KaiCalls Whatsapp Sender API

openapi: 3.2.0
info:
  title: KaiCalls Public Whatsapp Sender API
  version: '2026-06-05'
  description: Machine-readable surface for KaiCalls external developers and client agents.
servers:
- url: https://www.kaicalls.com/api
security:
- bearerAuth: []
tags:
- name: Whatsapp Sender
paths:
  /v1/whatsapp-sender:
    get:
      summary: Return the workspace's WhatsApp channel and provider-backed sender status…
      description: 'Returns two distinct status surfaces: channel, provisioning and sender_provisioning use the existing tenant-mapped Twilio derivation, where connected requires provider status ONLINE. telnyx.available reports server configuration; telnyx.connections contains saved tenant-scoped connection views. Each connection is connected only when its persisted status is connected, following carrier verification by POST action=sync; GET does not refresh those records. Empty connections can also mean the optional table is unavailable, so do not infer readiness or lack of setup from that alone. Neither signup-link creation nor sender status proves message delivery.'
      parameters:
      - name: business_id
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: WhatsApp channel status and provisioning state
        '403':
          description: Missing sms:read scope, or no access to this business
      x-required-scopes: sms:read
      tags:
      - Whatsapp Sender
      operationId: getV1WhatsappSender
      x-operation-id-source: derived
    post:
      summary: Create or verify a WhatsApp sender, or turn WhatsApp calls on/off, for a…
      description: '`action=connect` returns the one signup link the business owner opens to put WhatsApp on one of its own KaiCalls lines (optional `phone_number`); the owner signs in to Facebook as the business and verifies the number, and the link is reused while valid. `action=sync` reads the carrier back; a number is connected only when the carrier lists it verified for WhatsApp. The GET response carries these as `telnyx.connections`. Otherwise uses a customer-owned Twilio account or KaiCalls-managed subaccount. `action=create` registers the Meta Embedded Signup WABA and assigned phone through Twilio v2; `action=verify` submits a six-digit OTP. Both actions require a durable idempotency key. Mutation responses are acknowledgements only; connected requires a following exact GET read-back of the tenant-bound sender as ONLINE. `action=voice` with `enabled` attaches (or detaches) the voice application that lets the agent answer calls placed from WhatsApp; it requires a connected sender and a Meta-verified business at the 2,000-conversation messaging tier, and is unavailable until the deployment enables WhatsApp calls.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - business_id
              - action
              properties:
                business_id:
                  type: string
                action:
                  type: string
                  enum:
                  - connect
                  - sync
                  - create
                  - verify
                  - voice
                enabled:
                  type: boolean
                  description: 'For action=voice: true to let the agent answer WhatsApp calls'
                phone_number:
                  type: string
                  description: E.164 number for create
                waba_id:
                  type: string
                  description: WABA returned by Embedded Signup
                profile_name:
                  type: string
                verification_method:
                  type: string
                  enum:
                  - sms
                  - voice
                idempotency_key:
                  type: string
                  description: Required for create and verify; reuse only for the same request
                sender_sid:
                  type: string
                  description: Twilio XE SID for verify
                code:
                  type: string
                  description: Six-digit OTP for verify
      responses:
        '200':
          description: Provider-backed sender lifecycle state
        '403':
          description: Missing sms:write scope, or no access to this business
        '409':
          description: Business Twilio account or idempotency state requires action
        '429':
          description: Verification attempt rate limit reached
      x-required-scopes: sms:write
      tags:
      - Whatsapp Sender
      operationId: postV1WhatsappSender
      x-operation-id-source: derived
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'KaiCalls API key. Per-operation scope requirements are published on each operation as `x-required-scopes` — a scope string, or a nested `{ allOf: [...] }` / `{ anyOf: [...] }` expression. An operation with no `x-required-scopes` requires a valid key but no particular scope.'
      x-scopes:
      - workspaces:read
      - workspaces:write
      - numbers:read
      - numbers:write
      - agents:read
      - agents:write
      - communication-runs:read
      - communication-runs:write
      - calls:read
      - calls:write
      - sms:read
      - sms:write
      - webhooks:read
      - webhooks:write
      - events:read
      - events:replay
      - lifecycle:write
      - leads:read
      - leads:write
      - emails:read
      - emails:write
      - sdr:read
      - sdr:write
      - evals:read
      - evals:write
      - appointments:read
      - appointments:write
      - knowledge:read
      - knowledge:write
      - products:read
      - products:write
      - integrations:write
      - approvals:write
      - concierge:write
      - billing:read
      - billing:write
      - call_evidence:read
      - call_evidence:write
      - support:write
    sessionAuth:
      type: apiKey
      in: cookie
      name: sb-access-token
      description: Authenticated dashboard session cookie. Used by first-party flows that mint or manage API keys.