Developers / API Documentation
Enterprise API access with workspace-scoped authentication, HMAC-SHA256 signature verification, and automated retry mechanisms.
API Features
RESTful Outbound Messaging (`POST /v1/messages`)
Programmatically dispatch Meta-approved WhatsApp template messages or free-form replies (inside 24h window) with JSON payload validation.
Real-Time Webhook Engine (`POST /webhooks/receive`)
Subscribe to inbound message events (`messages`), message status updates (`delivered`, `read`), and template status updates (`approved`, `rejected`).
HMAC Signature Verification
Verify every incoming webhook event using SHA-256 HMAC signature headers (`X-Convoup-Signature`) to guarantee authenticity.
Contact & Segment Synchronization (`GET /v1/contacts`)
Programmatically query, create, update, or tag contact CRM records and retrieve historical message audit logs.
Tenant-Scoped Security
Bearer token authorization scoped strictly to your workspace ID with automatic rate limiting following Meta Cloud API guidelines.
Idempotent Operations (`X-Idempotency-Key`)
Pass unique idempotency headers on POST requests to safely prevent duplicate outbound message dispatch during network retries.
Embedded Signup & WABA Disconnect Handlers
Receive automated notifications when WABA permissions change or when a customer revokes Embedded Signup access.
Audit Logging & Compliance
Query historical API activity logs for compliance verification and enterprise system audits.
Dedicated engineering support available for API onboarding via [email protected].
Convoup REST API proxies Meta Cloud API requests while maintaining tenant isolation. API rate limits mirror Meta WABA tiering rules.