent a MARKETING template: 422. Utility and authentication templates still go.
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/template \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "template": {
        "name": "order_update",
        "language": {
            "code": "en"
        },
        "components": [
            {
                "type": "header",
                "parameters": [
                    {
                        "type": "text",
                        "text": "48213"
                    }
                ]
            },
            {
                "type": "body",
                "parameters": [
                    {
                        "type": "text",
                        "text": "Ana"
                    },
                    {
                        "type": "text",
                        "text": "48213"
                    },
                    {
                        "type": "date_time",
                        "date_time": {
                            "fallback_value": "October 7, 2026"
                        }
                    }
                ]
            },
            {
                "type": "button",
                "sub_type": "url",
                "index": "0",
                "parameters": [
                    {
                        "type": "text",
                        "text": "48213"
                    }
                ]
            }
        ]
    }
}'

# latitude (-90 to 90) and longitude (-180 to 180) required; name and address optional.
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/location \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "latitude": 46.77120000000000032969182939268648624420166015625,
    "longitude": 23.623599999999999710098563809879124164581298828125,
    "name": "Example Shoes",
    "address": "Str. Memorandumului 12, Cluj-Napoca"
}'

# contacts (1 to 10 cards) in WhatsApp's contacts[] shape: name.formatted_name required; phones[], emails[], addresses[], org optional.
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/contacts \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "contacts": [
        {
            "name": {
                "formatted_name": "Example Shoes Support",
                "first_name": "Support"
            },
            "phones": [
                {
                    "phone": "+40700000000",
                    "type": "WORK"
                }
            ],
            "emails": [
                {
                    "email": "support@example.com",
                    "type": "WORK"
                }
            ]
        }
    ]
}'

# message_id (the wam_id of the message to react to) and emoji (required; "" removes the reaction).
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/reaction \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "message_id": "wamid.HBgMNDA3MjEwMDAwMDEVAgARGBI5QkY2RkE3RDlCMjc2RjI2QkEA",
    "emoji": "👍"
}'

# message (required, max 1024): the text shown above the "Send location" button.
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/location-request \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "message": "Where should we deliver?"
}'

# message (required, max 1024): asks a username-only WhatsApp user to share their phone number.
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/request-contact-info \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "message": "Could you share your number so we can call you back?"
}'

# message (required, max 1024) and cards (2 to 10): header { type: image | video, link } required; body (max 160), url_button { text, url } and quick_replies (up to 3 of { id, title }) optional.
# Same guards and response as Send message.

curl -X POST \
https://whapier.com/api/send/carousel \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "phone": "+40721000001",
    "message": "Our new arrivals",
    "cards": [
        {
            "header": {
                "type": "image",
                "link": "https://cdn.example.com/shoes/1.jpg"
            },
            "body": "Runner, 89 EUR",
            "url_button": {
                "text": "See it",
                "url": "https://example.com/shoes/1"
            }
        },
        {
            "header": {
                "type": "image",
                "link": "https://cdn.example.com/shoes/2.jpg"
            },
            "body": "Trail, 119 EUR",
            "quick_replies": [
                {
                    "id": "trail",
                    "title": "Tell me more"
                }
            ]
        }
    ]
}'

# contact (required): the contact's uuid or phone (normalised with the organization's country).
# 200 { statusCode, success: true, message }; 404 flow or contact unknown; 422 flow not published; 409 the contact is already in a flow session.
# Whatever the flow sends is subject to the 24-hour window unless it uses template nodes.

curl -X POST \
https://whapier.com/api/flows/{{uuid}}/start \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "contact": "+40721000001"
}'

# Optional: ?page=1&per_page=10&search=
# Each campaign: uuid, name, status, scheduled_at, created_at, template (uuid, name, language, category, status), whatsapp_connection (uuid, name, type), audience (type: all | group | segment, uuid, name), counts (contacts, sent, delivered, read, failed).

