Skip to content

    Arabic or English · ↑↓ to move · Enter to open · Esc to close

    العربية
    On this page

    Messages

    Send a message (any type)

    POST/v2/messages
    • Scope:messages:send
    • Idempotency-Key:required
    • number key ok— Also accepts the legacy per-number x-api-key, for its own number.
    • sends messages

    Types: text, image, video (GIF / round video note), audio, voice, document, sticker, location, contact, poll, event, buttons, list, cta_url. Scheduling (scheduleAt) is available on request — see Schedule a message.

    Parameters

    Headers

    NameTypeConstraintsDescription
    Idempotency-KeyrequiredTypestringConstraints≤ 191 charsDescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with Idempotent-Replayed: true — it never runs twice. Kept 24 h.
    X-Request-IdoptionalTypestringConstraints—DescriptionOptional: your own request id, echoed back (otherwise we generate req_…). Quote it to support.

    Body

    NameTypeConstraintsDescription
    numberIdrequiredTypestringConstraints—DescriptionNumber to act on (id from GET /v2/numbers). A key restricted to some numbers can use only those.
    torequiredTypestringConstraints—DescriptionRecipient: international digits without + or leading zeros (e.g. 201001234567, 966501234567).
    typerequiredTypestringConstraints—DescriptionMessage type: text, image, video, audio, voice, document, sticker, location, contact, poll, event, buttons, list, cta_url. Each type has its own fields — see the table below.
    textoptionalTypestringConstraints—DescriptionMessage text. WhatsApp formatting passes through (*bold*, _italic_, ~strike~).
    referenceoptionalTypestringConstraints≤ 128 charsDescriptionYour own id (order number, ticket…). Echoed in message.status / interactive.reply webhooks and filterable in GET /v2/messages.
    scheduleAtoptionalTypestring (date-time)Constraints—DescriptionISO 8601 time 1 minute – 30 days ahead. Available on request (otherwise 422 SCHEDULING_DISABLED).

    Message types

    typeFieldsNotes
    textFieldstext (1–4096), linkPreviewNotesWhatsApp formatting passes through. A preview of the first https link is built safely when possible.
    imageFieldsmedia, caption ≤ 1024, viewOnceNotesJPEG · PNG · WebP, ≤ 5 MB.
    videoFieldsmedia, caption, viewOnce, gif, videoNoteNotesMP4 · 3GPP, ≤ 16 MB. videoNote: round, ≤ 60 s, no caption.
    audioFieldsmediaNotesOGG · MP3 · M4A · AAC · AMR, ≤ 16 MB. Shown as an audio file.
    voiceFieldsmedia, viewOnceNotesShown as a voice note (OGG/Opus keeps the waveform).
    documentFieldsmedia, fileName ≤ 120, captionNotesAny file except programs, ≤ 100 MB.
    stickerFieldsmediaNotesWebP ≤ 500 KB as is; PNG / JPG / GIF ≤ 5 MB are converted.
    locationFieldslatitude, longitude, name ≤ 100, address ≤ 200NotesA static pin (live location isn’t possible from a linked number).
    contactFieldscontacts[] 1–5: name, phones[] 1–3, email, organizationNotesThe vCard is built on the server.
    pollFieldsname ≤ 255, options[] 2–12, selectableCountNotesVotes arrive as poll.vote webhooks.
    eventFieldsname, startAt, endAt, description, locationNameNotesExperimental: some phones show 1:1 events as unsupported.
    buttonsFieldsbody.text, buttons[] 1–3, header, footer, fallbackNotesNumbered fallback by default; answers arrive as interactive.reply.
    listFieldsbody.text, list.buttonText, list.sections[] (≤ 10 rows)NotesA menu button that opens the rows.
    cta_urlFieldsbody.text, cta.title ≤ 20, cta.urlNotesOne link button; link rules apply to the URL.

    Request

    curl -X POST "https://mursilat.com/api/v2/messages" \
      -H "Authorization: Bearer $WASLA_API_KEY" \
      -H "Idempotency-Key: order-1042-confirm" \
      -H "Content-Type: application/json" \
      -d '{
      "numberId": "cm1abcd2345efgh6789ijkl",
      "to": "201001234567",
      "type": "text",
      "text": "طلبك اتشحن 🚚 *شكرًا*",
      "reference": "order-1042"
    }'
    Request — JSON
    {
      "numberId": "cm1abcd2345efgh6789ijkl",
      "to": "201001234567",
      "type": "text",
      "text": "طلبك اتشحن 🚚 *شكرًا*",
      "reference": "order-1042"
    }

    Response

    200Example

    200 — application/json
    {
      "id": "3EB0A1B2C3D4E5F60718",
      "numberId": "cm1abcd2345efgh6789ijkl",
      "status": "sent",
      "type": "text",
      "reference": "order-1042",
      "scheduledAt": null,
      "interactionId": null,
      "format": null,
      "fallbackIncluded": null,
      "estimatedDelayMs": null
    }

    Response schema

    Fields of the example answer. Expand objects and arrays.

    • responseobject10 fields
      • idstring "3EB0A1B2C3D4E5F60718"
      • numberIdstring "cm1abcd2345efgh6789ijkl"
      • statusstring "sent"
      • typestring "text"
      • referencestring "order-1042"
      • scheduledAtnull null
      • interactionIdnull null
      • formatnull null
      • fallbackIncludednull null
      • estimatedDelayMsnull null

    Errors

    Besides the authentication, rate-limit and validation errors every endpoint can return:

    Errors →

    Number Shield & behaviour

    Under load the answer is still 200 with status "queued" and estimatedDelayMs.

    Buttons may show as plain text on some phones; the numbered fallback means customers can always answer.

    Queued: when the number is busy or a short gap is due, the answer is still 200 with status: "queued" and estimatedDelayMs; the message leaves on its own and message.status follows.

    Paced / capped: messages to new contacts are spaced and capped by the warm-up stage — 429 SAFETY_PACING, SAFETY_HOURLY_CAP_REACHED or SAFETY_DAILY_CAP_REACHED with details.retryAt.

    Refused: opted-out recipients (422 SAFETY_SUPPRESSED), blocked content such as shorteners or links from young numbers (422 SAFETY_CONTENT_BLOCKED), a paused number (423 SAFETY_NUMBER_PAUSED; replies to people who wrote in the last 24 h still go out). Don’t retry these unchanged.

    Try it

    Send this request from your browser to the Mursilat API.

    documented example

    Preview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.

    Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (sends messages)

    Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.

    Send this request for real?

    This will send a real WhatsApp message (or campaign / code) from your number and use your plan quota.

    POST /v2/messages