REST API v1 · Changelog
API changelog
What changed in the v1 API, and when. Newest first.
API reference · Changelog
Built from the history of the API’s code; it starts in June 2026. Product changes outside the API are in the release notes.
- New: POST /sandbox/inbound, in a developer sandbox only (404 anywhere else), makes a simulated customer write to your sandbox number; a sandbox can use the API and webhooks without a paid plan.
- Every write takes an Idempotency-Key: webhooks, secret rotation, test and redelivery, payment voids, invoice and booking actions, leads, bulk tags, Instagram, template sync, integrations, edits and deletes.
- A customer who answers “No, thanks” to a consent question is opted out, and an API write never reverses it.
- Every answer, success or 429, carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (Retry-After is kept).
- API keys can be narrowed to scopes and to IP addresses; a key without the scope an endpoint needs gets 403 insufficient_scope.
- A key below admin can be given webhooks:manage, for Zapier, Make and Pabbly triggers; it subscribes only to events it may read and manages only the endpoints it registered.
- Writes have a body size limit, and when a workspace has more than one key each key may use at most half of a rate-limit bucket.
- Idempotency keys are kept per API key, and a request that never finished frees its key after two minutes.
- New: GET /openapi.json, an OpenAPI document of every endpoint with its scope and lowest role, and the webhook events. No key needed.
- The OpenAPI document shows the request bodies of the send, webhook, inbox, CRM, WhatsApp Pay and Instagram writes.
- The OpenAPI document shows the bodies of POST /broadcasts, /templates, /contacts and PATCH /contacts/{id}.
- New: GET /webhooks/{id}/deliveries, POST /webhooks/{id}/test and POST /webhooks/deliveries/{id}/redeliver.
- New: GET and DELETE /templates/{id}, and POST /templates/sync to sync templates from Meta.
- New: segments (GET, POST /segments; GET, PATCH, DELETE /segments/{id}); a broadcast can name one by segmentId; GET /broadcasts/{id}/recipients and POST /broadcasts/preview.
- New: GET /automations, /auto-replies and /bots, switching each on or off with PATCH, and POST /flows/{id}/send to send a WhatsApp form.
- New: GET /team, and quick replies can be created, changed and removed.
- New: GET /billing, GET /wallet and GET /costs, read only, for admin keys.
- New: POST /contacts/bulk, POST /contacts/bulk-tags, POST /contacts/{id}/block and /unblock, GET /tags and GET /contact-fields.
- New webhook events contact.updated and contact.deleted; contact.created also fires for contacts made through the API.
- New: POST /conversations/{id}/read marks a chat read, POST /conversations starts one with a template, and GET /messages/{id}/media gives a message’s file as a five-minute download link.
- New: GET /integrations and GET /integrations/{key}, POST /integrations/{key}/sync, PATCH /integrations/{key}/settings and DELETE /integrations/{key}.
- Facebook Lead Ads is its own entry in GET /integrations, with its Pages, forms, last lead and errors.
- New: GET and PATCH /integrations/{key}/messages for a store’s WhatsApp messages.
- New: invoices, proformas and quotations can be made, issued, sent, paid and cancelled (POST /sales-invoices and its actions). Admin keys.
- New: GET and POST /bookings, POST /bookings/{id}/reschedule and /cancel.
- New: invoice drafts, conversion, quotation bills and voided payments; a booking’s outcome; booking services and staff; both modules’ settings.
- POST /media takes 4 uploads per workspace at once; more answers 429 uploads_in_progress.
- POST /media takes files up to 16 MB again.
- A workspace without the Instagram add-on gets 402 instagram_addon_required from the Instagram endpoints, with an offer saying what the owner can buy.
- A revoked key’s webhooks stop with it, and a teammate who leaves or moves to a lower role has their keys revoked.
- An admin key narrowed to scopes is held to them on every webhook endpoint.
- A send-only key looking up a chat no longer sees the contact’s number and name.
- New: GET /sales-invoices and GET /bookings/{id}; invoice, quotation and booking events are sent once, from the change itself.
- Contacts carry their WhatsApp user id and username, and can be fetched by their wa: key.
- You can answer a customer WhatsApp shares no phone number for.
- A send from a number Meta is refusing answers 409 number_banned or sending_blocked at once, instead of being queued.
- New: GET /me, GET /webhooks/events and GET /webhooks/samples/{event}; a webhook can subscribe to a single event, for Zapier, Make and Pabbly.
- A bare 10-digit number finds the contact or lead stored with your workspace’s country code; GET /contacts?phone= is an exact match.
- DELETE /webhooks/{id} on an endpoint that is already gone answers ok with deleted: false.
- New: the Instagram endpoints (messages, posts, comments, insights) and WhatsApp Pay (POST /payment-requests, GET /payment-requests/{id}).
- New: GET /phone-numbers and POST /webhooks/{id}/rotate to rotate a webhook secret.
- GET /messages/{id} accepts a wamid and GET /contacts/{id} a phone number; a bad cursor answers 400; contact and conversation lists are WhatsApp only unless you ask for ?channel=instagram.
- POST /webhooks refuses a plain http:// address and says why.
- The API and webhooks are part of the Pro plan and up.
- New: the Sales CRM endpoints (leads, lead notes, tasks and the pipeline).
- New: broadcasts, GET /analytics, reading and updating a conversation and its notes, and reading flows and quick replies.
- New: GET /invoices and GET /invoices/{id}, the invoices Fliok issues to you.
- Template sends take a coupon code and a limited-time offer’s end.
- POST /send takes a template’s variables and its header media (headerMedia) instead of Meta’s component array, and refuses a media-header template sent without the media (400).
- A write that names an id your workspace doesn’t have answers 404 instead of success.
- New: POST /media uploads a document and returns a media id to send.