Same bearer auth. A submitted template must be Meta-approved (minutes to a day) before it can be used in a type: "template" send. GET /api/v1/templates/:id returns the full definition of one template.

GET /api/v1/messages/:id/status (delivery status by the Hub-assigned id, not Meta's wamid.*), GET /api/v1/conversations and GET /api/v1/conversations/:id/messages (both accept ?limit=), GET /api/v1/contacts?q= or ?phone=, GET /api/v1/account (WABA connection status and quality rating), and GET /api/v1/account/rate-limit.

Every error comes back in one shape: { "error": { "code": "...", "message": "...", ... } } — a stable code to branch on, plus endpoint-specific extra fields (e.g. metaError when Meta itself rejected something, details for validation failures). Check error.code before assuming error.metaError is present.

Once your WhatsApp account is connected, Wasi can forward inbound events to a URL of your choosing — contact support to have it set up. Deliveries are signed x-wasi-signature-256: sha256=<hmac> (HMAC-SHA256 of the raw JSON body, keyed by a per-client secret) — verify this before trusting a delivery. Event types: message.received, message_template_status_update, account_update.

The Hub API is capped at 300 requests/minute, currently scoped per source IP. Every response carries live X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset headers so you can self-throttle before hitting the limit.

• Never commit an API key or webhook secret to source control — load them from environment variables.
• If a key is compromised, delete it above and issue a new one — deletion takes effect immediately.
• Always verify the x-wasi-signature-256 header before acting on a forwarded webhook payload.
• client_id is a UUID, not a secret — but still avoid logging your API key or webhook secret.

Start with GET /api/v1/templates to confirm auth works before attempting a send, then send a type: "text" message to your own test number inside an active 24-hour window before wiring up template sends. Ready-to-import Postman collection (placeholder values, no real credentials): Wasi-Hub-API.postman_collection.json  ·  Wasi-Hub-API.postman_environment.json