Melakukan login ke sistem dan mengembalikan JWT token 7 hari serta profil lengkap pengguna/admin. Authenticates administrator or client credentials, returning a 7-day JWT token and user profile metadata.

curl -X POST "http://localhost:3000/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": ""
  }'

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": 1,
    "username": "admin",
    "role": "admin",
    "max_sessions": 100,
    "status": "active",
    "expires_at": null
  }
}

Mengambil data profil pengguna yang sedang login beserta jumlah sesi aktif yang telah digunakan. Fetches the currently authenticated profile along with active session usage statistics.

curl -X GET "http://localhost:3000/api/auth/me" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

{
  "success": true,
  "user": {
    "id": 1,
    "username": "admin",
    "role": "admin",
    "max_sessions": 100,
    "status": "active",
    "expires_at": null,
    "created_at": "2026-09-01T08:00:00.000Z",
    "active_sessions": 4
  }
}

Memperbarui password akun admin sendiri dengan validasi password lama terlebih dahulu. Updates the authenticated admin's own password, requiring validation of current password.

curl -X POST "http://localhost:3000/api/auth/change-password" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "currentPassword": "",
    "newPassword": "superSecureNewPassword2026"
  }'

Mengubah username akun sendiri setelah memverifikasi password saat ini. Modifies current account username after confirming current password.

curl -X PATCH "http://localhost:3000/api/auth/username" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "currentPassword": "mySecretPassword",
    "newUsername": "superadmin"
  }'

Mendapatkan daftar seluruh pengguna terdaftar di sistem beserta kuota sesi maksimal dan jumlah sesi yang sedang aktif. Retrieves all registered users in the database, including quota allocations and active session counts.

curl -X GET "http://localhost:3000/api/admin/users" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

{
  "success": true,
  "users": [
    {
      "id": 1,
      "username": "admin",
      "role": "admin",
      "max_sessions": 100,
      "status": "active",
      "expires_at": null,
      "created_at": "2026-09-01T08:00:00.000Z",
      "active_sessions": 2
    },
    {
      "id": 2,
      "username": "joko_client",
      "role": "user",
      "max_sessions": 3,
      "status": "active",
      "expires_at": "2026-12-31T23:59:59.000Z",
      "created_at": "2026-09-10T12:00:00.000Z",
      "active_sessions": 1
    }
  ]
}

Mendaftarkan akun pengguna baru dengan menetapkan kuota sesi WhatsApp (max_sessions), peran, dan opsional tanggal kedaluwarsa akun. Creates a new user account with specified session quota limits, role, and optional account expiration.

curl -X POST "http://localhost:3000/api/admin/users" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "client_budi",
    "password": "budiSecretPassword123",
    "max_sessions": 5,
    "role": "user",
    "expires_at": "2026-12-31T23:59:59.000Z"
  }'

{
  "success": true,
  "message": "User \"client_budi\" created successfully.",
  "user": {
    "id": 3,
    "username": "client_budi",
    "role": "user",
    "max_sessions": 5,
    "status": "active",
    "expires_at": "2026-12-31T23:59:59.000Z"
  }
}

Memperbarui kuota sesi, status akun (active / suspended), reset password pengguna, role, atau masa berlaku. Jika akun di-suspend, semua socket sesi WhatsApp milik user tersebut akan langsung diputus secara otomatis. Updates session quota, account status (active / suspended), password reset, role, or expiration. Suspending a user immediately disconnects all their active WhatsApp sockets.

curl -X PATCH "http://localhost:3000/api/admin/users/3" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "max_sessions": 10,
    "status": "active"
  }'

Menghapus akun pengguna secara permanen. Seluruh sesi WhatsApp milik akun tersebut akan diputus koneksinya, kredensial auth lokal dihapus, dan data dihapus dari SQLite. Permanently deletes a user account. Automatically terminates all WhatsApp sockets, purges credentials from disk, and cascades deletions in SQLite.

curl -X DELETE "http://localhost:3000/api/admin/users/3" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

Melihat seluruh sesi WhatsApp yang ada di sistem lintas semua pengguna, status koneksi, pemilik sesi, dan status auto-delete. Global system audit: lists all WhatsApp sessions across all users with ownership metadata, connection states, and toggle states.

curl -X GET "http://localhost:3000/api/admin/all-sessions" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

