Начать

REST · JSON · HTTPS

System X WhatsApp API

Send and receive WhatsApp messages from your CRM, website or ERP. Statuses, signed webhooks, scoped keys.

Русский · https://app.system-x.asia/api/v1

Authentication

Create a key in the dashboard: Settings → API for developers. The key is shown once. Scopes: send-only or full (can read conversations). Pass it as a header:

HTTP
Authorization: Bearer sx_xxxxxxxx_…

Send a message — POST /v1/messages

curl
curl -X POST https://app.system-x.asia/api/v1/messages \
  -H "Authorization: Bearer sx_xxxxxxxx_…" \
  -H "Content-Type: application/json" \
  -d '{"to": "77011234567", "text": "Ваш заказ готов"}'
JavaScript
const r = await fetch("https://app.system-x.asia/api/v1/messages", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.SX_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({ to: "77011234567", text: "Ваш заказ готов" }),
})
const data = await r.json()  // { id, to, status }
Python
import os, requests

r = requests.post("https://app.system-x.asia/api/v1/messages",
                  headers={"Authorization": f"Bearer {os.environ['SX_KEY']}"},
                  json={"to": "77011234567", "text": "Ваш заказ готов"}, timeout=15)
print(r.json())  # {'id': ..., 'to': ..., 'status': 'sent'}

Message status — GET /v1/messages/{id}

curl
curl https://app.system-x.asia/api/v1/messages/wamid.HBgM… -H "Authorization: Bearer sx_…"

Incoming messages (full scope) — GET /v1/messages?since=2026-09-29T00:00:00+05:00

curl
curl "https://app.system-x.asia/api/v1/messages?since=2026-09-29T00:00:00%2B05:00" -H "Authorization: Bearer sx_…"

Key and quota — GET /v1/me

curl
curl https://app.system-x.asia/api/v1/me -H "Authorization: Bearer sx_…"

Webhooks

Set an https URL in the dashboard. Each event is a POST with JSON and the X-SX-Signature header: t=timestamp,v1=HMAC-SHA256(secret, "timestamp.body"). Reply 2xx; failed deliveries are retried up to 5 times with backoff.

JSON
{
  "event": "message.incoming",
  "data": { "id": "wamid.HBgM…", "from": "77011234567", "text": "Здравствуйте", "at": "2026-09-29T10:15:00+05:00" }
}

Verifying the signature

Python
import hashlib, hmac, time

def verify(secret: str, body: bytes, header: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts = int(parts["t"])
    if abs(time.time() - ts) > 300:
        return False
    mac = hmac.new(secret.encode(), f"{ts}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, parts["v1"])
JavaScript
import crypto from "node:crypto"

export function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")))
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false
  const mac = crypto.createHmac("sha256", secret).update(`${parts.t}.`).update(rawBody).digest("hex")
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(parts.v1))
}

Errors

401missing, invalid or revoked key
402API plan is not active
403key scope is not enough
409no connected WhatsApp line
422invalid phone or text
429rate limit or plan quota exceeded

Limits and pricing

120 requests per minute per key. Outgoing messages are counted by the API plan: 1,000 — 2,900 KZT, 10,000 — 5,900 KZT, 50,000 — 8,900 KZT per month, paid from the organization balance. Over the quota — 429.

↑