API Reference
WhatsApp Messaging

Get a contact's WhatsApp call permission

GET
/v1/whatsapp/call-permissions

Returns whether a contact has granted permission for you to call them on WhatsApp. A contact with no recorded permission comes back as no_permission — absence is a meaningful answer here, not a 404.

Pass live=true to additionally check with Meta and refresh the stored value. A failed live check degrades to the stored value rather than failing the request.

API-key scope: whatsapp.messages.

Authorization

bearerAuth
AuthorizationBearer <token>

Long-lived ES256 JWT minted from the dashboard (https://app.sautikit.com/developers/api-keys). Signed by the platform keyring. Carries workspace_id and scopes claims; revoked via the platform deny-list.

In: header

Query Parameters

wa_id*string

The contact's WhatsApp id.

connection_id*string

The WhatsApp connection the contact belongs to.

Formatuuid
live?boolean

Also perform a live check with Meta and persist the result.

Response Body

application/json

application/json

curl -X GET "https://example.com/v1/whatsapp/call-permissions?wa_id=254700000001&connection_id=497f6eca-6276-4993-bfeb-53cbbbba6f08"
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9",  "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9",  "wa_id": "254700000001",  "status": "string",  "is_permanent": true,  "expires_at": "2019-08-24T14:15:22Z",  "last_requested_at": "2019-08-24T14:15:22Z",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z"}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ],    "resolution": "string",    "reason": "invalid_characters",    "suggested_e164": "+254727524723"  }}

Mark an inbound message as read POST

Sends a read receipt for an inbound message — the blue ticks the contact sees. Name the number the message arrived on with either `connection_id` or `number_id`, exactly as you would for a send. Sautikit does not retain messages, so it cannot infer the number from the `wamid` alone; the `wamid` comes from the `whatsapp.event.received` webhook that delivered the message. Meta's reference: https://developers.facebook.com/docs/whatsapp/cloud-api/guides/mark-message-as-read **API-key scope:** `whatsapp.messages`.

Ask a contact for permission to call them POST

Sends a call-permission request to a contact. You cannot place a WhatsApp call to someone who has not granted permission, so this is the step that unlocks outbound WhatsApp calling to them. Two forms, selected by `mode`: - `free_form` (default) — an interactive permission-request message built from `text`. Subject to the same 24-hour customer service window as any free-form message. - `template` — an already-approved template whose components include a `call_permission_request` component. Use this outside the 24-hour window. The contact's answer arrives as the `whatsapp.call_permission.updated` workspace webhook. ```json { "connection_id": "3f1a9c22-58d4-4f7e-9b10-2c6e8a4d5f31", "wa_id": "254700000001", "mode": "free_form", "text": "May we call you about your order?" } ``` Meta's reference: https://developers.facebook.com/docs/whatsapp/cloud-api/guides/call-permissions **API-key scope:** `whatsapp.messages`.