Skip to main content

Base URL

All public endpoints are prefixed with /api/v1/. Examples:

Authentication

All requests to /api/v1/* require a MsgFlash API key in the x-api-key header.
See Authentication for exact header format and security requirements.

Team workspace (msgf_team_…)

Team API keys require X-Team-Id matching the key’s team; workspace /api/v1/* routes then use the team’s shared data and the team owner’s plan. Personal keys must not send X-Team-Id (TEAM_KEY_REQUIRED). Account, compact usage, and most billing reads require a personal key (TEAM_KEY_NOT_ALLOWED with a team key). Full rules: Team context.

Rate limiting

If the limit is exceeded:
The real-time rate limit is separate from the monthly monthlyApiRequestQuota. You can stay under your monthly quota and still receive 429 if you exceed 10 req/s.

Response format

Success

All successful responses are wrapped in data.
For simple lists:
For paginated lists:

Error

See Error codes for the main codes.

Available endpoints

Messages

Campaigns

Templates

Contacts

Contact groups

Webhooks

WhatsApp statuses

Instances

Billing public read-only