Website button & WhatsApp links
Create a website button
POST
/v2/widgets- Scope:
widgets:write - Idempotency-Key:optional
- changes settings
numberId and allowedDomains are required; settings are optional (defaults like the dashboard). The answer carries the embed snippet. Plan limits: starter 1, growth 5, business unlimited; hiding "Powered by Mursilat" needs growth+.
Parameters
Headers
| Name | Type | Constraints | Description |
|---|---|---|---|
Idempotency-Keyoptional | Typestring | Constraints≤ 191 chars | DescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with Idempotent-Replayed: true — it never runs twice. Kept 24 h. |
X-Request-Idoptional | Typestring | Constraints— | DescriptionOptional: your own request id, echoed back (otherwise we generate req_…). Quote it to support. |
Request
curl -X POST "https://mursilat.com/api/v2/widgets" \
-H "Authorization: Bearer $WASLA_API_KEY" \
-H "Idempotency-Key: order-1042-confirm" \
-H "Content-Type: application/json" \
-d '{
"name": "Main website",
"numberId": "cm1abcd2345efgh6789ijkl",
"allowedDomains": [
"example.com"
],
"settings": {
"buttonText": {
"ar": "كلمنا واتساب",
"en": "Chat with us"
},
"attribution": {
"enabled": true,
"label": "ref",
"position": "end"
}
}
}'const res = await fetch('https://mursilat.com/api/v2/widgets', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
'Idempotency-Key': 'order-1042-confirm',
'Content-Type': 'application/json',
},
body: JSON.stringify({
"name": "Main website",
"numberId": "cm1abcd2345efgh6789ijkl",
"allowedDomains": [
"example.com"
],
"settings": {
"buttonText": {
"ar": "كلمنا واتساب",
"en": "Chat with us"
},
"attribution": {
"enabled": true,
"label": "ref",
"position": "end"
}
}
}),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);import os
import requests
headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}", "Idempotency-Key": "order-1042-confirm"}
res = requests.post(
"https://mursilat.com/api/v2/widgets",
headers=headers,
json={
"name": "Main website",
"numberId": "cm1abcd2345efgh6789ijkl",
"allowedDomains": [
"example.com"
],
"settings": {
"buttonText": {
"ar": "كلمنا واتساب",
"en": "Chat with us"
},
"attribution": {
"enabled": True,
"label": "ref",
"position": "end"
}
}
},
timeout=30,
)
data = res.json()
if not res.ok:
raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)<?php
$ch = curl_init('https://mursilat.com/api/v2/widgets');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
'Idempotency-Key: order-1042-confirm',
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode([
'name' => 'Main website',
'numberId' => 'cm1abcd2345efgh6789ijkl',
'allowedDomains' => [
'example.com'
],
'settings' => [
'buttonText' => [
'ar' => 'كلمنا واتساب',
'en' => 'Chat with us'
],
'attribution' => [
'enabled' => true,
'label' => 'ref',
'position' => 'end'
]
]
], JSON_UNESCAPED_UNICODE),
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);{
"name": "Main website",
"numberId": "cm1abcd2345efgh6789ijkl",
"allowedDomains": [
"example.com"
],
"settings": {
"buttonText": {
"ar": "كلمنا واتساب",
"en": "Chat with us"
},
"attribution": {
"enabled": true,
"label": "ref",
"position": "end"
}
}
}Response
201Example
{
"id": "wgt_k2m7q4x9a3b5c8d2",
"name": "Main website",
"enabled": true,
"numberId": "cm1abcd2345efgh6789ijkl",
"number": {
"name": "فرع المعادي",
"phone": "201001234567"
},
"allowedDomains": [
"example.com",
"*.example.com"
],
"settings": {
"position": "end",
"color": "#25D366",
"buttonText": {
"ar": "كلمنا واتساب",
"en": "Chat with us"
},
"icon": "whatsapp",
"greeting": {
"enabled": true,
"title": {
"ar": "أهلاً 👋",
"en": "Hi 👋"
},
"text": {
"ar": "محتاج مساعدة؟",
"en": "Need help?"