curl -X GET \
"https://whapier.com/api/campaigns?page=1&per_page=10" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Use when whatsapp_connection is a WhatsApp Cloud (WABA) line from GET /api/whatsapp-connections.
#
# PREREQUISITES
# - template: UUID of a row from GET /api/templates (organization-scoped), NOT the public template name string.
# - Match variable counts to your approved template: open the template metadata in the UI or Meta — BODY uses {{1}}, {{2}}, … in order.
# - You must supply one body parameter for each BODY placeholder, in the same order. A count that does not match the approved template is refused up front (422), not by WhatsApp afterwards.
#
# FIELD NOTES
# - contacts: "all" or a contact-group uuid; or segment: a saved segment's uuid (one of the two, not both). send_immediately: true, or scheduled_at (a date, read as UTC).
# - header: optional object; omitted means { "format": "TEXT", "parameters": [] }.
# - body: use body.parameters[] for variables. API format (recommended): { "type": "text", "value": "literal for {{1}}" } per slot.
#   Alternative (dashboard-style): { "selection": "static", "value": "..." } or { "selection": "dynamic", "value": "first name" } (maps contact fields).
# - footer / buttons: optional; use [] or {} if unused. Templates with URL/quick-reply variables need buttons[] shaped like the web campaign form.
# - Media header (IMAGE|VIDEO|DOCUMENT): header.parameters[] with type (IMAGE|VIDEO|DOCUMENT), "selection": "link", "value": "https://..." (public URL; API cannot upload files).
#
# RESPONSE: 200 { "statusCode": 200, "uuid": "...", "message": "..." }. Poll GET /api/campaigns/{uuid} for the report and GET /api/campaigns/{uuid}/logs for per-recipient status, or subscribe to the campaign.finished webhook.
# 403 when the plan's campaign limit is reached. Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/campaigns \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "name": "Billing reminder blast",
    "whatsapp_connection": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "contacts": "all",
    "send_immediately": true,
    "template": "281a3383-985c-4084-bcb0-9ec523c952de",
    "header": {
        "format": "TEXT",
        "parameters": []
    },
    "body": {
        "parameters": [
            {
                "type": "text",
                "value": "Ana"
            },
            {
                "type": "text",
                "value": "48213"
            },
            {
                "type": "text",
                "value": "7 October 2026"
            }
        ]
    },
    "footer": {},
    "buttons": []
}'

# The campaign object of List campaigns plus report: counts (contacts, sent, delivered, read, failed, pending), failure_reasons (code, title, count - the ten most frequent), started_at, finished_at (null until the campaign is over), paused_reason, paused_detail and paused_at (null unless the status is paused).
# paused_reason is user (paused from the dashboard or the API), admin, failing, failure_rate or quality (paused by the platform; paused_detail says why). 404 for an unknown campaign.

curl -X GET \
https://whapier.com/api/campaigns/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# No body. Only a scheduled or ongoing campaign can be paused: 409 otherwise, with the status the campaign is in. The logs stay as they are and resume picks them up.
# Response: { statusCode, status, message } - status is the campaign's new status. 404 for an unknown campaign.

curl -X POST \
https://whapier.com/api/campaigns/{{uuid}}/pause \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{}'

# No body. Only a paused campaign can be resumed: 409 otherwise. A campaign paused before its hour goes back to scheduled; one paused while sending goes back to ongoing.
# Response: { statusCode, status, message }. 404 for an unknown campaign.

curl -X POST \
https://whapier.com/api/campaigns/{{uuid}}/resume \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{}'

# No body. A scheduled, ongoing or paused campaign can be cancelled: 409 otherwise. What was not sent stays unsent; the report keeps showing who was reached.
# Response: { statusCode, status, message }. 404 for an unknown campaign.

curl -X POST \
https://whapier.com/api/campaigns/{{uuid}}/cancel \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{}'

# Optional: ?page=1&per_page=10&search= (search contact name/phone).
# Each row: contact (uuid, phone, first_name, last_name), status, message (uuid, wam_id, status) or null, error (code, title, reason) or null, retry_count, created_at, updated_at. 404 for an unknown campaign.

curl -X GET \
"https://whapier.com/api/campaigns/{{uuid}}/logs?page=1&per_page=10" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Optional query: ?page=1&per_page=10 (per_page max 100).
# Each template: uuid, name, language, category, status, components (as WhatsApp approved them), variables (header, body, buttons: how many placeholders each part takes), rejection (why it was rejected, or null), quality_score, updated_at.

