API reference

Webhooks

HTTPS callbacks for message and campaign events. Verify every delivery with HMAC-SHA256 so only ActiWAPI can call your URL.

Register a public HTTPS URL, choose events, and store the secret returned once on create. ActiWAPI retries failed deliveries. Use Socket.io for the dashboard; use webhooks for your backend.

Verify X-Webhook-Signature

Compute HMAC-SHA256 over the raw request body using the webhook secret, hex digest. Compare to the X-Webhook-Signature header with a constant-time equals. Return 2xx quickly; do heavy work asynchronously.

  • Canonical events: message_received, message_sent, message_delivered, message_read, message_failed, campaign_progress.
  • Dotted aliases such as message.received are accepted when you subscribe but payloads use underscores.
  • POST /api/webhooks/{id}/test sends a sample payload so you can debug your receiver.
GET/api/webhooks/events

List event types

Public list of webhook event types you can subscribe to.

URL: https://api.actiwapi.com/api/webhooks/events

Auth: None

Code examples

curl -X GET "https://api.actiwapi.com/api/webhooks/events" \
  -H "Content-Type: application/json"

Response example200

{
  "success": true,
  "data": [
    "message_received",
    "message_sent",
    "message_delivered",
    "message_read",
    "message_failed",
    "campaign_progress"
  ]
}

Try in Swagger UI

GET/api/webhooks

List webhooks

List configured webhook endpoints.

URL: https://api.actiwapi.com/api/webhooks

Auth: JWT Bearer

Headers

HeaderValueRequired
AuthorizationBearer {accessToken}Yes
Content-Typeapplication/jsonYes*

Code examples

curl -X GET "https://api.actiwapi.com/api/webhooks" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {accessToken}"

Response example200

{
  "success": true,
  "data": [{
    "id": "uuid",
    "url": "https://api.yourapp.com/webhooks/actiwapi",
    "events": ["message_received"],
    "isActive": true
  }]
}

Try in Swagger UI

POST/api/webhooks

Create webhook

Register a new webhook subscription. Requires a connected WhatsApp session. Secret is returned once on create.

URL: https://api.actiwapi.com/api/webhooks

Auth: JWT Bearer

Headers

HeaderValueRequired
AuthorizationBearer {accessToken}Yes
Content-Typeapplication/jsonYes*

Request example

{
  "name": "Production",
  "url": "https://api.yourapp.com/webhooks/actiwapi",
  "events": ["message_received", "message_sent"]
}

Code examples

curl -X POST "https://api.actiwapi.com/api/webhooks" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {accessToken}"
  -d '{  "name": "Production",  "url": "https://api.yourapp.com/webhooks/actiwapi",  "events": ["message_received", "message_sent"]}'

Response example201

{ "success": true, "data": { "id": "uuid", "isActive": true, "secret": "hex-secret" } }

Try in Swagger UI

GET/api/webhooks/{id}/history

Delivery history

View delivery attempts and HTTP response codes.

URL: https://api.actiwapi.com/api/webhooks/{id}/history

Auth: JWT Bearer

Headers

HeaderValueRequired
AuthorizationBearer {accessToken}Yes
Content-Typeapplication/jsonYes*

Path parameters

  • id — Webhook UUID

Code examples

curl -X GET "https://api.actiwapi.com/api/webhooks/{id}/history" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {accessToken}"

Response example200

{
  "success": true,
  "data": [{
    "eventType": "message_received",
    "status": "success",
    "responseStatus": 200,
    "deliveredAt": "2026-05-30T10:00:00.000Z"
  }]
}

Try in Swagger UI

POST/api/webhooks/{id}/test

Send a test event

Push a sample payload to your URL so you can verify signature handling.

URL: https://api.actiwapi.com/api/webhooks/{id}/test

Auth: JWT Bearer

Headers

HeaderValueRequired
AuthorizationBearer {accessToken}Yes
Content-Typeapplication/jsonYes*

Path parameters

  • id — Webhook UUID

Code examples

curl -X POST "https://api.actiwapi.com/api/webhooks/{id}/test" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {accessToken}"

Response example200

{ "success": true, "data": { "delivered": true, "responseStatus": 200 } }

Try in Swagger UI

POST/api/webhooks/{id}/deliveries/{deliveryId}/retry

Retry a delivery

Re-send a failed delivery.

URL: https://api.actiwapi.com/api/webhooks/{id}/deliveries/{deliveryId}/retry

Auth: JWT Bearer

Headers

HeaderValueRequired
AuthorizationBearer {accessToken}Yes
Content-Typeapplication/jsonYes*

Path parameters

  • id — Webhook UUID
  • deliveryId — Delivery UUID

Code examples

curl -X POST "https://api.actiwapi.com/api/webhooks/{id}/deliveries/{deliveryId}/retry" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {accessToken}"

Response example200

{ "success": true, "data": { "status": "success" } }

Try in Swagger UI

POSTyour-endpoint-url

Delivery payload shape

ActiWAPI POSTs this JSON to your URL. Verify X-Webhook-Signature = HMAC-SHA256(rawBody, secret).

URL: https://api.yourapp.com/webhooks/actiwapi

Auth: None

Request example

{
  "event": "message_received",
  "timestamp": "2026-07-17T18:05:00.000Z",
  "data": {
    "sessionId": "uuid",
    "from": "+919876543210",
    "content": "Hello",
    "messageId": "whatsapp-external-id",
    "mediaUrl": null
  }
}

Code examples

curl -X POST "https://api.yourapp.com/webhooks/actiwapi" \
  -H "Content-Type: application/json"
  -d '{  "event": "message_received",  "timestamp": "2026-07-17T18:05:00.000Z",  "data": {    "sessionId": "uuid",    "from": "+919876543210",    "content": "Hello",    "messageId": "whatsapp-external-id",    "mediaUrl": null  }}'

Response example200

{ "ok": true }

Try in Swagger UI

Error codes

Failed requests return a JSON envelope with success: false and a human-readable message.

{
  "success": false,
  "message": "Validation failed",
  "errors": {
    "phone": "Valid phone number is required"
  }
}
HTTPCodeDescription
400VALIDATION_ERRORRequest body or query failed validation.
401UNAUTHORIZEDMissing or invalid JWT / API key.
403FORBIDDENAuthenticated but lacking permission or entitlement.
403SUBSCRIPTION_INACTIVEAction not allowed on the current plan (including Free after trial). Upgrade or wait for entitlements.
403LIMIT_EXCEEDEDPlan limit reached (sessions, messages, API requests, etc.).
404NOT_FOUNDResource does not exist or is not in your account.
409CONFLICTDuplicate resource or invalid state transition.
429RATE_LIMITEDToo many requests; retry after backoff.
500INTERNAL_ERRORUnexpected server error.
502WHATSAPP_UNAVAILABLEWhatsApp session disconnected or provider error.