Channels

Path parameters

None.

Query parameters

None.Serves a fixed document and takes no input at all.

Body parameters

None.GET requests carry no body.

Response

Status codes

curl

curl -X GET 'https://api.dev.oprag.ai/widget.js' \
  -H 'X-Oprag-Key: sk_live_...'

Before you call it

• Only served while the project is live or indexing and its widget is enabled.
• Returns displayName, welcomeMessage, and theme (primaryColor, position, and an optional mode).
• theme.mode is auto, light, or dark. auto follows the visitor's prefers-color-scheme.
• quickPrompts and the lead-capture fields appear only when those features are on, and escalationEnabled only when the project has an escalation webhook or email.

Path parameters

Query parameters

None.Reads the resource named in the path; there is nothing else to select.

Body parameters

None.GET requests carry no body.

Response

Status codes

curl

curl -X GET 'https://api.dev.oprag.ai/v1/widget/{projectId}/config' \
  -H 'X-Oprag-Key: sk_live_...'

Before you call it

• Meta calls this when you register the webhook; your code never does.
• hub.verify_token is compared against the global WHATSAPP_VERIFY_TOKEN, never a per-project value.

Path parameters

None.

Query parameters

Body parameters

None.GET requests carry no body.

Response

1234567890

Status codes

curl

curl -X GET 'https://api.dev.oprag.ai/v1/webhooks/whatsapp' \
  -H 'X-Oprag-Key: sk_live_...'

Before you call it

• Meta calls this, not your code. It needs an X-Hub-Signature-256 header — sha256= followed by an HMAC-SHA256 of the raw body under the app secret — and the raw JSON body.
• Text messages only. Deliveries are de-duplicated on Meta's message id, and phone_number_id selects which project answers.
• Answers run through the shared chat pipeline with channel: "whatsapp".
• An unmapped or disabled connection is acknowledged without running chat at all, so Meta stops retrying.

Path parameters

None.

Query parameters

None.The provider signs and posts the whole payload; nothing is read from the URL.

Body parameters

Defined by the caller.Inbound message payload from WhatsApp.

Response

Status codes

curl

curl -X POST 'https://api.dev.oprag.ai/v1/webhooks/whatsapp' \
  -H 'X-Oprag-Key: sk_live_...'

Path parameters

Query parameters

None.Reads the resource named in the path; there is nothing else to select.

Body parameters

None.GET requests carry no body.

Response

Status codes

curl

curl -X GET 'https://api.dev.oprag.ai/v1/projects/{projectId}/widget-config' \
  -H 'Authorization: Bearer <Cognito JWT>'

Path parameters

Query parameters

None.Everything it needs is in the request body.

Body parameters

Response

Status codes

curl

curl -X PATCH 'https://api.dev.oprag.ai/v1/projects/{projectId}/widget-config' \
  -H 'Authorization: Bearer <Cognito JWT>'

Before you call it

• status is disconnected, connected, or error. Before the first connection, connected and enabled are both false and status is disconnected.
• No secrets are returned — this is a WhatsAppChannelStatus, in which tokenConfigured and webhookVerifyConfigured report only whether they exist.

Path parameters

Query parameters

None.Reads the resource named in the path; there is nothing else to select.

Body parameters

None.GET requests carry no body.

Response

{
  "connected": true,
  "enabled": true,
  "phoneNumberId": "123456789",
  "displayPhoneNumber": "+15551234567",
  "wabaId": "987654321",
  "tokenConfigured": true,
  "webhookVerifyConfigured": true,
  "lastInboundAt": "2026-08-11T12:00:00.000Z",
  "status": "connected"
}

Status codes

curl

curl -X GET 'https://api.dev.oprag.ai/v1/projects/{projectId}/channels/whatsapp' \
  -H 'Authorization: Bearer <Cognito JWT>'

Before you call it

• Ownership of the number is verified against the Meta Graph API with the supplied token before anything is stored.
• accessToken is encrypted at rest, which requires CHANNEL_TOKEN_ENCRYPTION_KEY to be configured.
• Hub webhook verification always uses the global WHATSAPP_VERIFY_TOKEN, never a per-project one.
• A successful connect returns the project's WhatsAppChannelStatus, exactly as GET …/channels/whatsapp would.

Path parameters

Query parameters

None.Everything it needs is in the request body.

Body parameters

Request

{
  "phoneNumberId": "123456789",
  "wabaId": "987654321",
  "accessToken": "EAA...",
  "displayPhoneNumber": "+15551234567"
}

Response

{
  "connected": true,
  "enabled": true,
  "phoneNumberId": "123456789",
  "displayPhoneNumber": "+15551234567",
  "wabaId": "987654321",
  "tokenConfigured": true,
  "webhookVerifyConfigured": true,
  "status": "connected"
}

Status codes

curl

curl -X POST 'https://api.dev.oprag.ai/v1/projects/{projectId}/channels/whatsapp/connect' \
  -H 'Authorization: Bearer <Cognito JWT>' \
  -H 'Content-Type: application/json' \
  -d '{"phoneNumberId": "123456789","wabaId": "987654321","accessToken": "EAA...","displayPhoneNumber": "+15551234567"}'

Before you call it

• Returns the project's WhatsAppChannelStatus with the new enabled value.

Path parameters

Query parameters

None.Everything it needs is in the request body.

Body parameters

Request

{ "enabled": false }

Response

{
  "connected": true,
  "enabled": false,
  "phoneNumberId": "123456789",
  "displayPhoneNumber": "+15551234567",
  "wabaId": "987654321",
  "tokenConfigured": true,
  "webhookVerifyConfigured": true,
  "status": "connected"
}

Status codes

curl

curl -X PATCH 'https://api.dev.oprag.ai/v1/projects/{projectId}/channels/whatsapp' \
  -H 'Authorization: Bearer <Cognito JWT>' \
  -H 'Content-Type: application/json' \
  -d '{ "enabled": false }'

Before you call it

• Deletes both the connection row and the global phone_number_id lookup.

Path parameters

Query parameters

None.Acts on the resource named in the path; there is nothing to choose.

Body parameters

None.DELETE requests carry no body.

Response

Status codes

curl

curl -X DELETE 'https://api.dev.oprag.ai/v1/projects/{projectId}/channels/whatsapp' \
  -H 'Authorization: Bearer <Cognito JWT>'