Public API

Conversations

{
  "current_page": 1,
  "data": [{
    "id": 91,
    "channel": "whatsapp",
    "status": "open",
    "last_message_at": "2026-06-13T08:00:00.000000Z",
    "contact": { "id": 42, "name": "Priya Shah", "phone": "+919876543210" }
  }],
  "per_page": 25, "total": 1, "last_page": 1
}

curl -sS "https://api.wahob.com/api/v1/conversations?per_page=10" \
+  -H "Accept: application/json" \
+  -H "X-Api-Key: wahob_your_key" \
+  -H "X-Api-Secret: your_secret"

Approved WhatsApp templates

Fetch this list with an API key that has templates.read, then use the returned id, name, and language to populate a template selector in your integration. Results include approved templates belonging to the key’s Wahob tenant only. Pending, rejected, and disabled templates are excluded. This endpoint lists templates for selection; it does not send them.

{
  "data": [
    {
      "id": 18,
      "whatsapp_account_id": 4,
      "name": "order_update",
      "language": "en_US",
      "category": "utility",
      "body_text": "Hi {{1}}, your order {{2}} has shipped.",
      "components": [{ "type": "BODY", "text": "Hi {{1}}, your order {{2}} has shipped." }]
    }
  ]
}

curl -sS "https://api.wahob.com/api/v1/templates" \
+  -H "Accept: application/json" \
+  -H "X-Api-Key: wahob_your_key" \
+  -H "X-Api-Secret: your_secret"

WhatsApp messaging

{
  "phone": "+919876543210",
  "message": "Your order has shipped.",
  "phone_number_id": 12
}

{
  "message": "Message sent",
  "data": {
    "provider_message_id": "wamid.example",
    "phone_number_id": 12
  }
}

curl -sS -X POST "https://api.wahob.com/api/v1/messages/send" \
+  -H "Accept: application/json" \
+  -H "Content-Type: application/json" \
+  -H "X-Api-Key: wahob_your_key" \
+  -H "X-Api-Secret: your_secret" \
+  -d '{"phone": "+919876543210","message": "Your order has shipped.","phone_number_id": 12}'

Incoming automation webhooks

External service → Wahob. The backend accepts GET and POST at /api/webhook/incoming/{slug}. This slug-based integration route is configured in Wahob and is not an API-key authenticated v1 endpoint. Its payload mapping and security are managed by the configured webhook/workflow; do not treat the slug as a substitute for secret handling. The route’s implementation handles inbound automation events; there is no public v1 endpoint to list or trigger workflow definitions.

curl -X POST "https://api.wahob.com/api/webhook/incoming/<configured-slug>" \
  -H "Content-Type: application/json" \
  -d '{"event":"order.updated","data":{"order_id":"example"}}'

Payload shape and response depend on the configured webhook. Confirm accepted fields in that configuration before sending production events.

APIs not available in public v1

These are common integration requests, but the public API-key contract does not currently expose them. Some related actions may exist in the Wahob dashboard, embedded widget, or provider/store integrations; those routes are not supported substitutes for a public developer API. Do not call undocumented product endpoints as an integration contract.

Other developer contract gaps

• Idempotency: mutations, including message sends, have no documented idempotency key. Reconcile an uncertain send before retrying.
• Rate limits: throttling currently has no documented 429 response or rate-limit headers; over-limit credentials may receive 401.
• Webhook operations: no public event-subscription, signing, retry, delivery-log, or replay contract exists.
• Developer artifacts: there is no public OpenAPI specification, SDK/Postman collection, formal deprecation policy, or API-specific changelog documented here.
• Key scopes: campaigns.read, webhooks.write, appointments.read, and appointments.write are accepted by key creation but do not currently grant a public v1 operation.

Errors, limits & versioning

Responses use endpoint-specific Laravel JSON structures, commonly a top-level message; there is no single structured error envelope or request ID. Validation failures use Laravel’s 422 validation response. Sending may return 422 for unavailable WhatsApp number or recipient/policy rejection, and 500 for an unexpected send failure. Auth failures are 401; missing scopes are 403. No 429 contract or retry headers are currently emitted by the public v1 limiter.

{
  "message": "The phone field is required.",
  "errors": { "phone": ["The phone field is required."] }
}

The route prefix is /api/v1. No formal compatibility or deprecation policy is currently published. Mutating public API calls have no idempotency-key contract; a network timeout after sending can leave delivery outcome unknown, so check Wahob conversation/provider records before retrying. The public API controller does not report subscription usage explicitly; plan entitlements may govern connected product features, but no public usage endpoint or guarantee is part of this contract.

Need help? Include the endpoint, approximate time, response body, and workspace name in your support request. Do not send API secrets.