API Reference
Every endpoint of the WhatsApp Platform API, generated from the OpenAPI contract.
Base URL https://developers.wasync.app/api/v1. Every request carries
Authorization: Bearer <your API key>; an OAuth access token goes in the same
header. The machine-readable contract these pages are built from is
openapi.json, served with open
CORS so you can generate a client straight from it.
Connections
List authorized connections
Returns the WhatsApp connections this access token may use.
Create a new connection
Provisions a new WhatsApp connection inside this grant.
Get connection status
Returns the current status and metadata of a single connection.
Delete a connection
Permanently removes the connection and its adapter session.
Restart a connection session
Restarts the WhatsApp adapter session without deleting the connection record.
Log out a connection
Logs the WhatsApp session out and clears session credentials.
Request a pairing code (link with phone number)
Issues a WhatsApp pairing code for a connection that is waiting to be paired — the alternative to scanning the QR.
Account
Messages
List recent messages
Returns recent messages (newest first) scoped to the token's connections.
Send a WhatsApp message (text or media)
Sends a message from one of the authorized connections.
Mark inbound messages as read (blue ticks)
Sends a WhatsApp read receipt so the customer sees the blue ticks on the messages they sent you.
Webhook
Read the webhook configuration
Returns the endpoint URL, the event types delivered to it, and whether a signing secret is set.
Set the webhook endpoint
Points WASync at your URL and returns the signing secret for it.
Rotate the webhook signing secret
Issues a new signing secret and invalidates the old one immediately — there is no overlap window.
OAuth2 for third-party apps
Only for apps that other WASync customers install. Authorization Code with PKCE, rotating refresh tokens, and one structural limit.
List authorized connections GET
Returns the WhatsApp connections this access token may use. Only connections with an active API add-on appear; an expired add-on hides the connection. Call this first to discover which `id` to send from or read.