This endpoint is not called by mobile or browser apps. WAHA (the WhatsApp bridge Watchatic operates between WhatsApp and this API) posts JSON envelopes here. 
POST https://api-v2.watchcollect.com/v2/webhooks/waha?userId=<clerk-user-id>

X-WAHA-SECRET: <shared-secret>
The userId query ties deliveries to the correct tenant. The secret rotates only through coordination with Watchatic operators — treat it like any production credential.

​
Responses

  • 401 — Missing or wrong X-WAHA-SECRET.
  • 400 — Payload fails envelope validation.
  • 202 — Accepted (accepted) or duplicate replay (duplicate_accepted).
  • 409 — Same WAHA identity reused with a conflicting body hash (conflict).
Exact JSON bodies appear under CommandResult / ErrorResponse in the API reference.

​
Supported WAHA event kinds

Watchatic derives feed updates from common lifecycle types including message, message.edited, message.revoked, session.status, and group.v2.* join/leave/participants/update events. Unknown WAHA types may still be stored as raw receipts without derived feed mutations — forward compatibility depends on WAHA upgrades.

​
Group filtering

Only selected groups contribute user-visible messages. Others are acknowledged without polluting feeds — mirror UX expectations documented under Group selection.