API & developers

Build on top of WallzaOS.

Clean REST API. Bearer-token auth. Predictable JSON. Free on every plan — no enterprise gate, no rate-limit shakedown.

Quickstart

Send your first message in 30 seconds

terminal

curl https://api.wallzaos.app/v1/messages \
  -H "Authorization: Bearer wlz_live_•••" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "whatsapp",
    "to":      "+919999999999",
    "template": "order_confirm",
    "variables": { "name": "Riya", "order_id": "WZ-1042" }
  }'

Core endpoints

POST/v1/messagesSend a WhatsApp / Instagram / Email message

GET/v1/messages/:idFetch delivery status of a single message

POST/v1/contactsCreate or upsert a contact with custom attributes

GET/v1/contactsList & filter contacts by tag, segment or attribute

POST/v1/campaigns/:id/triggerFire a pre-built campaign for one user or a list

POST/v1/webhooksSubscribe to events: message.delivered, reply.received, lead.scored

Authentication, limits & errors

Bearer token auth

Send Authorization: Bearer <key>. Keys are workspace-scoped, rotatable and revocable, with separate live and sandbox prefixes.

Rate limits

Limits apply per workspace and are returned on every response via X-RateLimit-Limit and X-RateLimit-Remaining headers. A 429 includes Retry-After.

Predictable errors

Errors return a stable code, human message and field-level details: 400 validation, 401 auth, 404 missing, 409 conflict, 429 rate limit, 5xx retryable.

Webhooks

Every event, signed and retried

We POST signed JSON to your endpoint and retry with exponential backoff for 24 hours until you return a 2xx.

POST https://your-app.com/hooks/wallzaos

{
  "id":    "evt_01J8ZK",
  "type":  "reply.received",
  "sent_at": "2026-06-28T10:12:04Z",
  "data": {
    "conversation_id": "cnv_7712",
    "channel":  "whatsapp",
    "contact":  { "id": "ctc_3391", "phone": "+919999999999", "name": "Riya" },
    "message":  { "text": "Is this in stock?", "intent": "product_availability" }
  }
}

message.sent
message.delivered
reply.received
lead.scored

Webhooks, SDKs & sandbox

Node, Python and PHP SDKs ship Q1 2026. Until then, plain HTTPS works everywhere. Sandbox tokens available on request.

Email devs@wallzaos.app →

FAQ

Answers before you ask

How do I authenticate API requests?+

Send your API key as a bearer token in the Authorization header. Keys are scoped per workspace and can be rotated or revoked at any time.

Are there rate limits?+

Requests are rate limited per workspace to protect deliverability. Standard limits suit high-volume messaging; contact us if you need them raised.

How do webhooks work?+

Subscribe to events such as message.delivered, reply.received or lead.scored. We POST signed JSON payloads and retry failed deliveries with exponential backoff.

Does the API cost extra?+

No. API access, webhooks and sandbox tokens are included on every plan with no enterprise gate.