Messages

Send a file (multipart)

POST/v2/messages

Scope:messages:send
Idempotency-Key:required
number key ok— Also accepts the legacy per-number x-api-key, for its own number.
sends messages

Same fields as JSON plus a file part. Bytes are sniffed; the name is never trusted.

Parameters

Headers

Name	Type	Constraints	Description
`Idempotency-Key`required	Type`string`	Constraints≤ 191 chars	DescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with `Idempotent-Replayed: true` — it never runs twice. Kept 24 h.
`X-Request-Id`optional	Type`string`	Constraints—	DescriptionOptional: your own request id, echoed back (otherwise we generate `req_…`). Quote it to support.

multipart/form-data fields

Name	Type	Constraints	Description
`numberId`optional	Type`string`	Constraints—	DescriptionNumber to act on (id from `GET /v2/numbers`). A key restricted to some numbers can use only those.
`to`optional	Type`string`	Constraints—	DescriptionRecipient: international digits without `+` or leading zeros (e.g. `201001234567`, `966501234567`).
`type`optional	Type`string`	Constraints—	DescriptionMessage type: `text`, `image`, `video`, `audio`, `voice`, `document`, `sticker`, `location`, `contact`, `poll`, `event`, `buttons`, `list`, `cta_url`. Each type has its own fields — see the table below.
`caption`optional	Type`string`	Constraints—	DescriptionCaption under an image, video or document (≤ 1024).
`file`optional	Type`file`	Constraints—	DescriptionThe file bytes (multipart). The real type is sniffed from the bytes; the file name is never trusted.

Request

POST /v2/messages

curl -X POST "https://mursilat.com/api/v2/messages" \
  -H "Authorization: Bearer $WASLA_API_KEY" \
  -H "Idempotency-Key: order-1042-confirm" \
  -F numberId="cm1abcd2345efgh6789ijkl" \
  -F to="201001234567" \
  -F type="document" \
  -F caption="فاتورتك" \
  -F file=@invoice-1042.pdf

import fs from 'node:fs';

const form = new FormData();
form.append('numberId', "cm1abcd2345efgh6789ijkl");
form.append('to', "201001234567");
form.append('type', "document");
form.append('caption', "فاتورتك");
form.append('file', new Blob([fs.readFileSync('invoice-1042.pdf')]), 'invoice-1042.pdf');

const res = await fetch('https://mursilat.com/api/v2/messages', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
    'Idempotency-Key': 'order-1042-confirm',
  },
  body: form,
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}", "Idempotency-Key": "order-1042-confirm"}
res = requests.post(
    "https://mursilat.com/api/v2/messages",
    headers=headers,
    data={
        "numberId": "cm1abcd2345efgh6789ijkl",
        "to": "201001234567",
        "type": "document",
        "caption": "فاتورتك"
    },
    files={"file": open("invoice-1042.pdf", "rb")},
    timeout=30,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)

<?php
$ch = curl_init('https://mursilat.com/api/v2/messages');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
        'Idempotency-Key: order-1042-confirm',
    ],
    CURLOPT_POSTFIELDS => [
        'numberId' => 'cm1abcd2345efgh6789ijkl',
        'to' => '201001234567',
        'type' => 'document',
        'caption' => 'فاتورتك',
        'file' => new CURLFile('invoice-1042.pdf')
    ],
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);

Response

200Example

200 — application/json

{
  "id": "3EB0A1B2C3D4E5F60718",
  "numberId": "cm1abcd2345efgh6789ijkl",
  "status": "sent",
  "type": "document",
  "reference": "order-1042",
  "scheduledAt": null,
  "interactionId": null,
  "format": null,
  "fallbackIncluded": null,
  "estimatedDelayMs": null
}

Response schema

Fields of the example answer. Expand objects and arrays.

responseobject10 fields
- idstring "3EB0A1B2C3D4E5F60718"
- numberIdstring "cm1abcd2345efgh6789ijkl"
- statusstring "sent"
- typestring "document"
- referencestring "order-1042"
- scheduledAtnull null
- interactionIdnull null
- formatnull null
- fallbackIncludednull null
- estimatedDelayMsnull null

Errors

Besides the authentication, rate-limit and validation errors every endpoint can return:

413MESSAGE_MEDIA_TOO_LARGEFile over the type limit.
415MESSAGE_MEDIA_TYPE_NOT_ALLOWEDThe bytes do not match the type.

Errors →

Number Shield & behaviour

Queued: when the number is busy or a short gap is due, the answer is still 200 with status: "queued" and estimatedDelayMs; the message leaves on its own and message.status follows.

Paced / capped: messages to new contacts are spaced and capped by the warm-up stage — 429 SAFETY_PACING, SAFETY_HOURLY_CAP_REACHED or SAFETY_DAILY_CAP_REACHED with details.retryAt.

Refused: opted-out recipients (422 SAFETY_SUPPRESSED), blocked content such as shorteners or links from young numbers (422 SAFETY_CONTENT_BLOCKED), a paused number (423 SAFETY_NUMBER_PAUSED; replies to people who wrote in the last 24 h still go out). Don’t retry these unchanged.

Try it

Send this request from your browser to the Mursilat API.

documented example

Preview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.

Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (sends messages)

API key

Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.

Idempotency-Key *

multipart/form-data → curl