curl -X GET \
"https://whapier.com/api/templates?page=1&per_page=10" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# The template object of List templates plus example_payload: a complete body for POST /api/send/template with one parameter per placeholder (the examples the template was submitted with, else a value naming the slot), a link for a media header and a suffix for each URL button with a variable.
# Optional query: whatsapp_connection (a line uuid) when the same template exists on several lines. 404 for an unknown uuid.

curl -X GET \
https://whapier.com/api/templates/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# name (lowercase letters, digits and underscores), category (MARKETING | UTILITY) and language (a Meta language code such as en or pt_BR) are required; whatsapp_connection (a WhatsApp Business line uuid) is optional - the default line otherwise.
# header (optional): { format: TEXT, text (max 60, one {{1}} allowed), examples } or { format: IMAGE | VIDEO | DOCUMENT, media_url: a public https link to a sample file }.
# body.text (required, max 1024, placeholders {{1}}, {{2}}, ...) with body.examples, one per placeholder; footer (optional, max 60); buttons (optional, up to 10): { type: QUICK_REPLY | URL | PHONE_NUMBER | COPY_CODE, text, url, phone_number, example }.
# Response: 200 { statusCode, uuid, status, message } - status is PENDING until Meta reviews it (the template.status.update webhook tells you). 400 with Meta's reason when Meta refuses it; AUTHENTICATION templates cannot be submitted through the API yet. A sandbox key cannot submit (403). Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/templates \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "name": "order_update",
    "category": "UTILITY",
    "language": "en",
    "header": {
        "format": "TEXT",
        "text": "Order {{1}}",
        "examples": [
            "48213"
        ]
    },
    "body": {
        "text": "Hi {{1}}, your order {{2}} ships on {{3}}.",
        "examples": [
            "Ana",
            "48213",
            "October 7"
        ]
    },
    "footer": "Example Shoes",
    "buttons": [
        {
            "type": "URL",
            "text": "Track",
            "url": "https://example.com/track/{{1}}",
            "example": "48213"
        },
        {
            "type": "QUICK_REPLY",
            "text": "Stop updates"
        }
    ]
}'

# No body. Pulls the templates of every WhatsApp Business line from Meta, as the dashboard's refresh does, so a template changed in Meta Business Manager shows up here.
# Response: { statusCode, synced, message } - synced is how many templates were added or changed. A sandbox key cannot sync (403); 400 when Meta refused the request.

curl -X POST \
https://whapier.com/api/templates/sync \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{}'

# Each row: uuid, url, events, secret_preview (the last six characters of the signing secret), created_at, updated_at. The full secret is shown once, in the answer to Add webhook.
# 403 when the Webhooks module is not on the plan.

curl -X GET \
https://whapier.com/api/webhooks \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Every event a webhook can receive: data (name, description). The Webhooks page in the dashboard reads the same catalogue.
# A delivery is { event, data }; the shape of data per event is under Before you start > Webhooks, and POST /api/webhooks/{uuid}/test delivers a sample of any of them.

curl -X GET \
https://whapier.com/api/webhooks/events \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# url (required, https, unique per organization) and events (required, one or more names from GET /api/webhooks/events).
# Response: { statusCode, uuid, secret, message } - the only time the full secret is returned; store it to check X-Whapier-Signature. Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/webhooks \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "url": "https://example.com/hooks/whapier",
    "events": [
        "message.received",
        "message.status",
        "campaign.finished"
    ]
}'

# Same body as Add webhook. The events list replaces the stored one; the secret stays as it is. 404 for an unknown uuid.

curl -X PUT \
https://whapier.com/api/webhooks/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "url": "https://example.com/hooks/whapier",
    "events": [
        "message.received",
        "message.status"
    ]
}'

# Removes the endpoint and its subscriptions; nothing is delivered to it any more. Response: { statusCode, uuid, message }. 404 for an unknown uuid.

curl -X DELETE \
https://whapier.com/api/webhooks/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# event (required): a name from GET /api/webhooks/events. The sample payload is posted to the url as { event, data, test: true }, signed with the secret in X-Whapier-Signature.
# Response: { statusCode, event, delivered, http_status, message } - delivered is false with the status your endpoint answered, or http_status null when it could not be reached. 404 for an unknown uuid.

