API Reference v1

Messaging API

The Actionpackd Messaging API lets your backend send WhatsApp notifications, order updates, and conversational messages over Meta’s official Cloud API infrastructure without managing WABA tokens or complex Meta App setups.

Base URL

https://api.actionpackd.com

Auth Format

Bearer apk_live_… / apk_test_…

Idempotency

Idempotency-Key: <uuid>

Authentication

All API requests must include your API key in the Authorization HTTP header. Your tenant identity is securely bound to the key; do not supply account or tenant IDs in your payload.

Auth Header

curl -X GET "https://api.actionpackd.com/v1/webhook" \
  -H "Authorization: Bearer apk_live_your_api_key_here"

Send an Approved Template

Outside the 24-hour customer window, Meta requires pre-approved template messages. Every send requires an Idempotency-Key header to prevent double-billing on network retries.

POST /v1/messages

curl -X POST "https://api.actionpackd.com/v1/messages" \
  -H "Authorization: Bearer apk_live_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 11111111-1111-1111-1111-111111111111" \
  -d '{
    "to": "919876543210",
    "type": "template",
    "template": {
      "name": "order_update",
      "language": "en"
    }
  }'

Send Free-Form Session Text

Free-form text is permitted only when the customer messaged your WhatsApp number in the past 24 hours. If the customer care window is closed, the API immediately returns HTTP 409 Conflict.

POST /v1/messages

curl -X POST "https://api.actionpackd.com/v1/messages" \
  -H "Authorization: Bearer apk_live_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 22222222-2222-2222-2222-222222222222" \
  -d '{
    "to": "919876543210",
    "type": "text",
    "text": {
      "body": "Hi there! Your request is being handled by our support specialist."
    }
  }'

Check Delivery Status

Poll status directly or rely on customer webhooks for real-time delivery transitions (queued → sent → delivered → read | failed).

GET /v1/messages/{id}

curl -X GET "https://api.actionpackd.com/v1/messages/11111111-1111-1111-1111-111111111111" \
  -H "Authorization: Bearer apk_live_..."

Inbound Messages & Status Webhooks

Set your HTTPS webhook URL to receive inbound customer replies and real-time delivery receipts. The setup response returns your shared secret once. Every outgoing dispatch includes an X-Actionpackd-Signature HMAC-SHA256 header.

PUT /v1/webhook

curl -X PUT "https://api.actionpackd.com/v1/webhook" \
  -H "Authorization: Bearer apk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-backend.example.com/webhooks/whatsapp"}'

Validating Webhook Signatures

Always verify the X-Actionpackd-Signature header against the raw request buffer to prevent replay and spoofing attacks.

Signature Verification

import crypto from 'node:crypto';

export function verifySignature(rawBodyBuffer, signatureHeader, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBodyBuffer)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected)
  );
}

HTTP Status Codes

Code	Status	Meaning
202	Accepted	Message accepted and enqueued for dispatch via BullMQ.
400	Bad Request	Payload failed schema validation or template is not approved by Meta.
401	Unauthorized	Missing, invalid, or revoked API key in Authorization header.
409	Conflict	Session text rejected because customer 24h window is closed.
429	Too Many Requests	API plan send allowance reached or rate limit exceeded.

← View API Pricing Plans Manage API Keys →