Skip to main content
The Zapfy API is REST over HTTPS. You send messages and manage instances and webhooks through a single surface — how it connects to WhatsApp stays abstracted. Base URL

​
Authentication

Everything via Authorization: Bearer <token>. There are two tokens, each with its own scope:

Account token

Prefix zpfy_acct_. Manages instances and webhooks (create, list, edit, delete).

Instance token

Prefix zpfy_inst_. Sends messages for a specific number.
Each endpoint shows which token to use in the Authorization selector of the playground on the right. Messages use the instance token; instances and webhooks, the account token.

​
Identifiers

Zapfy uses two identifiers, abstracting away WhatsApp’s internal JIDs:
  • phone is just the person’s number — never ...@s.whatsapp.net.
  • id is the exact value the API returns (from GET /groups, GET /communities, GET /newsletters). It’s opaque: it may look like ...@g.us (group/community) or ...@newsletter (channel) — use it as received, don’t rebuild it or derive it from a phone.
When sending, the recipient goes in the to field, which accepts a phone (person) or a group id. The response returns { messageId } — keep it to reuse in follow-up actions on the message (status, reaction, delete, edit).

​
Webhooks

Inbound events (message received, status, connection) arrive at the webhooks you register — one URL, many events. See Configuration and Events.