Developer DocumentationExplore guides, APIs and resources to build with Sprout
Build with Sprout
Sprout provides two REST APIs. Use the WhatsApp API Gateway to send
messages out, and the Business API to read contacts and conversation
history back. Choose the one that matches what you need to do.
WhatsApp API Gateway
REST · Bearer token · Read and write
Manage WhatsApp message templates, send approved template messages
to recipients, and receive delivery, read and inbound-message
webhook events.
Message template management
Send template messages
Message status webhooks
Incoming customer messages
Business API v1
REST · API key · Read-only
Pull your enterprise's contacts and leads, and the full conversation
history for any contact, into your CRM, data warehouse or reporting
tools.
List contacts and leads
Retrieve conversation history
Rich media, templates and call events
Self-service API keys
Which API do I need?
What you want to do
Use this API
Send a WhatsApp message to a customer
WhatsApp API Gateway
Create, edit or delete a message template
WhatsApp API Gateway
Be notified the moment a message is delivered or read
WhatsApp API Gateway (webhooks)
React to an incoming customer message in real time
WhatsApp API Gateway (webhooks)
Export your leads into a CRM
Business API v1
Read the full chat transcript for a contact
Business API v1
Back-fill past conversations for reporting
Business API v1
The two APIs are separate products with separate base URLs and separate
credentials. Neither one replaces the other.
Getting Started
Choose your APIUse the table above, or the switcher at the top of the sidebar.
Get your credentials Request a bearer token for the Gateway, or create an API key for the
Business API from the Sprout admin UI.
Make your first call Copy a cURL example from any endpoint page and replace the
placeholder values with your own.
API GatewayConnect, automate and scale WhatsApp experiences
Sprout WhatsApp API Gateway
Integrate WhatsApp messaging capabilities into external systems
using a simplified REST API.
The Sprout WhatsApp API Gateway allows developers to manage
WhatsApp message templates, send approved template messages,
receive message-status updates and process incoming customer
messages.
Main Capabilities
Message Template Management
Retrieve, create, edit and delete WhatsApp message templates.
Send Template Messages
Send approved WhatsApp message templates to recipients.
Message Status Updates
Receive asynchronous updates when messages are sent,
delivered or read.
Incoming Customer Messages
Receive customer replies and message details through webhook
events.
Getting Started
Configure the Base URLUse the Sprout WhatsApp API Gateway base URL.
Add AuthenticationInclude the bearer token in the authorization header.
Identify the Required IDs Use the WABA ID, phone number ID and template ID in the
relevant endpoints.
Manage TemplatesRetrieve, create, edit or delete WhatsApp templates.
Send a Template MessageSend an approved template using the phone number ID.
Receive Webhook EventsReceive status updates and incoming customer messages.
Looking for contact and conversation data?
To read your contacts or pull chat transcripts into another system,
use the Business API instead.
Endpoint ConfigurationUse the correct host and API path for every request
Base URL
All API requests must be sent through the Sprout WhatsApp API
Gateway.
Host
app.hellosprout.ai
API Path
/whatsapp-gw/api
Full Base URL
https://app.hellosprout.ai/whatsapp-gw/api
All endpoint paths shown in this documentation must be added after
the base URL.
Secure AccessAuthenticate every request with a bearer token
Authentication
All API endpoints require bearer token authentication.
Message DeliverySend approved templates to recipients
Send Template Message
Send a WhatsApp template message using the connected WhatsApp
business phone number.
POST/<PHONE_NUMBER_ID>/messages
Request Body Fields
Field
Type
Required
Description
messaging_product
string
Yes
Must be whatsapp
to
string
Yes
Recipient number in E.164 format
type
string
Yes
Must be template
template
object
Yes
Template configuration
Template Configuration
NameThe approved template name.
Languageen_US
ComponentsContains the dynamic values required by the template.
Named Parameters
The documented body parameter includes:
Type
Parameter name
Text value
Named parameters allow the template to insert customer-specific
content.
Response
Messaging product: the messaging platform used.
