Developers

WAFlow API documentation

A REST API and signed webhooks for messaging, templates, contacts, and campaigns. All traffic to WhatsApp uses Meta's official Cloud API on behalf of the workspace that authorised WAFlow.

Base URL

All endpoints are versioned

https://wafollow.in/api/v1

Rate limits: 60 requests/minute per workspace on write endpoints and 300 requests/minute on reads. WhatsApp messaging throughput is additionally governed by your Meta messaging limit and quality rating.

Authentication

All API requests are authenticated with a workspace API key sent as a bearer token. Keys are created in Settings → API and are scoped to a single workspace, so a key can never read another customer's data. Rotate keys at any time; the previous key stops working immediately.

curl https://wafollow.in/api/v1/contacts \
  -H "Authorization: Bearer wafl_live_xxxxxxxxxxxxxxxx"

Messages

Send template messages, free-form replies inside the 24-hour customer service window, and media. Requests are queued, delivered through the official WhatsApp Cloud API, and reconciled with Meta status webhooks.

POST /api/v1/messages
{
  "to": "+919876543210",
  "type": "template",
  "template": {
    "name": "appointment_reminder",
    "language": "en",
    "variables": { "1": "Priya", "2": "Thursday 4 PM" }
  }
}

Templates

Create templates, submit them to Meta for review, list approval status, and delete templates you no longer use. Approval decisions are made by Meta; WAFlow mirrors the status and rejection reason.

POST /api/v1/templates
{
  "name": "order_shipped",
  "category": "UTILITY",
  "language": "en",
  "body": "Hi {{1}}, your order {{2}} has shipped."
}

Contacts

Create, update, list, and delete contacts, manage tags and custom fields, and record opt-in or opt-out state. Opt-out contacts are automatically excluded from broadcasts.

POST /api/v1/contacts
{
  "phone": "+919876543210",
  "name": "Priya Sharma",
  "tags": ["webinar-aug"],
  "opt_in": true,
  "opt_in_source": "landing-page-form"
}

Campaigns

Create a campaign from an approved template and a segment, schedule it, and read aggregate performance including sent, delivered, read, replied, and failed counts.

POST /api/v1/campaigns
{
  "name": "August webinar reminder",
  "template": "webinar_reminder",
  "segment_id": "seg_123",
  "send_at": "2026-08-22T09:30:00+05:30"
}

Webhooks

Subscribe an HTTPS endpoint to receive inbound messages, delivery status updates, template approval changes, and automation events. Every payload is signed with an HMAC-SHA256 signature over the raw body; verify it with a timing-safe comparison before processing. Respond with 2xx within 10 seconds — WAFlow retries with exponential backoff for 24 hours.

POST https://your-app.com/waflow-webhook
X-WAFlow-Signature: sha256=...

{
  "event": "message.received",
  "workspace_id": "ws_123",
  "data": {
    "from": "+919876543210",
    "text": "Is the offer still live?",
    "received_at": "2026-08-19T13:02:11Z"
  }
}

Errors

WAFlow uses conventional HTTP status codes. 400 invalid request, 401 missing or invalid API key, 403 not permitted for this workspace, 404 unknown resource, 409 conflict such as a duplicate template name, 422 policy or validation failure including Meta template rejections, 429 rate limited, and 5xx server errors. Error bodies always include a machine-readable code and a human-readable message, and Meta errors include the upstream code.

{
  "error": {
    "code": "template_not_approved",
    "message": "Template 'order_shipped' is pending review by Meta.",
    "meta_error_code": 132000
  }
}

Examples

A common pattern: capture a lead in your own app, create the contact with documented opt-in, then trigger a template message and let an automation handle follow-up.

// 1. create contact with consent
await api.post('/contacts', { phone, name, opt_in: true, opt_in_source: 'checkout' })
// 2. send an approved utility template
await api.post('/messages', { to: phone, type: 'template',
  template: { name: 'order_confirmation', language: 'en', variables: { '1': orderId } } })
// 3. listen for the reply on your webhook and hand off to a human

Meta webhook endpoint

WAFlow exposes a dedicated Meta callback endpoint at https://wafollow.in/api/webhooks/whatsapp. It answers Meta's GET verification handshake and validates the X-Hub-Signature-256 header on every POST before routing events to the correct workspace. This endpoint is for Meta only — use your own webhook subscription for application events.