Numbers

Set the webhook of a number

PUT/v2/numbers/{numberId}/webhook

Scope:webhooks:write
Idempotency-Key:optional
changes settings

Public https URL only (private addresses refused). The signing secret is returned once.

Parameters

Path

Name	Type	Constraints	Description
`numberId`required	Type`string`	Constraints—	DescriptionNumber id (GET /v2/numbers).

Headers

Name	Type	Constraints	Description
`Idempotency-Key`optional	Type`string`	Constraints≤ 191 chars	DescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with `Idempotent-Replayed: true` — it never runs twice. Kept 24 h.
`X-Request-Id`optional	Type`string`	Constraints—	DescriptionOptional: your own request id, echoed back (otherwise we generate `req_…`). Quote it to support.

Body

Name	Type	Constraints	Description
`url`required	Type`string`	Constraints—	DescriptionPublic `https://` URL on port 443 (or 80). Private / internal addresses are refused and redirects are never followed.
`events`optional	Type`string[]`	Constraints—	DescriptionEvent types to receive. Omit (or `null`) for all events — new event types are then delivered automatically.
`version`optional	Type`integer`	Constraintsone of: 2default 2	DescriptionWebhook payload version. Only `2` is accepted on v2.

Request

PUT /v2/numbers/{numberId}/webhook

curl -X PUT "https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/webhook" \
  -H "Authorization: Bearer $WASLA_API_KEY" \
  -H "Idempotency-Key: order-1042-confirm" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com/mursilat",
  "events": [
    "message.received",
    "message.status",
    "interactive.reply"
  ]
}'

const res = await fetch('https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/webhook', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
    'Idempotency-Key': 'order-1042-confirm',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "url": "https://example.com/mursilat",
    "events": [
      "message.received",
      "message.status",
      "interactive.reply"
    ]
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}", "Idempotency-Key": "order-1042-confirm"}
res = requests.put(
    "https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/webhook",
    headers=headers,
    json={
        "url": "https://example.com/mursilat",
        "events": [
            "message.received",
            "message.status",
            "interactive.reply"
        ]
    },
    timeout=30,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)

<?php
$ch = curl_init('https://mursilat.com/api/v2/numbers/cm1abcd2345efgh6789ijkl/webhook');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
        'Idempotency-Key: order-1042-confirm',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'url' => 'https://example.com/mursilat',
        'events' => [
            'message.received',
            'message.status',
            'interactive.reply'
        ]
    ], JSON_UNESCAPED_UNICODE),
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);

Request — JSON

{
  "url": "https://example.com/mursilat",
  "events": [
    "message.received",
    "message.status",
    "interactive.reply"
  ]
}

Response

200Example

200 — application/json

{
  "url": "https://example.com/mursilat",
  "version": 2,
  "events": [
    "message.received",
    "message.status",
    "interactive.reply"
  ],
  "availableEvents": [
    "message.received",
    "message.status",
    "interactive.reply",
    "poll.vote",
    "contact.opted_out",
    "contact.opted_in",
    "session.status",
    "number.status",
    "number.restricted",
    "campaign.status",
    "otp.verified",
    "conversation.attributed"
  ],
  "secretConfigured": true,
  "disabledAt": null,
  "disabledReason": null,
  "secret": "whsec_…(shown once)"
}

Response schema

Fields of the example answer. Expand objects and arrays.

responseobject8 fields
- urlstring "https://example.com/mursilat"
- versioninteger 2
- eventsarray3 items
  - [0]string "message.received"
- availableEventsarray12 items
  - [0]string "message.received"
- secretConfiguredboolean true
- disabledAtnull null
- disabledReasonnull null
- secretstring "whsec_…(shown once)"

Errors

Besides the authentication, rate-limit and validation errors every endpoint can return:

400URL_PRIVATE_ADDRESSURL points to a private / internal address.
400URL_PORT_NOT_ALLOWEDOnly ports 443 / 80.
403WEBHOOKS_NOT_IN_PLANYour plan does not include webhooks.
400WEBHOOK_EVENTS_INVALIDUnknown event type.

Errors →

Try it

Send this request from your browser to the Mursilat API.

documented example

Preview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.

Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (changes settings)

API key

Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.

Path parameters

numberId

Idempotency-Key

Body (JSON)