Contacts: the original recipient input and WhatsApp ID.
Messages: the message ID and message status.
The example message status is accepted. An accepted
response means the gateway has taken the message. Actual delivery is
confirmed later through webhook events.
Business APIRead your contacts and conversations programmatically
Sprout Business API v1
Retrieve your enterprise's contacts and their conversation history
through a read-only REST API.
The Business API gives external systems such as a CRM, a data
warehouse or a reporting tool direct access to the leads captured by
your Sprout agents and to the messages exchanged with them. Every
response is automatically limited to your own enterprise's data.
Main Capabilities
List Contacts
Retrieve contacts and leads captured by your agents, newest first,
including any custom fields collected during the conversation.
Conversation History
Retrieve the full message history for a contact, grouped by session,
in the same order as the admin Conversations screen.
Rich Content Support
Text, rich media, template messages, emoji reactions and voice-call
events are all represented in the response.
Self-Service API Keys
Create and revoke API keys yourself from the Sprout admin UI, with
up to five active keys per enterprise.
Important Characteristics
Versionv1
MethodsGET only. Version 1 is read-only.
AuthenticationX-API-Key
Rate limit60 requests per minute per key, by default.
Message retentionThe last 3 months of messages.
Getting Started
Create an API KeyGenerate a key from Integrations, then Sprout API, in the admin UI.
Add the Authentication HeaderSend the key in the X-API-Key header on every request.
List Your ContactsCall the contacts endpoint and store the contact IDs you receive.
Retrieve ConversationsUse a contact ID to pull that contact's full message history.
Poll IncrementallyUse the timestamp filter so you only fetch what has changed.
Need to send messages instead?
The Business API is read-only. To send WhatsApp messages or manage
templates, use the WhatsApp API Gateway.
Getting AccessCreate and manage your enterprise API keys
Create an API Key
API keys are created and revoked by you, from within the Sprout admin
UI.
Steps
Open the Integrations Page In the Sprout admin UI, go to Integrations, then Sprout API, and
select sprout-api.
Create the Key Each enterprise can hold a maximum of five keys at a time.
Copy It Immediately The full key is shown only once, at creation. It cannot be
retrieved afterwards. Only a name and an identifier are stored.
Revoke When No Longer Needed Revoke a key at any time from the same page. Revoked keys stop
working immediately.
Key Format
A key has two parts separated by a dot: a key ID and a secret. Send the
whole value, including the dot, in the authentication header.
<keyId>.<secret>
Scope
Each key is scoped to your enterprise. All API responses are
automatically limited to your enterprise's data, so you never pass an
enterprise ID yourself.
Treat your key like a password
Anyone holding the key can read your contacts and conversation
history. Never publish it, never commit it to a repository, and
revoke it immediately if it is exposed.
Do Not Have Access Yet?
If the Sprout API integration is not enabled on your account, or you
cannot see the Integrations page, submit the form below and our team
will get in touch.
Endpoint ConfigurationBase URL, transport and response conventions
Base URL and Conventions
All Business API requests are sent to a versioned base path over HTTPS.
Base URL
https://<gateway-host>/business-api/v1
Your gateway host is confirmed together with your API access. Replace <gateway-host> with the value supplied for your
account.
Conventions
Item
Value
Transport
HTTPS only
Methods
GET only. Version 1 is read-only.
Authentication header
X-API-Key: <keyId>.<secret>, required on every request
Content type
application/json in responses
Timestamps
ISO-8601 in UTC, for example 2026-07-20T10:15:00Z
IDs
Opaque strings. Do not attempt to parse them.
Correlation
Every response carries X-Correlation-ID. Include it when reporting an issue.
Pagination
Both endpoints use offset pagination through the page and limit query parameters, and return a pagination object in the response.
Field
Description
page
The page that was returned
limit
The page size that was applied
total
Total number of records available
totalPages
Total number of pages available
hasMore
Whether a further page exists
Secure AccessAuthenticate every request with your API key
Authentication
Every Business API request must include your enterprise API key in the X-API-Key header.
