Threadwire by TriTech

← API reference

Changelog

What changed for customers and for systems that use the API, newest first.

Versioning

/v1 is the version. From 5 October 2026, within /v1 we only add: new endpoints, new optional fields in a request, new fields in an answer or an event, new events and new values of a field. So read what you know, and ignore what you do not. Before that, /v1/verifications became /v1/otps without notice.

A change that could break your code (something removed or renamed, or a meaning changed) is announced here before it happens. The words of a message or an error are for people to read and may be reworded: show them, do not match on them.

12 October 2026

  • Connecting a system is one page. Developers → Connect your system now has what another system asks for: each instance's ID to copy, a new API key, your webhook URL and its signing secret. Each is made and shown there.
  • Plans may differ in features. A call to a feature your plan does not include answers 403 with the code feature_not_included, and message names the feature. A running broadcast then pauses with the reason not_included, and you can resume it once the feature is added. Nothing changes for you unless your plan changes; your Billing page says what it is without.
  • The API guides now read in Arabic too. Every guide but this changelog has an Arabic page at /ar/docs/guides/…, with the same sections, code and limits; the link in the top bar switches between the two. A link to a section, such as #what-holds-a-message, works in both.
  • Threadwire has its own address: threadwire.net. The API is at https://threadwire.net/api/v1, and the panel, the guides and this reference moved with it. Nothing breaks: https://threadwire.tri-tech.net/api/v1 keeps answering, with the same keys, so change the address in your system when it suits you. Pages opened on the old address take you to the new one, where you sign in once more.
  • A change your code may notice: the User-Agent of our webhooks, and of our requests for a file you send by url, now names threadwire.net. If a firewall rule matches it, match Threadwire-Webhooks/ and Threadwire/.
  • Our emails now come from [email protected]. If you filter or allow our emails by sender, add it.
  • An address of its own for each instance. A paying customer's instance now reaches WhatsApp from a home address in its own country, not from our server's. On a free trial, instances share ours.
  • A change you may notice: with your first payment, each connected instance reconnects once to move to its address. Automatic warm-up between your own instances starts then too.
  • Links to files in webhooks now start with https://threadwire.net; in API answers they start with the address you called. Links you were already given keep working until they expire.

6 October 2026

  • A change your code may notice: a message that failed or was cancelled no longer has media when its file was sent inline: it is null, and the file is deleted. Files sent by url are not affected.

  • Every error has a code. An API error carries a stable code beside its message, and a waiting or failed message carries error_code. Both lists are in Waiting, errors and retries.

  • Webhooks by API. Set the URL, the events and the authentication header, rotate the signing secret, send a test event and resume a paused endpoint: GET and PATCH /v1/webhook, and the same for one instance. Our deliveries now carry a User-Agent.

  • Reply to someone whose number WhatsApp hides. POST /v1/messages takes the chat_id of a person who wrote to the instance.

  • Limits that protect everyone. An instance with more than 500 messages waiting answers backlog_full, replies excepted. Files sent inline have a daily budget per account. Lists read from the phone are kept 30 seconds.

  • A menu of choices. People answer with a digit; each choice sends an answer, opens a sub-menu or hands the chat to your team. Auto-replies → Menu, or GET and PUT /v1/instances/{id}/menu.

  • Contact fields. Keep a customer number, a city or a date about each person who writes to you, use one in a broadcast as {city}, and narrow a broadcast to a label or a field's value. GET /v1/contact-fields, and GET and PUT /v1/chats/{chat}/contact-fields.

  • Reply times. Admins see on Chats how fast the team answers, and how many chats each teammate handled.

  • Someone who wrote before is not counted as new. A message to a person who wrote in the last 90 days no longer uses one of the day's new people. Every other first-message rule still applies to them.

  • Large files. A received file over 100 MB is not kept; its message says so (file_too_large).

  • Invoices keep the seller details they were issued with.

  • Sign-up no longer says whether an email already has an account, and its "Check your email" page lets a mistyped address be corrected. Getting started now ends with receiving a message.

