Read the webhook configuration
Returns the endpoint URL, the event types delivered to it, and whether a signing secret is set. **The secret is never returned here.** A read is routinely logged, cached and pasted into support tickets; a secret that leaks through it is a secret you cannot reason about. If you lost yours, rotate it — which is what you would have to do after a leak anyway.
Returns the endpoint URL, the event types delivered to it, and whether a signing secret is set.
The secret is never returned here. A read is routinely logged, cached and pasted into support tickets; a secret that leaks through it is a secret you cannot reason about. If you lost yours, rotate it — which is what you would have to do after a leak anyway.
The default way to authenticate. Create a key at https://developers.wasync.app/keys and send it as Authorization: Bearer wsk_live_….
The key is shown once at creation and stored only as a hash — lose it and you revoke it and create another. Each key carries its own scopes (whatsapp.read, whatsapp.send, whatsapp.events, whatsapp.manage) and an optional IP allowlist.
Errors: an unknown or revoked key returns 401 invalid_key; a key whose IP allowlist does not cover the calling address returns 403 ip_not_allowed (a distinct code on purpose — the key is fine, the address is not). Both carry a WWW-Authenticate: Bearer challenge. Scopes and the connection list are resolved live on every request, so revoking a key or narrowing it takes effect on the next call.
In: header
Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/webhook"{ "url": "https://example.com/wasync/webhook", "events": [ "message.received", "message.status", "connection.disconnected", "connection.connected" ], "secretSet": true}Mark inbound messages as read (blue ticks) POST
Sends a WhatsApp **read receipt** so the customer sees the blue ticks on the messages they sent you. Call this the moment one of your operators opens the conversation in your own UI. If your agents read WhatsApp inside your CRM, nobody ever opens the chat in WhatsApp — the customer's messages stay on double grey ticks and the conversation feels ignored. **Scope is `whatsapp.send`, not `whatsapp.read`:** marking read TRANSMITS a receipt from your number to the customer's device, so it is an outbound action. Any client that can already send can mark read — no new scope, no re-consent. Supply `connectionId` plus at least one of `phone` / `messageId`. `messageId` is WASync's stable id (a cuid) of an INCOMING message — not `waMessageId`. When both are given, `messageId` wins. Idempotent by nature: re-marking an already-read conversation is a no-op, so no `idempotencyKey` is accepted and no rate limit applies. Retry freely. Connection differences: WAPP/QR connections mark the whole chat; WABA (official API) connections can only mark one specific message, so a `phone`-only request resolves your most recent inbound message from that number automatically.
Set the webhook endpoint PUT
Points WASync at your URL and returns the signing secret for it. Idempotent — calling it again with a different URL moves the endpoint. The URL must be HTTPS on a publicly reachable host; http, localhost and private ranges are rejected with 400 `invalid_webhook`. Signature scheme (unchanged): every delivery carries `X-WASync-Signature: sha256=<hex>` = HMAC-SHA256 of `${X-WASync-Timestamp}.${rawBody}` keyed with this secret. `X-WASync-Timestamp` is epoch milliseconds; reject anything older than 5 minutes. Verify over the RAW body, before parsing. Full contract: https://developers.wasync.app/docs/webhooks