This endpoint is not called by mobile or browser apps. WAHA (the WhatsApp bridge Watchatic operates between WhatsApp and this API) posts JSON envelopes here.
The userId query ties deliveries to the correct tenant. The secret rotates only through coordination with Watchatic operators — treat it like any production credential.

​
Responses

  • 401 — Missing or wrong X-WAHA-SECRET.
  • 400 — Payload fails envelope validation.
  • 202 — Accepted (accepted) or duplicate replay (duplicate_accepted).
  • 409 — Same WAHA identity reused with a conflicting body hash (conflict).
Exact JSON bodies appear under CommandResult / ErrorResponse in the API reference.

​
Supported WAHA event kinds

Watchatic derives feed updates from common lifecycle types including message, message.edited, message.revoked, session.status, and group.v2.* join/leave/participants/update events. Unknown WAHA types may still be stored as raw receipts without derived feed mutations — forward compatibility depends on WAHA upgrades.

​
Group filtering

Only selected groups contribute user-visible messages. Others are acknowledged without polluting feeds — mirror UX expectations documented under Group selection.