  • The status page shows an uptime figure, worked out from the outages posted on it. A slowdown or a notice is listed there, not counted.

  • API, things your code may notice.

    • GET /v1/messages lists messages in the order they reached us, newest first. A message stored late can appear below page 1, so follow the message.* events or GET /v1/events for new messages.
    • A new field, written_at, on every message: WhatsApp's own time. It is null on messages you send.
    • An id we do not know answers 404 in plain words: "No message with this id on your account." The same for an instance, a broadcast, an OTP and a status.
    • A cursor we did not give you is a 422. A file url longer than 2,048 characters is a 422.
    • An Idempotency-Key belongs to its instance and is compared exactly, capitals included, for messages, OTPs and broadcasts.
    • A retry with a key already used answers 200 with the header Idempotent-Replayed: true. The first request wins, whatever the second one carried.
    • / and \ in media.filename become -.
    • You may get more message.edited and message.deleted events: for an edit that changes only capitals or accents, and for changes that arrive under a person's private id.
    • GET …/qr and the pairing code answer 409 with the reason while a link was refused.

  • Events are not lost when we stumble. If handling a received message fails part-way, the next try finishes it once: its event, its file, and the automatic answer.

  • After WhatsApp refuses a message, only replies go until the rest ends. Messages to people who wrote before, to groups and to channels wait with the new chats. See Protection.

  • One WhatsApp number, one instance. A number already linked to another instance is not linked a second time, and the instance says why.

  • Opt-outs hold. Editing a message never lifts one. After "STOP", a person stays out of broadcasts until they send "START", even once you are talking again.

  • A message that may have gone counts. One that failed with "it may have been delivered" now counts toward the day's limits, so a retry cannot repeat it to a stranger.

  • Webhooks. When a paused endpoint resumes, its waiting events go a few at a time. Received files have a queue of their own, so one customer's backlog no longer delays another's files.

  • Billing. Changing plan converts the days you have left by price, and the Billing page shows the result before you pay. "Forgot password?" links last one hour; invitations still last 7 days.

  • The panel on a phone. Lists fit the screen with their actions in reach. A chat has "Mark as done", "Assign" and one "Other actions" menu. Linking offers the code first when WhatsApp is on the same phone.

  • Arabic. The Activity log reads in Arabic, and one word is used for each idea across the panel.

  • Plainer statuses. A message shows as "Waiting" and "Not sent" in the panel. The API's values, queued and failed, did not change.

  • New guides: Waiting, errors and retries and Official API or a linked number.

5 October 2026

  • OTP. "Verification" is now called OTP everywhere: /v1/otps in the API, the events otp.completed and otp.failed, and its own OTP page in the panel with "Try it". The older /v1/verifications paths no longer work. See WhatsApp OTP.
  • Broadcasts. One message to many people who wrote to you, each sent on its own, paced, with an opt-out line. A broadcast pauses by itself when the instance is at risk. POST /v1/broadcasts, and the events broadcast.paused and broadcast.completed. See Broadcasts.
  • One word, "instance". The panel, the emails and the API's messages call a linked number an instance. Error texts changed with it: "This number is not connected." is now "This instance is not connected."
  • A simpler panel. "Connect WhatsApp" and "Connect your system" walk a new admin through setup. An instance's page has tabs. The inbox shows the chat list beside the conversation, with "New chat". Home has a card per instance. Ctrl + K (⌘ + K on a Mac) jumps to a chat or an instance.
  • One Developers item for admins, with tabs: Connect, API keys, Webhooks, Event log, API requests and Message log. "API requests" shows the last 24 hours of calls and how each was answered, never what a call carried.
  • More from a chat: react, edit, delete for everyone, send a poll, a location or a contact card, send a picture as a sticker, and archive the chat or mark it unread on the phone.
  • Groups from the panel: rename a group, change who may write in it, add or remove people, and reset its invite link.
  • Emails. Arabic emails read right to left. Each person chooses on their profile which emails they get. An instance that keeps dropping its connection sends one email, not one per drop.

