Loading…
Loading…
One header, x-api-key. JSON over HTTPS. Send and read WhatsApp on the business number the team already uses. Meta's token stays inside UlaloBots.
Base URL https://api.ulalobots.com/api/v1. No SDK. Any language that can send HTTPS is enough.
curl -sS "https://api.ulalobots.com/api/v1/developer/workspace" \
-H "x-api-key: $ULALOBOTS_API_KEY"console
POST /developer/automation/run uses the same engine as a customer message on WhatsApp. Keep deliverReplies false until you mean to text someone. Any language that can send HTTPS is enough. There is no SDK to install.
curl -sS -X POST "https://api.ulalobots.com/api/v1/developer/automation/run" \
-H "Content-Type: application/json" \
-H "x-api-key: $ULALOBOTS_API_KEY" \
-d '{"contactKey":"customer-123","text":"hello","deliverReplies":false}'console
Paths sit under https://api.ulalobots.com/api/v1. Each key carries its own permissions. Swagger and the OpenAPI file list the live contract.
| Method | Path | Permission | What it does |
|---|---|---|---|
| GET | /developer/workspace | tenant.read | Who this key belongs to, including industry. |
| GET | /developer/flows | flow.read | Guided chats in the workspace. |
| GET | /developer/templates | template.read | Template drafts in the workspace. |
| GET | /developer/conversations | conversation.read | The same inbox the team replies from. |
| GET | /developer/conversations/:id/messages | conversation.read | Messages in one thread. |
| POST | /developer/messages | whatsapp.send | Send a WhatsApp text on the business number. |
| POST | /developer/automation/run | conversation.reply | Send text into the guided chat. Dry-run with deliverReplies false. |
Start in the dashboard. Move to your server when the workspace read returns 200.
UlaloBots opens the business space and the first API key. The key is the identity. You do not send a tenant id from your server.
Connect the WhatsApp business account from UlaloBots. You do not register Meta's webhook yourself. Meta delivers into UlaloBots.
Name the key for the server that will call the API. Copy it once. UlaloBots stores a hash, not the key.
Call GET /developer/workspace from API Playground before live traffic. A 200 confirms the key is bound to that space.
POST /developer/automation/run uses the same engine as WhatsApp. Set deliverReplies to false while you test, so the customer is not texted.
Add an HTTPS callback under Developer, then use Test webhook. Verify the signature and return a 2xx response quickly.
Meta signs WhatsApp into UlaloBots. Separately, UlaloBots can POST signed events to an HTTPS address you control. Each callback has its own whsec_ secret. Verify HMAC-SHA256 over timestamp + "." + raw body, compare v1= from x-ulalobot-signature, and reject timestamps older than five minutes.
message.receivedA customer wrote on WhatsApp.message.sentA message left the business number.message.status.updatedDelivery or read status changed.automation.executedA guided chat ran.A CRM mapping is your build, or a Provider engagement. Scale sends and reads WhatsApp, and it can notify your URL. It does not drop every chat into a CRM for you.
const crypto = require("crypto");
const timestamp = req.header("x-ulalobot-timestamp");
const signature = req.header("x-ulalobot-signature");
const expected = crypto
.createHmac("sha256", process.env.ULALOBOTS_WEBHOOK_SECRET)
.update(timestamp + "." + req.rawBody)
.digest("hex");
const received = signature
.split(",")
.find((part) => part.startsWith("v1="))
?.slice(3);console
Keys are for the server. The inbox and the first reply still come first.
Connect a WhatsApp business number, set the first reply, and answer as a team with the full history.