GWhats
    API & Developers

    WhatsApp customer service API, webhooks and MCP for developers

    Integrate, extend and automate GWhats: a REST API documented in OpenAPI 3.1, webhooks with durable delivery, an API channel with structured content, a native MCP server for Claude Code, Cursor and VS Code, Dashboard Apps and multi-tenant provisioning.

    reference in ReDoc, Swagger-UI and JSON
    OpenAPI 3.1
    modules exposed via MCP across 12 areas
    100+
    groups of webhook events by module
    14

    What the GWhats API & Developers layer is

    The API & Developers layer lets you connect GWhats to CRMs, ERPs, data warehouses, n8n and AI agents without depending on the product team. The REST API covers contacts, conversations, messages, atomic conversation assignment and scheduled messages, documented in OpenAPI 3.1 with ReDoc, Swagger-UI and JSON for Postman or Insomnia. Signed webhooks deliver events from every module with history, retries and resend, and the API channel turns any application into a first-class inbox.

    For AI, native MCP creates access profiles with an execution user, module selection and read-only mode, ready for Claude Code, Cursor, VS Code and Windsurf, while Maestro Robots consume external MCP servers such as Linear, Notion, Stripe and GitHub with human approval. Dashboard Apps embed your apps in the conversation screen with secure context, Custom Scripts inject JS and CSS, and the Platform API provisions accounts, users and bots in multi-tenant scenarios.

    Everything an integrator needs, with governance

    REST, webhooks, MCP and SDKs with idempotency, secrets shown only once and least privilege.

    REST API with OpenAPI 3.1 reference

    Contacts, conversations, messages, atomic assignment and schedules browsable in ReDoc, testable in Swagger-UI with Try it out and importable into Postman or Insomnia.

    Tokens and durable webhooks

    Access token per user or account and signed webhooks. Every delivery is recorded before queuing, with backoff retries, searchable history and bulk resend.

    Event catalog by module

    Fourteen event groups: conversations, CRM, Catalog and Commerce, orders, payments, follow-ups, contracts, WhatsApp Hub, Ads, Flow Builder, Workforce Management and more.

    API channel with structured content

    Connect your app as an inbox. Buttons, payment CTAs, catalog cards, calendar events, reactions and templates arrive structured and replies go back symmetrically.

    Customer service bots via webhook

    Agent bots assigned to any inbox receive events at the outgoing_url and reply through the API, with rotatable token and secret and HMAC contact verification.

    Native MCP server for customer service

    Access profiles with an execution user, 100+ modules across 12 areas, read-only mode and a dedicated secret. Connect Claude Code, Cursor, VS Code, Windsurf and MCP Inspector.

    Robots with external MCP servers

    Linear, Notion, Stripe, GitHub, Sentry or an internal ERP as Robot tools, with upfront discovery, allowlist, human approval (HITL) and secrets by reference.

    Dashboard Apps SDK V2 and Custom Scripts

    HTTPS apps embedded in the conversation or sidebar with capability-based context and a 2-minute identity assertion. JS and CSS per surface with context and teardown.

    Multi-tenant Platform API

    Create accounts, users, memberships with administrator or agent role, agent bots and SSO login links from a Platform App with a permissibles list.

    REST API

    One contract for messages, assignment and schedules

    Endpoints under /api/v1/accounts/{account_id} authenticated with api_access_token. Send messages with content_type and content_attributes, swap assignee and team in a single transaction with PUT .../assignment and create scheduled messages with preview, X-Idempotency-Key and lock_version.

    • Atomic assignment: assignee_type User or AgentBot, idempotent, with 422 for unknown IDs.
    • Scheduled messages one_time, sequence and recurring with a blockers preview and MCP tools generated from the OpenAPI.
    • source_id on messages to deduplicate redeliveries; no universal token, each operation declares its own security.
    Webhooks

    Events from every module with delivery that never gets lost

    Subscribe to account events under Settings, Integrations, Webhooks. The signing secret is shown only once, every delivery is recorded before it enters the queue and network or 5xx errors trigger backoff retries. The history lets you search, filter and resend one or many deliveries.