4 October 2026

  • The AI agent. An instance can answer people who write to it, with your own Anthropic or OpenAI key, from what you tell it about your business. See The AI agent.
  • WhatsApp OTP. Confirm that someone holds a phone number, by a link they send from WhatsApp, or by a code the instance sends.
  • Events by polling. GET /v1/events gives the same events as your webhook, for systems with no public address. See Webhooks and events.
  • Chat history from the phone: GET /v1/instances/{id}/chats/{phone}/history.
  • Your own protection settings. Make an instance's protection stricter, or adjust it within safe limits, in the panel or with protection_settings. Nothing switches it off.
  • A safety score for each instance, from 100 down, with its reasons and the next step: protection.safety in the API, and on the instance's page.
  • Warm-up by volume. For two weeks after linking, an instance may send 50 messages a day that are not replies, rising to 200. Replies always go.
  • Someone who does not answer is not written to first again for 7 days after the last message. The refusal gives the date.
  • Time zones by area code in North America, Brazil and Mexico, for quiet hours and daily limits.
  • The API reference opens with a short overview, with a guide for each topic, and a Postman collection to download.
  • A Laravel package, tritech/threadwire-laravel. See Tools and code samples.
  • "Send again" for events in the panel's Webhooks log, one or many.
  • The inbox has an "Unassigned" tab.

3 October 2026

  • Link with a code typed on the phone, instead of the QR code: POST /v1/instances/{id}/pairing-code, and "Link with a phone number instead" in the panel.
  • Reactions. What people react with is kept on the message as reactions, and sent as a message.reaction event.
  • A time zone per instance, from its phone's country, for quiet hours and every daily limit.
  • Someone new who has not answered gets at most 3 messages a day: the first one and two more.
  • The same file with the same caption may open at most 5 chats a day, as the same text may.
  • Cancel a queued message: DELETE /v1/messages/{id}, or "Cancel" in the panel.
  • The inbox: send a file with a caption, and see chats under All, Needs a reply, Done and Mine. Chats take labels and team notes.
  • A Help page in the panel, in English and Arabic.
  • AI agents that use our MCP server can read past the first page of a list.

2 October 2026

  • Instances. "Numbers" became "Instances", each with its own page. An API key can be made for one instance only.
  • Restart, stop, start and unlink an instance, in the panel and the API.
  • A webhook URL per instance, with its own signing secret.
  • Groups and channels: send, receive, create and manage, with the events group.message and group.update.
  • Statuses: post one, delete it, and see who viewed it. Orders and products people send from a catalog are kept as such.
  • Chats and contacts in the API, archive and unread, WhatsApp Business labels, and the instance's own WhatsApp profile.
  • Calls: the events call.received and call.rejected, and reject_calls to decline them.
  • Edit a sent text within 15 minutes, and delete a sent message for everyone within two days. Changes made anywhere arrive as message.edited and message.deleted.
  • Stickers, polls with their votes, and link previews.
  • An MCP server for AI agents, code samples in C#, Java, Go and Ruby, and an authentication header for your webhook.
  • Sign up yourself, with a 7-day free trial.
  • Users and roles: admins and members.

1 October 2026

  • Is a phone on WhatsApp? POST /v1/instances/{id}/check.
  • Two-step sign-in with an authenticator app.
  • Paying: by InstaPay, mobile wallet or bank transfer, with an invoice for each payment, and less to pay for 3, 6 or 12 months ahead.

30 September 2026

29 September 2026

  • The team inbox: read and answer chats from the panel, with saved answers.
  • Auto-replies: keyword, away and welcome.
  • More in the API: locations, contact cards, scheduled messages, quoted replies, reactions, read marks and message history.
  • Webhooks: choose which events you get; a new signing secret works beside the old one for 24 hours.
  • API keys that only read, or only send and read, and keys locked to your IP addresses.
  • First messages to someone new: at most 600 characters, and one text may open at most 5 chats a day.
  • A public status page, with incidents.
  • Arabic: the panel, the public page and the emails.
  • An activity log of who changed what.