Whapick Public API

1. Authenticate

Create a key under Settings -> API (shown once). Send it as a bearer token. Every key is bound to one business — the account is always taken from the key, never the body.

Authorization: Bearer wh_live_<prefix>_<secret>

A test key validates the full path but never dispatches or charges.

2. Scopes

3. Send a broadcast

POST /api/v1/broadcasts

curl -X POST https://whapick.com/api/v1/broadcasts \
  -H "Authorization: Bearer $WHAPICK_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "templateId": "665f1c2ab3e4d5f6a7b8c9d0",
    "recipient": { "source": "groups", "groupIds": ["665f1c2ab3e4d5f6a7b8c9d1"] },
    "variables": { "1": "Ada", "2": "20% off" },
    "externalId": "order-4821"
  }'

{
  "broadcastId": "665f1c2ab3e4d5f6a7b8c9d2",
  "status": "QUEUED",
  "totalRecipients": 412,
  "creditsReserved": 412,
  "scheduledFor": null
}

• Recipients: source is phones or groups. Numbers are normalised and de-duplicated.
• Variables: positional map, e.g. { "1": "Ada" }.
• Scheduling: pass scheduledFor (ISO-8601) to hold the send.
• Idempotency: replaying the same externalId returns the original broadcast (HTTP 200) instead of sending twice.

4. Endpoints

5. Credits & billing

Bulk sends charge 1 AI credit per dispatched message from the same pool as your chatbot usage. Credits are reserved up front for the whole list, then reconciled on completion: dispatched messages are charged, recipients skipped before any attempt are refunded. remaining = allowance - used - reserved. A send that does not fit is refused with 402 insufficient_credits, and bulk sends require a payment method on file.

6. Webhooks

Configure an endpoint under Settings -> API. We POST a signed broadcast.completed / broadcast.failed event. Verify X-Whapick-Signature (HMAC-SHA256 of the raw body, keyed by your signing secret) before trusting the payload, and treat the webhook as a notification only — GET /broadcasts/:id is authoritative.

7. Errors