Required Header
X-API-Key: <keyId>.<secret>
How the Key Is Validated
The gateway validates the key, enforces the key's rate limit and
endpoint allowlist, and resolves your enterprise before the request
reaches the service.
A missing, malformed, revoked or out-of-scope key is rejected at the
edge with a 401 INVALID_API_KEY response.
Stable contact ID. Use this as the contactId for the messages endpoint.
name
string
Yes
Contact name, if collected.
email
string
Yes
Email address, if collected.
phone
string
Yes
Phone number in E.164 form, if collected.
source
string
No
Acquisition channel: WEB, WHATSAPP, FB or IG. Version 1 returns the
channel only, not the specific web page URL.
customFields
object
No
Key and value map of extra fields the agent collected during the
conversation. May be an empty object. Values are strings.
createdOn
string
No
When the contact was first recorded, in ISO-8601 UTC. This is the sort key.
lastUpdatedOn
string
Yes
The last time the contact record changed.
Notes
Results are sorted by createdOn in descending order.
customFields is derived from the contact's collected
data. Malformed data yields an empty object rather than failing the
whole row.
To poll incrementally, store the highest createdOn you
have seen and pass it as updatedSince on the next call.
Incremental polling is the recommended pattern. It keeps you well
inside the rate limit and avoids re-fetching unchanged data.
MessagesRetrieve the full conversation history for a contact
Get Conversation History
Returns the conversation history for one contact, grouped by session.
Sessions are returned in the same order as the admin Conversations
screen: the newest session first, with messages inside each session
running oldest to newest.
GET/business-api/v1/messages
Query Parameters
Parameter
Type
Default
Constraints and notes
contactId
string
—
Required. An ID returned by the contacts endpoint.
limit
integer
50
Clamped to a value between 1 and 100. Paginates over session
groups, not individual messages.
page
integer
1
Must be 1 or greater.
Pagination works on sessions
A limit of 50 returns up to 50 conversation sessions, each of which
may contain many messages. It does not return 50 messages.
The structure of each object in the response is described on the page.
Response StructureEvery object returned by the messages endpoint
Response Objects
The messages endpoint returns session blocks, each containing messages,
which may in turn carry reactions or call details.
Session Block Object
Field
Type
Nullable
Description
sessionId
string
No
Conversation or session identifier.
personaName
string
Yes
Name of the agent persona for the session, if known.
messages
array
No
Messages in the session, ascending by createdOn.
Message Object
Field
Type
Nullable
Description
messageId
string
No
Message identifier.
sender
string
No
visitor, bot, agent or system.
content
string
No
Message text. For non-text content types the payload is carried as-is.
contentType
string
No
TEXT, JSON, REACT, TEMPLATE_MESSAGE or CALL.
createdOn
string
No
Message timestamp in ISO-8601 UTC.
reactions
array
Yes
Emoji reactions applied to this message. Omitted or null when there are none.
callDetails
object
Yes
Present only when contentType is CALL. Otherwise omitted or null.
Reaction Object
Each entry in a message's reactions array:
Field
Type
Nullable
Description
emoji
string
No
The reaction emoji character.
sender
string
No
Who reacted: visitor for the end user or agent for a human agent.
createdOn
string
No
When the reaction was added, in ISO-8601 UTC.
A standalone message with content type REACT is an event
marker with empty content. The emoji itself is carried in the reactions array of the message it reacts to.
Call Details Object
Present on CALL messages:
Field
Type
Nullable
Description
callId
string
No
Call identifier.
direction
string
No
USER_INITIATED or AGENT_INITIATED.
status
string
No
One of RINGING, INITIATING, CONNECTING, CONNECTED, ACCEPTED, TERMINATED, REJECTED, MISSED, FAILED, AI_CONNECTED or UNKNOWN.
consumerPhone
string
No
End user's phone number in E.164 form.
businessPhone
string
No
Business phone number in E.164 form.
startedAt
string
Yes
Call start time in ISO-8601 UTC, if known.
endedAt
string
Yes
Call end time in ISO-8601 UTC, if known.
duration
string
Yes
Call duration in seconds, if known.
