API changelog

Within v1 we only add things. A breaking change would get /v2, with at least 6 months' notice before /v1 stops.

1.3.0 5 November 2026

• Named API keys: several per number, each with its own permissions (send, read, templates, contacts) and, optionally, the IP addresses it may be used from. Shown once; a call a key isn't allowed gets 403 with key_not_allowed or ip_not_allowed.
• Owners can turn a number's main key off once their systems use named keys.

1.2.0 5 November 2026

• Webhooks carry Sonar-Signature: t=...,v1=..., signing the send time with the body, so an old update can't be replayed. X-Sonar-Signature still comes too.
• Webhook updates are stored and retried for about 2 days (1 minute to 24 hours apart), each with the same id; a delivery log under the webhook settings shows the last 7 days.

1.1.0 5 November 2026

• Paths start with /v1. The paths without it still work, as v1.
• Error answers carry a code that stays the same, and meta_code when WhatsApp refused the message.
• A rate limit of 20 calls a second per key, in bursts of up to 40: past it, 429 with Retry-After.
• Owners can make a new API key for a number (WhatsApp numbers, Advanced): the old key stops working at once.

1.0.0 5 November 2026

• First published reference: send, send-template (with reference, so a retry doesn't send twice), message-status, create-template, list-templates, contacts/upsert and file download.