{
  "success": true,
  "sessions": [
    {
      "id": "e229e612-3bdc-4ad0-a9cb-b0cbdb7946bf",
      "user_id": 2,
      "name": "WA Support Toko",
      "api_token": "a1b2c3d4e5f6...",
      "status": "connected",
      "auto_reply_enabled": 1,
      "watermark_enabled": 0,
      "auto_delete_enabled": 1,
      "auto_delete_delay": 30,
      "created_at": "2026-09-20T10:00:00.000Z",
      "owner_username": "joko_client",
      "owner_status": "active"
    }
  ]
}

Membuat sesi WhatsApp baru untuk admin sendiri atau meng-assign langsung ke pengguna tertentu via user_id. Provisions a new WhatsApp session directly, either for the administrator or assigned to a specific user_id.

curl -X POST "http://localhost:3000/api/admin/sessions" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Official Admin Dispatcher",
    "user_id": 1
  }'

Mengambil data QR code (berupa base64 image data URL) atau pairing code 8 digit untuk sesi tertentu. Retrieves current QR code data URL or pairing code for a specific session.

curl -X GET "http://localhost:3000/api/admin/sessions/<SESSION_ID>/qr" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

Memicu inisialisasi koneksi ulang via QR code baru untuk sesi tersebut. Triggers a fresh QR code connection attempt for the given session.

curl -X POST "http://localhost:3000/api/admin/sessions/<SESSION_ID>/connect" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

Meminta kode pairing 8-digit dari WhatsApp menggunakan nomor telepon. Requests an 8-digit WhatsApp phone pairing code for headless onboarding.

curl -X POST "http://localhost:3000/api/admin/sessions/<SESSION_ID>/pair" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "phoneNumber": "6281234567890"
  }'

Memodifikasi fitur toggle sesi: watermark ('> Developed by JSGDEV'), auto reply, serta server-side auto-delete dan jeda delay-nya (1 - 86400 detik). Updates operational session toggles: watermark ('> Developed by JSGDEV'), auto reply, and server-side auto-delete with custom delay (1 - 86400s).

curl -X PATCH "http://localhost:3000/api/admin/sessions/<SESSION_ID>/settings" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "watermark_enabled": false,
    "auto_reply_enabled": true,
    "auto_delete_enabled": true,
    "auto_delete_delay": 60
  }'

Menghapus sesi WhatsApp secara permanen, memutus socket Baileys, dan membersihkan folder sesi dari server. Permanently deletes a WhatsApp session, terminates the Baileys socket, and wipes credentials from disk.

curl -X DELETE "http://localhost:3000/api/admin/sessions/<SESSION_ID>" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"

Mengambil konfigurasi webhook untuk sesi tertentu, termasuk status aktif, URL tujuan, secret key signature, dan daftar chain URLs. Fetches session webhook parameters: enabled toggle, target URL, signature secret, and configured chain URLs.

{
  "success": true,
  "webhook": {
    "enabled": true,
    "url": "https://api.domain.com/webhook",
    "events": "incoming,connected,disconnected,message_status",
    "secret": "mySecretWebhookKey",
    "chain_urls": [
      "https://backup.domain.com/webhook"
    ]
  }
}

Memperbarui konfigurasi webhook sesi. Perubahan langsung aktif di memori tanpa perlu restart server. Updates session webhook settings. Cache updates instantly in memory without needing server reboot.

curl -X PATCH "http://localhost:3000/api/admin/sessions/<SESSION_ID>/webhook" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "url": "https://api.example.com/wa/webhook",
    "secret": "webhookSignatureKey123",
    "chain_urls": ["https://secondary.example.com/wa/webhook"]
  }'

Melihat seluruh daftar aturan auto reply yang terpasang pada sesi tertentu. Lists all auto reply keyword rules attached to the specified session.

{
  "success": true,
  "autoReplies": [
    {
      "id": 1,
      "keyword": "*harga*",
      "reply_text": "Daftar harga layanan kami dapat dilihat di https://example.com/pricing"
    }
  ]
}

Menambahkan aturan balas otomatis baru. Gunakan tanda bintang *kata* untuk pencarian substring (contains), atau tanpa bintang untuk pencarian persis (exact match). Adds a new auto reply rule. Wrap keywords with asterisks *word* for wildcard contains, or omit for exact match.

curl -X POST "http://localhost:3000/api/admin/sessions/<SESSION_ID>/auto-replies" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "keyword": "*bantuan*",
    "reply_text": "Halo! Silakan ketik 1 untuk Pembayaran, 2 untuk CS."
  }'

Menghapus aturan balas otomatis berdasarkan ID-nya. Deletes an auto-reply rule by its numeric primary key.

curl -X DELETE "http://localhost:3000/api/admin/auto-replies/1" \
  -H "Authorization: Bearer <ADMIN_JWT_TOKEN>"