},
"avatar": {
"type": "initial",
"initial": ""
}
},
"agents": [],
"message": {
"ar": "عندي سؤال عن {page_title}",
"en": "Question about {page_title}"
},
"attribution": {
"enabled": true,
"label": "ref",
"position": "end"
},
"branding": {
"show": true
},
"impressions": {
"enabled": false
}
},
"snippet": "<script async src=\"https://mursilat.com/w/v1.js\" data-widget=\"wgt_k2m7q4x9a3b5c8d2\"></script>",
"stats7d": {
"clicks": 120,
"conversations": 31
},
"createdAt": "2026-10-14T09:00:00.000Z",
"updatedAt": "2026-10-14T09:00:00.000Z"
}Response schema
Fields of the example answer. Expand objects and arrays.
responseobject11 fields
- idstring "wgt_k2m7q4x9a3b5c8d2"
- namestring "Main website"
- enabledboolean true
- numberIdstring "cm1abcd2345efgh6789ijkl"
numberobject2 fields
- namestring "فرع المعادي"
- phonestring "201001234567"
allowedDomainsarray2 items
- [0]string "example.com"
settingsobject10 fields
- positionstring "end"
- colorstring "#25D366"
buttonTextobject2 fields
- arstring "كلمنا واتساب"
- enstring "Chat with us"
- iconstring "whatsapp"
greetingobject4 fields
- enabledboolean true
titleobject2 fields
- arstring "أهلاً 👋"
- enstring "Hi 👋"
textobject2 fields
- arstring "محتاج مساعدة؟"
- enstring "Need help?"
avatarobject2 fields
- typestring "initial"
- initialstring ""
- agentsarray []
messageobject2 fields
- arstring "عندي سؤال عن {page_title}"
- enstring "Question about {page_title}"
attributionobject3 fields
- enabledboolean true
- labelstring "ref"
- positionstring "end"
brandingobject1 fields
- showboolean true
impressionsobject1 fields
- enabledboolean false
- snippetstring "<script async src=\"https://mursilat.com/w/v1.js\" data-widget=\"wgt_k2m7q4x…"
stats7dobject2 fields
- clicksinteger 120
- conversationsinteger 31
- createdAtstring "2026-10-14T09:00:00.000Z"
- updatedAtstring "2026-10-14T09:00:00.000Z"
Errors
Besides the authentication, rate-limit and validation errors every endpoint can return:
- 403WIDGET_LIMIT_REACHEDYour plan allows no more website buttons.
- 400WIDGET_DOMAINS_REQUIREDAt least one allowed website domain is required.
- 400WIDGET_DOMAIN_INVALIDAn allowed domain is not a valid website domain.
- 400WIDGET_DOMAINS_TOO_MANYToo many allowed domains (max 20).
- 400WIDGET_NUMBER_INVALIDnumberId (or an agent numberId) is not one of your numbers.
- 400WIDGET_NUMBER_NO_PHONEThe number was never linked: its phone is unknown.
- 400WIDGET_SETTINGS_INVALIDA widget setting is invalid (details.field, details.reason).
- 403WIDGET_BRANDING_LOCKEDHiding "Powered by Mursilat" needs the Growth plan or higher.
- 400WIDGET_NAME_INVALIDName is required (1–80 characters).
- 403NUMBER_NOT_ALLOWEDThe key is restricted to other numbers.
Try it
Send this request from your browser to the Mursilat API.
documented examplePreview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.
Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (changes settings)
Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.
curl -X POST 'https://mursilat.com/api/v2/widgets' \
-H "Authorization: Bearer $WASLA_API_KEY" \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-d '{"name":"Main website","numberId":"cm1abcd2345efgh6789ijkl","allowedDomains":["example.com"],"settings":{"buttonText":{"ar":"كلمنا واتساب","en":"Chat with us"},"attribution":{"enabled":true,"label":"ref","position":"end"}}}'