Dokumentasi API

List semua session Anda.

curl https://maublast.net/api/v1/sessions \
  -H "Authorization: Bearer YOUR_TOKEN"

Response:

[
  {
    "session_id": "sess_abc123",
    "name": "Marketing Utama",
    "status": "logged_in",
    "phone_number": "628123456789",
    "push_name": "MAUBLAST",
    "created_at": "2026-04-20T08:00:00Z"
  }
]

Buat session baru. Setelah dibuat, lanjut panggil /connect untuk mulai pairing.

curl -X POST https://maublast.net/api/v1/sessions \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Marketing Utama", "device": {"os": "Windows", "platform": "desktop"}}'

Cek status koneksi. Nilai status: disconnected, waiting_for_qr, waiting_for_pairing_code, logged_in.

curl https://maublast.net/api/v1/sessions/SESSION_ID/status \
  -H "Authorization: Bearer YOUR_TOKEN"

Ambil QR code terkini (saat status waiting_for_qr). QR auto-rotate tiap ~20 detik — polling tiap 2-3s.

{ "qr_codes": ["2@abc...", "2@def..."] }

Generate kode pairing 8 digit (alternatif scan QR). Field device opsional (sama seperti di create session).

curl -X POST https://maublast.net/api/v1/sessions/SESSION_ID/pair \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"phone": "628123456789", "device": {"os": "Windows", "platform": "desktop"}}'

Mulai proses pairing. Setelah ini, poll /qr atau pakai /pair. Body opsional untuk override identitas perangkat.

curl -X POST https://maublast.net/api/v1/sessions/SESSION_ID/connect \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"device": {"os": "Windows", "platform": "desktop"}}'

Putus koneksi. Session tetap tersimpan, tinggal /connect lagi kalau mau aktifin ulang.

Hapus session permanen (logout dari WA + hapus record).

Kirim pesan teks. Support formatting: *bold*, _italic_, ~strike~, ```mono```.

curl -X POST https://maublast.net/api/v1/sessions/SESSION_ID/messages/text \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "628123456789",
    "text": "Halo, ini pesan dari API."
  }'

Struktur sama dengan image, field video.url atau video.base64. MP4 direkomendasikan, max 16MB.

{
  "to": "628123456789",
  "video": { "url": "https://cdn.example.com/demo.mp4" },
  "caption": "Demo produk"
}

Kirim audio/voice note (format OGG, MP3, AAC). Set ptt: true untuk voice note.

{
  "to": "628123456789",
  "audio": { "url": "https://cdn.example.com/voice.ogg" },
  "ptt": true
}

{
  "to": "628123456789",
  "document": { "url": "https://cdn.example.com/invoice-123.pdf" },
  "filename": "invoice-123.pdf",
  "caption": "Invoice order #123"
}

{
  "to": "628123456789",
  "latitude": -6.2088,
  "longitude": 106.8456,
  "name": "Kantor Pusat",
  "address": "Jl. Sudirman No. 1, Jakarta"
}

{
  "to": "628123456789",
  "contact": {
    "display_name": "Customer Service",
    "phones": [
      { "number": "628555666777", "phone_type": "CELL" }
    ]
  }
}

Max 12 opsi. selectable_count: 0 = unlimited (multi-select).

{
  "to": "628123456789",
  "name": "Produk mana yang paling menarik?",
  "options": ["Produk A", "Produk B", "Produk C"],
  "selectable_count": 1
}

Native flow buttons. Tipe button: quick_reply, cta_url, cta_copy, cta_call.

{
  "to": "628123456789",
  "body_text": "Mau lanjut ke step mana?",
  "footer_text": "Powered by MAUBLAST",
  "buttons": [
    { "name": "quick_reply",
      "button_params_json": "{\"display_text\":\"Ya, lanjut\",\"id\":\"btn_yes\"}" },
    { "name": "cta_url",
      "button_params_json": "{\"display_text\":\"Lihat detail\",\"url\":\"https://example.com\"}" },
    { "name": "cta_call",
      "button_params_json": "{\"display_text\":\"Telepon kami\",\"phone_number\":\"+6281234567890\"}" }
  ]
}

Single tombol Call-To-Action yang membuka URL di browser. Lebih sederhana dari /messages/interactive karena tidak perlu construct button_params_json manual.

{
  "to": "628123456789",
  "body_text": "Lihat katalog terbaru kami",
  "footer_text": "Promo bulan ini",
  "display_text": "Buka katalog",
  "url": "https://example.com/katalog",
  "merchant_url": "https://example.com"
}

1–3 tombol reply cepat. Modern native-flow — pengganti /messages/buttons legacy, lebih reliable di iOS & WA versi baru. id dikirim balik ke webhook saat tombol ditekan.