curl -X POST \
https://whapier.com/api/webhooks/{{uuid}}/test \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "event": "message.status"
}'

# Optional query: status (sent | delivered | read | failed | accepted | played), direction (inbound | outbound), since and until (dates, UTC), contact (a contact uuid), campaign (a campaign uuid: the messages it produced), wam_id (one message by WhatsApp id), page, per_page (default 25, max 100).
# Response: { statusCode, data: [ message ], meta: { page, per_page, total, last_page } }. 404 when contact or campaign is unknown.
# A message: uuid, wam_id, direction, status, type, content, created_at, delivered_at, read_at, failed_at, failure (code, title, reason, retryable) or null, pricing (category, model, billable, amount, currency, country), contact (uuid, phone, first_name, last_name).
# content by type - text: body, header, footer, buttons (type, text); template: name, language, body; image, video, audio, document, sticker: caption, media (type, url, filename); interactive and button: text, payload (what the customer pressed); location: latitude, longitude, name, address; contacts: contacts (name, phones); reaction: emoji, wam_id.

curl -X GET \
"https://whapier.com/api/messages?status=failed&per_page=25" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# The same message objects as List messages, for one contact, newest first. Optional query: per_page (default 25, max 100), before (the uuid of the oldest message you already have).
# Response: { statusCode, data: [ message ], meta: { per_page, has_more, next_before } } - pass next_before as before to get the older messages. 404 for an unknown contact or cursor.

curl -X GET \
"https://whapier.com/api/contacts/{{uuid}}/messages?per_page=25" \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# The same message object plus history: a list of { status, timestamp, recorded_at }, every status change WhatsApp reported. 404 for an unknown uuid.

curl -X GET \
https://whapier.com/api/messages/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Response data: plan (name, status, valid_until), limits (contacts, messages, campaigns: used, limit; limit null = unlimited), trial_daily_messages (trial accounts only), messages_sent (today, last_7_days, last_30_days), estimated_cost (last_30_days: amount, currency), rate_limit (per_minute).

curl -X GET \
https://whapier.com/api/usage \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# Response data: contact (uuid, phone, first_name, last_name), ticketing (whether Settings > Tickets is on), ticket (status, assigned_to: name, email; opened_at, waiting_since, resolved_at) or null, messages (uuid, wam_id, direction, type, text, status, created_at - the 50 newest first), next_before.
# Optional query: before (the uuid of the oldest message you have) for the older messages; 400 when the cursor is not a message of this contact. 404 for an unknown contact.

curl -X GET \
https://whapier.com/api/conversations/{{uuid}} \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Accept: application/json'

# user_email (required, nullable): the email of an active member of the organization; null unassigns the ticket. A conversation without a ticket gets one.
# Response: { statusCode, data: ticket, message } with the ticket as Get a conversation shows it. 409 while ticketing is off; 422 when nobody active in the organization has that email; 404 for an unknown contact.

curl -X POST \
https://whapier.com/api/conversations/{{uuid}}/assign \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "user_email": "maria@example.com"
}'

# No body. Resolves the ticket (status closed, resolved_at set), as the inbox button does. Response: { statusCode, data: ticket, message }.
# 409 while ticketing is off; 404 for an unknown contact.

curl -X POST \
https://whapier.com/api/conversations/{{uuid}}/close \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{}'

# No body. Reopens a closed ticket (status open, resolved_at cleared); an open ticket is returned as it is. Response: { statusCode, data: ticket, message }.
# 409 while ticketing is off; 404 for an unknown contact.

curl -X POST \
https://whapier.com/api/conversations/{{uuid}}/reopen \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{}'

# note (required, max 5000): shown to the agents in the thread, never sent to the contact. Works whether ticketing is on or off.
# Response: { statusCode, uuid, created_at, message }. 404 for an unknown contact. Accepts an Idempotency-Key header.

curl -X POST \
https://whapier.com/api/conversations/{{uuid}}/notes \
-H 'Authorization: Bearer <YOUR_AUTHORIZATION_TOKEN>' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d '{
    "note": "Customer called; wants the order delivered on Friday."
}'