The Basics Overview

Base URL

Use Dualhook's connection-scoped WhatsApp runtime:

https://api.dualhook.com/v25.0

The path, method, query, and payload shapes intentionally match the supported WhatsApp Cloud API and WhatsApp Business Management API routes. Runtime requests use api.dualhook.com and a connection-scoped dh_live_... key.

Do not send a Meta access token or appsecret_proof to this endpoint. Dualhook applies both internally.

Authentication

Create a dh_live_... key from the connection's Overview page. It is shown once and is bound to that connection's phone number.

Authorization: Bearer dh_live_...

Dualhook stores only a SHA-256 hash of the key. See Runtime API Authentication for rotation and security guidance.

Send a Message

curl -X POST "https://api.dualhook.com/v25.0/<PHONE_NUMBER_ID>/messages" \
  -H "Authorization: Bearer <DUALHOOK_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "messaging_product":"whatsapp",
    "recipient_type":"individual",
    "to":"12015550123",
    "type":"text",
    "text":{"body":"Hello there"}
  }'

Safe Meta response status codes and JSON remain Graph-compatible. Dualhook never retries message sends automatically because a retry could create a duplicate message. Every response includes X-Dualhook-Request-Id for support correlation.

Allowed Routes

The runtime is not a general Graph API gateway. Its exact allowlist covers:

• message sends, read receipts, and typing indicators
• media upload, metadata, byte download, and delete
• phone and WABA identity, status, quality, limits, and health
• message-template list, create, read, update, and delete
• business-profile read and update
• safe identity-change and calling configuration
• QR code list, create, update, and delete

See the Runtime API Endpoint Reference for every method/path and field allowlist. Arbitrary Graph versions, paths, fields, methods, hosts, and query parameters are rejected.

Inbound Webhooks

Inbound messages, statuses, history, smb_message_echoes, and smb_app_state_sync payloads still route directly from Meta to the webhook URL configured for the connection. They do not pass through the outbound runtime.

Management Operations

Templates, health/status, profiles, safe phone/calling settings, and QR codes are available through the allowlisted runtime. Dashboard management remains available where documented.

Webhook subscriptions and callback overrides, Flows, registration, PINs, number lifecycle, billing, partner assignments, SIP credentials, encryption/storage settings, and other partner-wide or cross-business operations are deliberately unavailable. Dualhook keeps the customer-scoped Meta authorization encrypted server-side and never reveals it through the dashboard or API.