    • Unique delivery header as the idempotency key, reused on manual resends.
    • Commerce payload with the Include commercial data opt-in; never credentials or the raw gateway payload.
    • Events such as ctwa_conversation_started, wfm_break_breached, whatsapp_broadcast_completed and flow_session_completed.
    Native MCP

    Connect Claude Code, Cursor and VS Code to customer service

    Create an MCP connection with an execution user, modules chosen from 100+ across 12 areas and read-only mode. The effective tool list is the intersection of the selection, the Super Admin ceiling and the user's permissions: the assistant never does more than the person running it.

    • 512-tool ceiling on the list; search_tools and call_tool reach all the others.
    • The Maestro MCP server exposes departments as ask_department to external clients.
    • Robots consume external MCP servers with allowlist, HITL, SSRF protection and OAuth for Notion.
    Dashboard Apps

    Embed your app in the conversation screen securely

    An HTTPS app runs in an iframe on the conversation or sidebar surfaces. With SDK V2 it receives account, user, conversation and contact according to the granted capabilities, subscribes to events like conversation.changed and never sees tokens. To write to your backend, use getIdentityAssertion() and validate it at the introspection_url.

    • Capabilities such as account:read, conversation:read, contact:phone and identity:assertion, granted per installation.
    • Audience by role, team or user; 8 sidebar categories and 22 icons; installations managed via REST and MCP.
    • Custom Scripts inject JS and CSS into the dashboard, the Help Center portal and the widget, with ctx and teardown.

    How it works

    1. 1

      Generate least-privilege credentials

      Access token for REST, MCP profile with modules and read-only mode, or a Platform App for provisioning.

    2. 2

      Read the contract

      Browse the OpenAPI 3.1 reference, read each operation's security and import the JSON into Postman or generate an SDK.

    3. 3

      Integrate in both directions

      Call the API and receive events through signed webhooks or the API channel webhook, deduplicating by idempotency key.

    4. 4

      Connect AI and apps

      Point Claude Code, Cursor or VS Code at the MCP URL, give Robots external servers with HITL and embed Dashboard Apps.

    Works together with

    API integrationAuthentication guide, endpoints and REST call examples.WebhooksSubscription, secret verification and event catalog.n8n integrationn8n flows triggered by webhooks and calling the GWhats API.Automation and FlowsRules, macros and the Flow Builder consuming the same events internally.

    Frequently asked questions

    Where is the API documentation?

    In the OpenAPI 3.1 reference: ReDoc for reading, Swagger-UI to test calls with Try it out and the JSON to import into Postman or Insomnia or generate SDKs. On self-hosted installations the operator enables the docs with ENABLE_API_DOCS.

    Do I need to code to connect Claude or an IDE to GWhats?

    No. Under Settings, MCP, you create a profile with an execution user, modules and read-only mode, copy the URL and the mcp_ secret and paste them into Claude Code, Cursor, VS Code or Windsurf with Authorization: Bearer. The client runs initialize, tools/list and tools/call.

    Can the AI assistant do more than the user running it?

    Never. The effective tool list is the intersection of the profile selection, the Super Admin ceiling and the execution user's permissions. Read-only mode removes everything that creates, updates or deletes.

    How do I make sure I don't process a webhook twice?

    Every delivery carries a unique identification header, reused on manual resends. Use it as the idempotency key on your receiver; retries after network or 5xx errors and resends from the history keep the same identifier.

    Can I connect my own application as a customer service channel?

    Yes, with the API channel: create an API-type inbox, send incoming messages via REST and receive agent replies at your webhook_url, including buttons, payment, catalog, calendar and reactions. You also send back delivery receipts and reactions.

    Can I provision accounts and users automatically for my customers?

    Yes, through the Platform API at /platform/api/v1 with a Platform App token. It creates accounts, users, memberships with administrator or agent role, agent bots and generates SSO login links. The app only touches objects in its permissibles list.
    Get started today

    Ready to transform
    your service?

    Join over 1,000 companies that already use GWhats to serve, automate and sell more on WhatsApp.

    7 days free, no card
    Meta Official API
    Dedicated support
    Cancel anytime