# API documentation

## Authentication
Send `X-API-Key: YOUR_KEY` over HTTPS. Create keys in the CRM API Keys page.

## POST /api/v1/transactions/event.php
Accepts transaction events and queues a message if an enabled template exists.

Required JSON fields:
- `event_id`: globally unique event identifier
- `event_type`: configured template key, e.g. `sale.created`
- `party`: `name`, `phone`, optional `code`
- `transaction`: transaction-specific values

The response `202 queued` means accepted for local processing, not delivered.

## GET /api/v1/connection/status.php
Returns recent coarse extension connection-state reports. It does not provide chat history or send functionality.

## Provider adapter
Live delivery is intentionally disabled until `app/Services/WhatsAppProvider.php` is replaced with a supported, authorized provider integration.


## Official WhatsApp Cloud API webhook
Callback URL: `https://YOUR-DOMAIN/webhooks/whatsapp.php`

- GET requests validate the configured `webhook_verify_token`.
- POST requests require a valid `X-Hub-Signature-256` calculated with the Meta App Secret.
- New inbound message payloads are stored in `messages` and can be viewed in `public/inbox.php`.
- Outgoing status updates update known messages by provider message ID.
- Configure the `messages` webhook subscription in Meta. This does not import historical WhatsApp Web chats.