REST API

Authentication

Send the key as a bearer token (or X-Api-Key). Rate limits are per key, per minute.

curl http://localhost:8010/api/v1/sessions \
  -H "Authorization: Bearer wsk_ab12cd.0123456789abcdef…"

Successful responses are { "success": true, "data": … }; failures are { "success": false, "error": "…" } with a 4xx/5xx status.

Sending messages

One endpoint covers every content type. Use phone for a raw number or chatId for a JID (…@c.us, …@g.us, …@newsletter).

POST /api/v1/sessions/{session}/messages

// Text with a mention and a quote
{ "phone": "15551234567", "type": "text", "text": "Hi @15550001111!",
  "mentions": ["15550001111"], "quotedMessageId": "false_1555…@c.us_ABC" }

// Image from a URL with a caption
{ "phone": "15551234567", "type": "image",
  "mediaUrl": "https://example.com/promo.jpg", "caption": "New drop 🎉" }

// Document from base64
{ "phone": "15551234567", "type": "document", "mediaBase64": "JVBERi0…",
  "media_mime": "application/pdf", "media_filename": "invoice.pdf" }

// Voice note (plays as PTT)
{ "phone": "15551234567", "type": "voice", "mediaUrl": "https://example.com/note.ogg" }

// Sticker, view-once photo, GIF
{ "phone": "…", "type": "sticker", "mediaUrl": "https://example.com/logo.png" }
{ "phone": "…", "type": "image", "mediaUrl": "…", "viewOnce": true }
{ "phone": "…", "type": "gif", "mediaUrl": "https://example.com/clip.mp4" }

// Location
{ "phone": "…", "type": "location", "latitude": 51.5072, "longitude": -0.1276,
  "locationName": "London", "locationAddress": "Trafalgar Square" }

// Poll
{ "phone": "…", "type": "poll",
  "poll": { "name": "Pick a slot", "options": ["9am","1pm","4pm"],
            "allowMultipleAnswers": false } }

// Contact card
{ "phone": "…", "type": "contact", "contactIds": ["15550002222"] }

Sessions

Messaging

Chats

Contacts

Groups

Channels

Labels, broadcasts, calls

Campaigns & webhooks

Webhooks

Subscribe to any of these events. Each delivery carries X-WaSaaS-Signature: sha256=<hmac> computed over the raw body with your webhook secret. Retries use exponential backoff for up to six attempts.

// Express / Node verification example
import crypto from 'node:crypto';

app.post('/webhooks/wasaas', express.raw({ type: '*/*' }), (req, res) => {
  const raw = req.body.toString('utf8');
  const expected =
    'sha256=' + crypto.createHmac('sha256', process.env.WASAAS_WEBHOOK_SECRET)
      .update(raw)
      .digest('hex');

  if (expected !== req.get('x-wasaas-signature')) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(raw);
  // handle event…
  res.sendStatus(204);
});