Everything you need to integrate WhatsApp messaging into your application.
This API lets you manage WhatsApp instances and send/receive messages programmatically. There are two authentication keys you'll use:
| Key | Purpose | How to pass it |
|---|---|---|
| API Key | Your client identity. Used to create instances and list your instances. | Authorization: Bearer <api_key> or ?api_key=YOUR_KEY |
| Instance Token | Per-instance access. Returned when you create an instance. Used for all operations on that instance. | Authorization: Bearer <token> or ?token=YOUR_TOKEN |
Base URL:
Here's the typical flow to get a WhatsApp instance running:
POST /api/instance/{instanceId}/init
Creates a new WhatsApp instance. Uses your API Key.
curl -X POST {BASE_URL}/api/instance/my_clinic_wa/init \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"userId": "dr_smith"
}'
Response:
{
"success": true,
"message": "Instance created successfully",
"instanceId": "my_clinic_wa",
"userId": "dr_smith",
"token": "a1b2c3d4e5f6789...your_instance_token"
}
GET /api/instance/{instanceId}/qr?format=base64
Retrieves the QR code image for the user to scan with WhatsApp. Uses Instance Token.
curl "{BASE_URL}/api/instance/my_clinic_wa/qr?format=base64&token=YOUR_INSTANCE_TOKEN"
Response:
{
"success": true,
"qrCode": "data:image/png;base64,iVBORw0KGgo...",
"status": "qr_ready",
"format": "base64"
}
Formats: base64 (PNG as data URL), svg, terminal, raw
<img> tag: <img src="${qrCode}">. Poll this endpoint every 5 seconds until status changes to connected.
GET /api/instance/{instanceId}/status
curl -H "Authorization: Bearer YOUR_INSTANCE_TOKEN" \
"{BASE_URL}/api/instance/my_clinic_wa/status"
Response:
{
"success": true,
"instanceId": "my_clinic_wa",
"status": "connected",
"userInfo": {
"name": "Dr Smith Clinic",
"number": "60123456789"
}
}
| Status | Meaning |
|---|---|
| connecting | Instance is starting up |
| qr_ready | QR code available — waiting for scan |
| connected | WhatsApp authenticated and ready |
| disconnected | Session ended or phone disconnected |
POST /api/instance/{instanceId}/messages/send
curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/messages/send?token=YOUR_INSTANCE_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"to": "60123456789",
"type": "text",
"message": "Hi! Your appointment is confirmed for tomorrow at 10am."
}'
Response:
{
"success": true,
"messageId": "3EB01A2B3C4D5E6F",
"timestamp": "2026-03-23T10:30:00.000Z",
"to": "60123456789",
"type": "text"
}
+ or spaces. E.g. 60123456789 for Malaysia.
curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/messages/send?token=YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"to": "60123456789",
"type": "image",
"image": {
"url": "https://example.com/xray-result.jpg",
"caption": "Your X-ray results"
}
}'
curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/messages/send?token=YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"to": "60123456789",
"type": "document",
"document": {
"url": "https://example.com/invoice.pdf",
"filename": "Invoice_March_2026.pdf",
"mimetype": "application/pdf"
}
}'
Supported types: text, image, video, audio, document
Media can be sent via url (public URL) or data (base64 encoded).
GET /api/instance/{instanceId}/groups?token=YOUR_TOKEN
POST /api/instance/{instanceId}/groups/messages/send
curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/groups/messages/send?token=YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"to": "120363025246125789@g.us",
"type": "text",
"message": "Reminder: Staff meeting at 3pm today"
}'
Register a webhook URL to receive real-time notifications when messages arrive or connection status changes.
POST /api/instance/{instanceId}/webhook
curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/webhook?token=YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"webhookUrl": "https://your-app.com/api/whatsapp-webhook",
"events": ["message", "message_ack", "connection_update"]
}'
When a message is received, your webhook URL gets a POST request like:
{
"event": "message",
"instanceId": "my_clinic_wa",
"data": {
"from": "60123456789",
"fromName": "Patient John",
"message": "Hi, I'd like to book an appointment",
"messageType": "text",
"timestamp": 1711180200,
"messageId": "3EB0..."
}
}
| Event | Description |
|---|---|
| message | New incoming message |
| message_ack | Message delivery/read receipt |
| connection_update | Instance connected/disconnected |
| qr_updated | New QR code generated |
POST /api/instance/{instanceId}/logout?token=YOUR_TOKEN
Disconnects WhatsApp. The instance and token remain — you can reconnect by scanning a new QR code.
curl -X POST "{BASE_URL}/api/instance/my_clinic_wa/logout?token=YOUR_TOKEN"
DELETE /api/instance/{instanceId}?token=YOUR_TOKEN
Permanently removes the instance, its data, and token. Cannot be undone.
curl -X DELETE "{BASE_URL}/api/instance/my_clinic_wa?token=YOUR_TOKEN"
GET /api/instances
Uses your API Key (not instance token). Returns all instances you've created.
curl -H "Authorization: Bearer YOUR_API_KEY" "{BASE_URL}/api/instances"
| HTTP Code | Meaning |
|---|---|
| 200 | Success |
| 400 | Bad request — missing or invalid fields |
| 401 | Unauthorized — invalid or missing token/api_key |
| 403 | Forbidden — token doesn't match instance, client deactivated, or limit reached |
| 404 | Not found — instance doesn't exist |
| 409 | Conflict — instance already exists |
| 500 | Server error |
All error responses follow this format:
{
"success": false,
"error": "Description of what went wrong"
}