Auto-replies

Update / toggle a rule

PATCH/v2/numbers/{numberId}/auto-replies/{ruleId}

Scope:autoreplies:write
Idempotency-Key:optional
changes settings

Partial update; enabled toggles it.

Parameters

Path

Name	Type	Constraints	Description
`numberId`required	Type`string`	Constraints—	DescriptionNumber id (GET /v2/numbers).
`ruleId`required	Type`string`	Constraints—	DescriptionAuto-reply rule id.

Headers

Name	Type	Constraints	Description
`Idempotency-Key`optional	Type`string`	Constraints≤ 191 chars	DescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with `Idempotent-Replayed: true` — it never runs twice. Kept 24 h.
`X-Request-Id`optional	Type`string`	Constraints—	DescriptionOptional: your own request id, echoed back (otherwise we generate `req_…`). Quote it to support.

Body

Name	Type	Constraints	Description
`name`optional	Type`string`	Constraints≤ 120 chars	DescriptionRule name (≤ 120).
`enabled`optional	Type`boolean`	Constraintsdefault true	Description`false` keeps the rule but stops it from answering.
`trigger`optional	Type`object`	Constraints—	DescriptionWhen the rule answers.
`trigger.type`optional	Type`string`	Constraintsone of: KEYWORD · FIRST_MESSAGE · AWAY	Description`KEYWORD` (message contains / equals a keyword), `FIRST_MESSAGE` (welcome a new chat) or `AWAY` (outside the schedule).
`trigger.match`optional	Type`string`	Constraintsone of: EXACT · CONTAINS · STARTS_WITH · REGEX	Description`EXACT`, `CONTAINS`, `STARTS_WITH` (literal keywords after Arabic normalisation: أ/إ/آ → ا, ى → ي, ة → ه, diacritics removed) or `REGEX` (RE2 patterns in `trigger.patterns`). Any case is accepted (`regex`, `starts_with`); `trigger.matchType` is an alias.
`trigger.keywords`optional	Type`string[]`	Constraints≤ 50 items	DescriptionUp to 50 keywords for `EXACT` / `CONTAINS` / `STARTS_WITH` rules.
`trigger.patterns`optional	Type`string[]`	Constraints1–10 items	Description`REGEX` rules: 1–10 RE2 patterns, ≤ 200 characters each; any match fires the rule. Linear time — no lookarounds or backreferences. Captures go into the reply as `{1}`, `{2}` or `{groupName}`.
`trigger.regex`optional	Type`object`	Constraints—	Description`REGEX` options.
`trigger.regex.ignoreCase`optional	Type`boolean`	Constraintsdefault true	DescriptionCase-insensitive matching (default `true`).
`trigger.regex.normalizeArabic`optional	Type`boolean`	Constraintsdefault true	DescriptionMatch the Arabic-normalised text: أ/إ/آ → ا, ى → ي, ة → ه, tatweel and diacritics removed, Arabic digits → 0–9 (default `true`).
`trigger.regex.allowLinksInCaptures`optional	Type`boolean`	Constraintsdefault false	DescriptionKeep link-like captures (URLs, domains, wa.me / t.me) in the reply (default `false`: always removed, so a customer can’t make your number send a link of their choice).
`schedule`optional	Type`object \| null`	Constraints—	DescriptionBusiness hours (for `AWAY` rules). `null` = always.
`schedule.timezone`optional	Type`string`	Constraints—	DescriptionIANA time zone, e.g. `Africa/Cairo`, `Asia/Riyadh`.
`schedule.days`optional	Type`integer[]`	Constraints—	DescriptionWorking days, `0` = Sunday … `6` = Saturday.
`schedule.start`optional	Type`string`	Constraints—	DescriptionOpening time `HH:mm`.
`schedule.end`optional	Type`string`	Constraints—	DescriptionClosing time `HH:mm`.
`reply`optional	Type`object`	Constraints—	DescriptionWhat to answer.
`reply.text`optional	Type`string`	Constraints≤ 4096 chars	DescriptionReply text; `{name\|fallback}` inserts the customer name.
`reply.mediaUrl`optional	Type`string`	Constraints—	DescriptionOptional public `https://` file to send with the reply.
`reply.mediaType`optional	Type`string`	Constraintsone of: image · video · document · audio	DescriptionType of `reply.mediaUrl`.
`cooldownMinutes`optional	Type`integer`	Constraints≥ 0	DescriptionDo not answer the same person with this rule again for this many minutes.
`priority`optional	Type`integer`	Constraints—	DescriptionOrder when several rules match: the lowest number is checked first (default `0`).

Request

PATCH /v2/numbers/{numberId}/auto-replies/{ruleId}

curl -X PATCH "https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/auto-replies/cm3rule0001xyz" \
  -H "Authorization: Bearer $WASLA_API_KEY" \
  -H "Idempotency-Key: order-1042-confirm" \
  -H "Content-Type: application/json" \
  -d '{
  "enabled": false
}'

const res = await fetch('https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/auto-replies/cm3rule0001xyz', {
  method: 'PATCH',
  headers: {
    Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
    'Idempotency-Key': 'order-1042-confirm',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "enabled": false
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}", "Idempotency-Key": "order-1042-confirm"}
res = requests.patch(
    "https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/auto-replies/cm3rule0001xyz",
    headers=headers,
    json={
        "enabled": False
    },
    timeout=30,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)

<?php
$ch = curl_init('https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/auto-replies/cm3rule0001xyz');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
        'Idempotency-Key: order-1042-confirm',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'enabled' => false
    ], JSON_UNESCAPED_UNICODE),
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);

Request — JSON

{
  "enabled": false
}

Response

200Example

200 — application/json

{
  "id": "cm3rule0001xyz",
  "sessionId": "cm1abcd2345efgh6789ijkl",
  "scope": "number",
  "name": "الأسعار",
  "enabled": false,
  "trigger": {
    "type": "KEYWORD",
    "match": "CONTAINS",
    "keywords": [
      "سعر",
      "بكام",
      "price"
    ]
  },
  "schedule": null,
  "reply": {
    "text": "أهلاً {name|بيك} 👋 الأسعار: https://example.com/prices"
  },
  "cooldownMinutes": 60,
  "priority": 0,
  "stats": {
    "triggered": 42,
    "lastTriggeredAt": "2026-10-13T07:40:00.000Z"
  },
  "createdAt": "2026-10-01T09:00:00.000Z",
  "updatedAt": "2026-10-10T09:00:00.000Z"
}

Response schema

Fields of the example answer. Expand objects and arrays.

responseobject13 fields
- idstring "cm3rule0001xyz"
- sessionIdstring "cm1abcd2345efgh6789ijkl"
- scopestring "number"
- namestring "الأسعار"
- enabledboolean false
- triggerobject3 fields
  - typestring "KEYWORD"
  - matchstring "CONTAINS"
  - keywordsarray3 items
    [0]string "سعر"
- schedulenull null
- replyobject1 fields
  - textstring "أهلاً {name|بيك} 👋 الأسعار: https://example.com/prices"
- cooldownMinutesinteger 60
- priorityinteger 0
- statsobject2 fields
  - triggeredinteger 42
  - lastTriggeredAtstring "2026-10-13T07:40:00.000Z"
- createdAtstring "2026-10-01T09:00:00.000Z"
- updatedAtstring "2026-10-10T09:00:00.000Z"

Errors

Only the common authentication, rate-limit and validation errors.

Errors →

Try it

Send this request from your browser to the Mursilat API.

documented example

Preview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.

Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (changes settings)

API key

Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.

Path parameters

numberIdruleId

Idempotency-Key

Body (JSON)