WAP.lat Tenant API

Authentication

Send `x-api-key: wap_...` with every request. Each key belongs to one tenant and can be limited with scopes such as `messages:send`, `messages:read`, `media:read`, `instances:read`, `instances:connect`, `instances:write`, `webhooks:read` and `webhooks:write`. The backend revalidates tenant and scope for every resource.

curl -H "x-api-key: wap_xxx" https://api.wap.lat/messages

Plans and features

Capabilities come from the tenant plan plus tenant-level overrides. Disabled features return 403 with `feature_disabled` and `requiredFeature`.

Messages and rich media

POST /messages/text
{ "route": "default", "to": "5493510000000", "text": "Hello" }

Available endpoints: `/messages/image`, `/messages/audio`, `/messages/document`, `/messages/video`, `/messages/sticker`, `/messages/location`, `/messages/contact` and `/messages/poll`.

Premium tenants can manage reusable WebP assets through `/stickers` and send them with `/stickers/{id}/send`. Sent outbound text may be edited with `PATCH /messages/{id}` and supported outbound messages may be revoked with `DELETE /messages/{id}`. Provider limits still apply.

Use a persisted message's internal WAP.lat ID to react. Sending another reaction replaces it; `DELETE` removes the connected number's reaction.

POST /messages/{messageId}/reactions
{ "emoji": "👍" }

DELETE /messages/{messageId}/reactions

Validation codes

Generate a 4 to 10 character numeric or easy alphanumeric code, or three hyphen-separated words. The request selects the recipient, sending number, language and template; the response returns the code for the integrator to check.

POST /validation/codes
{ "instanceId": "...", "to": "5493510000000", "type": "numeric", "length": 6, "locale": "en" }

Plans define monthly requests, templates and retries per phone within 24 hours. Each send also consumes one outbound message. See the full API reference for template and settings management.

Archived number restoration

Deleting a number performs a logical archive. If the same tenant creates it again, WAP.lat restores the instance and history and returns restoredFromArchive: true. An active instance, current ownership by another tenant or a global ban still rejects creation.

Groups

Requires `groups`. Supports listing groups, reading metadata, creating groups, updating participants, invite links, leaving and text sends.

GET /groups?instanceId=...
POST /groups/{groupId}/messages/text

Broadcast lists

Broadcast lists are WAP.lat-owned audiences, not native WhatsApp broadcast lists. Sending creates individual messages for traceability, retries and opt-out.

POST /broadcast-lists
POST /broadcast-lists/{listId}/recipients
POST /broadcast-lists/{listId}/send-text

Webhooks

A tenant can create multiple callbacks up to its plan allowance. Each endpoint can target one, several or all tenant numbers; WAP.lat filters on `payload.instanceId` before creating a delivery. Endpoints receive HMAC-signed events when a secret is configured.

POST /webhook-endpoints
{ "url": "https://crm.example/webhook", "events": ["message.received"], "instanceIds": ["inst_spain"] }

PATCH /webhook-endpoints/{id}/instances
{ "instanceIds": ["inst_spain", "inst_support"] }

Base events: `message.received`, `message.sent`, `message.failed`, `media.received`, `qr.updated`, `instance.connected` and `instance.disconnected`.

Expanded events: `message.receipt_update`, `message.reaction`, `poll.results`, `call.received`, `chat.update`, `group.update` and `group.participants_update`.

Delivery is asynchronous, retried and persisted with its HTTP result. The panel shows event, attempts, response or error; Conversations links that evidence to the related message.

Public connection widget API

Tenants can issue revocable connection tokens for a single WhatsApp instance. Tokens carry capabilities such as `status`, `reconnect`, `qr` and `subscribe`, and can be rotated from the panel. QR access is opt-in and is not exposed by a read-only scope.

GET /public/instances/{id}/status
POST /public/instances/{id}/reconnect
GET /public/instances/{id}/qr
GET /public/instances/{id}/stream
POST /public/instances/{id}/alert-subscriptions

The embeddable `widget.js` and `/embed/instance/{id}` iframe use that API with rate limits, `Cache-Control: no-store`, QR opt-in and double opt-in email alerts.

If pairing remains pending indefinitely, the tenant can stop and resume regeneration with `POST /instances/{id}/qr-renewal/pause` and `/resume`; status responses expose `qrRenewalPaused`.

Traffic policy and alarms

Groups, newsletters and broadcast lists are denied by default before persistence, media download, transcription or callback delivery. Policy inherits global → tenant → pool → number and treats inbound and outbound traffic independently.

GET   /traffic-policy
PATCH /traffic-policy
GET   /traffic-policy/instances/{id}/effective
PATCH /traffic-policy/instances/{id}
GET   /traffic-policy/metrics?minutes=1

Per-minute counters are green through 50 attempts, yellow from 51 to 100 and red from 101. Superadmins manage the same hierarchy under `/admin/traffic-policy`.

Operations, superadmin and verifiable archives

The native superadmin console manages tenants, plans, features, users, numbers, callbacks, assignments, API keys and archive policies. Number reassignment clears operational associations to prevent cross-customer leakage. CRM exposes 30 days of daily inbound/outbound usage; System accepts an inclusive range, defaults to seven days, and groups hourly traffic and files by type.

Operations includes direct-IP and proxy inventory, shared or dedicated pools, health checks, critical-component monitoring and a controlled lab for Baileys, WPPConnect and open-wa. Registering egress does not provision an IP or promise instant cross-provider failover.

Platform health includes audio transcription, image OCR and the internal sentiment engine. Sentiment and intent calibration are private Superadmin review workflows; they do not expose stored tenant conversations through the public API. Local Qwen runtimes for prompts, images and voice are optional, default to off and add no public tenant endpoints.

The lightweight ledger permanently retains traffic metadata without message text or binaries. Eligible detail is packaged as a native ZIP with a manifest and SHA-256, read back and verified before purge, and can be restored transactionally. Packages use local or S3-compatible storage.

GET   /archive/runs
GET   /archive/runs/{id}/download
GET   /admin/archive/policy?tenantId=...
PATCH /admin/archive/policy
POST  /admin/archive/runs
POST  /admin/archive/runs/{id}/restore

Tenants require the `messageArchiveAccess` feature, assigned by plan or override. Configuration, execution and restoration remain superadmin-only. Production availability depends on the migration, storage and policy being enabled; it is not advertised as active by default.

SDKs and n8n

The repository includes uniform dependency-minimal clients for Node.js, Python, Laravel/PHP, Go, .NET and Java plus an initial n8n node. They share typed errors, use the tenant API and respect scopes/features. Syntax or compilation is checked with `npm.cmd run check:sdks`.

Machine-readable integration artifacts are versioned in the repository as `docs/openapi.yaml` and `docs/postman-wap-lat.json`; the live API also exposes `GET /openapi.json` and `GET /llms.txt`.

Coverage status

WAP.lat covers rich messaging, callbacks per number, remote connection controls, basic groups, internal lists, lightweight SDKs and operational observability. Some capabilities remain in rollout or on the roadmap so public claims stay aligned with availability.