Send messages, receive events, build on real infrastructure.
REST API and webhooks live in production since v3.10.0
Send WhatsApp messages from your own code
One authenticated endpoint sends text, media, or Meta-approved templates from any backend, script, or integration you already run — no separate SDK required, just a standard HTTP request.
- Single POST endpoint for text, media, and template sends
- Authenticated with a bearer API key scoped to your team
- Works from any language that can make an HTTP request
curl -X POST https://rabtcrm.com/api/v1/send \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"instanceName": "sales-line",
"number": "201061711867",
"type": "text",
"message": "Your order #4021 has shipped."
}'Get notified the instant something happens
Subscribe your own endpoint to message.received and message.status events. Every delivery is signed with HMAC-SHA256 so you can verify it genuinely came from RABTCRM before trusting the payload.
- message.received and message.status event types
- HMAC-SHA256 signature in the X-RabtCRM-Signature header on every delivery
- A stable X-RabtCRM-Delivery ID for deduping retried deliveries
import { createHmac } from "crypto";
// Verify an inbound webhook delivery from RABTCRM
function verifySignature(rawBody, signatureHeader, secret) {
const expected =
"sha256=" + createHmac("sha256", secret)
.update(rawBody, "utf8")
.digest("hex");
return signatureHeader === expected;
}
app.post("/webhooks/rabtcrm", (req, res) => {
const signature = req.headers["x-rabtcrm-signature"];
const deliveryId = req.headers["x-rabtcrm-delivery"]; // dedupe key
if (!verifySignature(req.rawBody, signature, WEBHOOK_SECRET)) {
return res.status(401).send("invalid signature");
}
// req.body.event === "message.received" | "message.status"
res.status(200).send("ok");
});At-least-once delivery, backed by a real outbox
Webhook events are written to a durable outbox and retried automatically if your endpoint is briefly down — you don't lose events to a momentary outage, and templates can be sent the same way text and media are.
- Durable outbox pattern, not a fire-and-forget HTTP call
- Automatic retries on delivery failure
- The same /v1/send endpoint sends templates, text, and media
import requests
resp = requests.post(
"https://rabtcrm.com/api/v1/send",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={
"instanceName": "sales-line",
"number": "201061711867",
"type": "template",
"templateName": "order_confirmation",
"templateLanguage": "en",
"templateBodyVariables": ["4021", "3"],
},
)
resp.raise_for_status()
print(resp.json())What's included
Everything the developer API and webhook system gives you
Built on /v1/send and the v3.10.0 outbound webhook system — HMAC-signed, durable, at-least-once.
Questions
Developer API & Webhooks FAQ
QHow do I send a WhatsApp message programmatically?
Make a POST request to /api/v1/send with your API key, instance name, recipient number, and message type (text, media, or template). See the curl sample above.
QHow do I verify an inbound webhook is genuine?
Every webhook is signed with HMAC-SHA256 in the X-RabtCRM-Signature header. Compute the same signature from the raw request body using your webhook secret and compare — see the JavaScript sample above.
QWhat happens if my endpoint fails to receive a webhook event?
RABTCRM uses a durable outbox pattern with at-least-once delivery — failed deliveries are retried automatically. Use the X-RabtCRM-Delivery header as a dedupe key on your side.
QCan I send approved templates through the API?
Yes — use type: "template" with the template name, language, and body variables, as shown in the Python sample above.