Pusat Dokumentasi API WA Gateway
WA Gateway API Documentation Hub
Solusi gateway WhatsApp REST API multi-user dengan manajemen kuota, proteksi anti-banned berbasis perilaku manusia, auto-delete server-side, chaining webhook multi-endpoint, dan SSE streaming real-time.
Production-grade multi-user WhatsApp REST API gateway with quota management, humanized anti-ban protection, server-side auto-delete, multi-target webhook chaining, and real-time SSE streaming.
Quick Documentation Quick Documentation
Panduan langkah demi langkah dari login akun, pembuatan sesi, scan QR code, hingga mengirimkan pesan teks WhatsApp pertama Anda. Step-by-step onboarding from authentication and session creation to QR code scanning and sending your very first WhatsApp message.
Client API Reference Client API Reference
Dokumentasi lengkap untuk klien: sesi WhatsApp, pengiriman teks & media, broadcast berjadwal, validasi nomor, pengetikan, dan webhook. Full developer reference for client endpoints: WhatsApp sessions, text & media dispatch, safe broadcast, presence typing, and webhooks.
Admin API Reference Admin API Reference
Kontrol superadministrator sistem: kelola pengguna, tetapkan batas kuota sesi, pantau seluruh sesi aktif sistem, dan suspensi akun. Superadministrator controls: manage user accounts, assign session quota limits, inspect all active system sessions, and suspend accounts.
Interactive Playground Interactive Playground
Uji coba langsung seluruh REST endpoint dan dengarkan incoming webhook event secara real-time langsung di browser Anda. Test all REST endpoints interactively and listen to incoming webhook payloads in real time directly from your web browser.
Arsitektur & Konsep Utama
Architecture & Core Concepts
Mekanisme keamanan, isolasi multi-user, dan fitur tingkat lanjut yang disediakan oleh WA Gateway.
Security models, multi-tenant isolation, and advanced messaging capabilities of WA Gateway.
👥 Multi-User & Kuota Sesi
👥 Multi-User & Quota Limits
Setiap pengguna memiliki akun independen dengan limit max_sessions yang dapat diatur oleh Admin. Pengguna hanya dapat mengakses dan mengelola sesi WhatsApp miliknya sendiri.
Every user has an isolated account with a configurable max_sessions quota limit set by the administrator. Users cannot view or modify sessions belonging to other accounts.
🔑 Dua Lapisan Autentikasi
🔑 Two-Tier Authentication
1. JWT Bearer: Untuk rute dashboard dan manajemen sesi (/api/auth/*, /api/user/*, /api/admin/*).
2. Session API Token: Token statis 64-karakter hex per sesi WhatsApp untuk rute pengiriman pesan gateway (/api/send, /api/send-media).
1. JWT Bearer: Used for management and profile routes (/api/auth/*, /api/user/*, /api/admin/*).
2. Session API Token: A static 64-character hex token per WhatsApp session used for gateway message dispatching (/api/send, etc.).
🛡️ Proteksi Anti-Banned Cerdas
🛡️ Smart Anti-Ban Protection
Gateway secara otomatis melakukan validasi nomor via onWhatsApp sebelum mengirim untuk menghindari penalti nomor mati, mensimulasikan status mengetik (composing), dan menerapkan jeda acak (jitter) pada broadcast.
Automatically validates recipient numbers via onWhatsApp before sending to prevent dead-number penalties, simulates natural human typing presence (composing), and applies randomized jitter delays on broadcast batches.
🗑️ Auto-Delete For Me (Sisi Server)
🗑️ Server-Side Auto-Delete
Pesan yang dikirim melalui gateway dapat secara otomatis dihapus hanya pada HP server pengirim (Delete For Me) setelah delay tertentu (default 30 detik). Pesan tetap utuh pada HP penerima sehingga storage HP server tetap bersih.
Sent messages can be automatically deleted only on the server's phone (Delete For Me) after a specified delay (default 30s). The message remains intact for the recipient, keeping the server device storage free.
🔗 Webhook Chaining
🔗 Webhook Chaining
Mendukung penerusan payload event ke beberapa URL sekaligus. Setiap event masuk (pesan baru, koneksi, status kirim) diteruskan berurutan ke primary webhook URL dan seluruh daftar chain_urls.
Supports fan-out event forwarding to multiple destination URLs. Every incoming event (incoming messages, connection changes, delivery receipts) is forwarded sequentially to the primary URL and all configured chain_urls.
📡 Server-Sent Events (SSE)
📡 Real-Time SSE Stream
Endpoint /api/events menyediakan streaming event live berbasis SSE untuk memantau status koneksi sesi, pembaruan QR code, dan pairing code secara instan tanpa perlu polling berkala.
The /api/events endpoint delivers live SSE streaming updates for connection status changes, QR code refreshes, and phone pairing codes without needing polling loops.
Format Respons & Kode Status HTTP
Response Formats & HTTP Status Codes
Standar kode status yang dikembalikan oleh seluruh endpoint WA Gateway.
Standard status codes returned by all WA Gateway endpoints.
| HTTP Code | Artinya Meaning | Deskripsi & Contoh Penyebab Description & Example Causes |
|---|---|---|
| 200 OK | Success |
Permintaan berhasil diproses. Mengembalikan JSON dengan {"success": true, ...}.
Request completed successfully. Returns JSON payload with {"success": true, ...}.
|
| 400 Bad Request | Validation Error | Parameter wajib tidak lengkap, nomor telepon tidak terdaftar di WhatsApp, atau tipe media tidak didukung. Missing required fields, phone number not registered on WhatsApp, or unsupported media type. |
| 401 Unauthorized | Authentication Required | Authorization Bearer token tidak disertakan, token kedaluwarsa, atau API Token sesi tidak valid. Missing Authorization header, expired JWT token, or invalid session API Token. |
| 403 Forbidden | Access Denied / Quota Exceeded |
Akun disuspensi, akun telah expired, kuota sesi melebihi batas (max_sessions), atau user mencoba mengakses resource admin.
Account suspended, account expired, session quota exceeded (max_sessions), or non-admin accessing admin resources.
|
| 404 Not Found | Resource Not Found | ID sesi atau akun pengguna tidak ditemukan di database. Session ID or user ID was not found in the database. |
| 409 Conflict | State Conflict |
Permintaan QR code ketika sesi WhatsApp sudah dalam kondisi terhubung (connected).
Requesting a QR code when the WhatsApp session is already in a connected state.
|
| 413 Too Large | Payload Too Large | Payload body request melebihi batas maksimal 50 MB (misal upload media base64 sangat besar). Request payload exceeds the maximum 50 MB limit (e.g. extremely large base64 buffers). |
| 500 Server Error | Internal Error | Kesalahan internal server saat berkomunikasi dengan Baileys atau database SQLite. Internal error while communicating with Baileys or the SQLite database. |
⚠️ Pemberitahuan Batasan Tanggung Jawab Disclaimer & Notice
Aplikasi ini menggunakan library pihak ketiga non-resmi (Baileys) untuk berinteraksi dengan WhatsApp Web Protocol. WhatsApp/Meta secara berkala memperbarui sistem deteksi anti-spam. Risiko penangguhan atau pemblokiran nomor (banned) sepenuhnya merupakan risiko pengguna. Selalu gunakan delay yang wajar dan hindari pengiriman spam massal ke nomor yang tidak dikenal. This project uses an unofficial third-party library (Baileys) to communicate with WhatsApp Web Protocol. WhatsApp/Meta actively updates spam and automation detection. Any risk of temporary or permanent phone number bans is solely the user's responsibility. Always apply reasonable sending delays and avoid unsolicited cold messaging.