Your integration.
Your business credentials.
Use a scoped Sohan Soft Tech API key to call your business workspace. Meta credentials stay encrypted on the server.
Authenticate with your Sohan API key
Create a key in Workspace → API & developers. Choose scopes and expiry. Copy it once and store it in your server’s secret manager.
Authorization: Bearer sst_YOUR_API_KEY Content-Type: application/json
The key determines your tenant. Do not send another workspace’s x-tenant-id. Wallet recharge, Meta account connection and platform administration require OTP session authentication.
Send an approved template
curl https://wab.sohansoft.in/api/messages \
-H 'Authorization: Bearer sst_YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"contactId":"YOUR_CONTACT_ID","phoneId":"YOUR_PHONE_RECORD_ID","templateId":"YOUR_APPROVED_TEMPLATE_ID","idempotencyKey":"YOUR_UNIQUE_REQUEST_ID"}'The response identifies the queued message. Delivery and read state are updated from verified Meta webhooks; enqueueing does not mean delivery.
Supported bearer operations
| Method | Path | Scope |
|---|---|---|
| GET | /api/contacts | contacts.read |
| POST | /api/contacts | contacts.manage |
| PATCH | /api/contacts/{id} | contacts.manage |
| DELETE | /api/contacts/{id} | contacts.manage |
| POST | /api/contacts/{id}/consent | contacts.manage |
| GET | /api/contacts/export | contacts.read |
| GET | /api/numbers | numbers.read |
| GET | /api/templates | templates.read |
| POST | /api/templates | templates.manage |
| GET | /api/messages | messages.read |
| POST | /api/messages | messages.send |
| GET | /api/conversations | conversations.read |
| GET | /api/campaigns | campaigns.read |
| POST | /api/campaigns | campaigns.manage |
| GET | /api/billing | billing.read |
| GET | /api/usage | usage.read |
| GET | /api/subscriptions | billing.read |
| POST | /api/templates/sync | templates.manage |
| PATCH | /api/conversations/{id} | conversations.manage |
| POST | /api/conversations/{id}/notes | conversations.manage |
| POST | /api/campaigns/{id}/start | campaigns.manage |
| POST | /api/campaigns/{id}/pause | campaigns.manage |
| POST | /api/campaigns/{id}/resume | campaigns.manage |
| POST | /api/campaigns/{id}/cancel | campaigns.manage |
Rotate without exposing old secrets
Create a replacement with an overlap of 0–24 hours. Deploy the new key to your integration, then revoke the old key. Expired, revoked or out-of-scope keys are rejected; old plaintext keys cannot be retrieved.
Errors and retrying
Errors use an error.code and error.message object. A 429 means rate limiting; wait before retrying. Reuse the same message idempotency key for retries. An UNKNOWN provider outcome requires reconciliation and must not be blindly resent.