Content TypesWhat the content field holds for each message type
Content Types
The content field is always a string. Its meaning depends
on the contentType.
Content type
What content holds
TEXT
Plain UTF-8 text. This is the default and covers the vast majority of messages.
JSON
A stringified JSON payload, typically rich media such as an
image, video, document, audio clip or sticker, or an
interactive menu.
TEMPLATE_MESSAGE
A stringified JSON WhatsApp template or promotion message, with
a header, body, footer, buttons and optional carousel cards.
REACT
An empty string. The message records an emoji reaction to an
earlier message. There is no inline text payload.
CALL
An empty string. The message marks a voice-call event, for
example a WhatsApp call. There is no inline text payload.
Sample: TEXT
Plain text, the default
{
"messageId": "6690aa11bb22cc33dd44ee55",
"sender": "visitor",
"content": "Hi there, I need help with my order",
"contentType": "TEXT",
"createdOn": "2026-07-20T10:15:00Z"
}
Reading the TranscriptWho sent what, in which order, and for how long it is kept
Senders, Ordering and Retention
Three behaviours determine how a conversation transcript should be read
and displayed.
Sender Mapping
Internal role
API sender
Meaning
user
visitor
Message from the end user or contact.
assistant
bot
Automated persona reply.
agent
agent
Human agent reply.
reader
system
Rare system or internal marker.
Ordering
Within a session, messages are ascending by createdOn, oldest first.
Across sessions, ordering is descending by the session's latest
message, so the most recent conversation comes first.
Pagination through page and limit is applied
over session groups, not over individual messages.
Retention
Retention windowLast 3 months
Only messages from the last three months are returned. This matches the
admin Conversations screen.
Plan for the retention window
If you need a permanent archive of conversations, export and store
them in your own system on a regular schedule. Messages older than
three months are not available through this API.
Error HandlingStatus codes and the standard error body
Errors
All errors return a JSON body with a machine-readable code and a
human-readable message.
Error Response Shape
JSON
{
"error": {
"code": "INVALID_API_KEY",
"message": "The provided API key is missing or invalid."
}
}
Status Codes
HTTP code
Code
When it happens
400
BAD_REQUEST
An invalid or missing query parameter, for example a missing contactId or a non-integer page.
401
INVALID_API_KEY
A missing, malformed, revoked or unscoped API key.
403
FORBIDDEN
The key is not permitted for this endpoint, method or enterprise.
404
CONTACT_NOT_FOUND
The contactId does not exist within your enterprise.
429
RATE_LIMITED
The per-key rate limit has been exceeded.
500
INTERNAL_ERROR
An unexpected server error.
Cross-tenant access is treated as not found, returning 404 rather than 403, so keys cannot be used
to probe for other enterprises' contact IDs.
When reporting an issue, include the X-Correlation-ID header returned with the failing response.
Usage LimitsDesign your polling to stay inside the limit
Rate Limiting
Each API key has a requests-per-minute limit, enforced at the gateway.
Default limit60 requests per minute
When the Limit Is Exceeded
The API returns 429 RATE_LIMITED. Design your polling to
stay within the limit.
Recommended Approach
Use updatedSince on the contacts endpoint so you avoid
re-fetching unchanged data.
Store the highest createdOn you have seen and send it on
the next call.
Request larger pages rather than more frequent calls. The maximum
page size is 100.
Back off and retry after a short delay when you receive a 429 response.
Versioning PolicyHow changes are shipped without breaking your integration
Versioning
The API version appears in the request path.
/business-api/v1
What May Change Within v1
Additive, backward-compatible changes such as new fields or new
optional parameters may ship within version 1.
Breaking Changes
Breaking changes are introduced under a new version prefix, so your
existing integration continues to work against version 1.
Request Authentication Token
Enter your details below and our team will contact you regarding your authentication token request.
✓
Submission successful!
Thank you for your request. Our team will get back to you shortly.
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it. View Privacy Policy and Terms and ConditionsAccept Cookies