{
  "to": "628123456789",
  "body_text": "Ada yang bisa kami bantu?",
  "footer_text": "Reply kapan saja",
  "buttons": [
    { "id": "support",  "display_text": "Hubungi support" },
    { "id": "billing",  "display_text": "Tagihan" },
    { "id": "feedback", "display_text": "Beri masukan" }
  ]
}

Menu dropdown multi-section.

{
  "to": "628123456789",
  "title": "Menu utama",
  "description": "Silakan pilih layanan",
  "footer": "MAUBLAST",
  "button_text": "Lihat menu",
  "sections": [
    {
      "title": "Layanan",
      "rows": [
        { "row_id": "order", "title": "Pesan produk", "description": "Order & bayar" },
        { "row_id": "track", "title": "Cek status", "description": "Status pesanan" }
      ]
    }
  ]
}

Buat dan antrikan kampanye. Response 202 dengan ID kampanye.

curl -X POST https://maublast.net/api/v1/blast \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Kampanye Promo Lebaran",
    "message": "Halo {{nama}}, ada {diskon 20%|promo spesial} buat kamu!",
    "mode": "balanced",
    "rotator_group_id": 3,
    "recipients": [
      {"phone": "628111111111", "name": "Budi"},
      {"phone": "628222222222", "name": "Ani"},
      {"phone": "628333333333", "name": "Charlie"}
    ],
    "skip_night": true
  }'

Response (202):

{
  "id": 47,
  "name": "Kampanye Promo Lebaran",
  "status": "queued",
  "total": 3,
  "sent": 0,
  "ok": 0,
  "failed": 0,
  "progress_pct": 0,
  "mode": "balanced",
  "created_at": "2026-04-22T10:00:00Z"
}

Cek progress kampanye. Poll tiap 2-5 detik untuk update real-time.

curl https://maublast.net/api/v1/blast/47 \
  -H "Authorization: Bearer YOUR_TOKEN"

{
  "id": 47,
  "status": "running",
  "total": 3,
  "sent": 2,
  "ok": 2,
  "failed": 0,
  "progress_pct": 66,
  "last_error": null,
  "started_at": "2026-04-22T10:00:04Z",
  "completed_at": null
}

List kampanye Anda. Query: limit (default 20, max 100), status (filter).

curl "https://maublast.net/api/v1/blast?status=running&limit=10" \
  -H "Authorization: Bearer YOUR_TOKEN"

Pause, resume, cancel

Mode preset

Shortcut setting siap pakai. Anda bisa override field individual kalau perlu.

Fake reply (anti-ban)

Bungkus tiap pesan blast seolah-olah balasan ke pesan dummy sebelumnya (produk listing, order, lokasi, video review, dll). WhatsApp melihatnya sebagai conversational context — mengurangi risiko terdeteksi sebagai broadcast spam. Data dummy (nama produk, harga, lokasi mall, nama kontak Indonesia) ter-random tiap pesan.

Field:

Contoh launch dengan fake reply product:

curl -X POST https://maublast.net/api/v1/blast \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "Kak, produk ini masih ready ya? Mau order 2",
    "mode": "balanced",
    "session_id": "SESSION_ID",
    "recipients": [{"phone": "628111111111", "name": "Budi"}],
    "fake_reply": {
      "type": "product",
      "title": "Sepatu Nike Air Max 270",
      "body": "Ready stock, bisa COD"
    }
  }'

Contoh lengkap: launch + monitor

Node.js:

const TOKEN = process.env.MAUBLAST_TOKEN;
const BASE = "https://maublast.net/api/v1";

async function launch() {
  const res = await fetch(`${BASE}/blast`, {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: "Promo weekend",
      message: "Halo {{nama}}, {diskon 20%|promo spesial} buat kamu hari ini",
      mode: "balanced",
      session_id: "SESSION_ID",
      skip_night: true,
      recipients: [
        { phone: "628111111111", name: "Budi" },
        { phone: "628222222222", name: "Ani" },
      ],
    }),
  });
  return await res.json();
}

async function waitComplete(id) {
  while (true) {
    const res = await fetch(`${BASE}/blast/${id}`, {
      headers: { "Authorization": `Bearer ${TOKEN}` },
    });
    const c = await res.json();
    console.log(`[${c.status}] ${c.sent}/${c.total} (OK:${c.ok}, Fail:${c.failed})`);
    if (["completed", "cancelled", "failed"].includes(c.status)) return c;
    await new Promise(r => setTimeout(r, 3000));
  }
}

const campaign = await launch();
console.log("Launched:", campaign.id);
const final = await waitComplete(campaign.id);
console.log("Done:", final);

Python:

import os, time, requests

TOKEN = os.environ["MAUBLAST_TOKEN"]
BASE = "https://maublast.net/api/v1"
HEADERS = {"Authorization": f"Bearer {TOKEN}"}

def launch():
    r = requests.post(f"{BASE}/blast", headers=HEADERS, json={
        "name": "Promo weekend",
        "message": "Halo {{nama}}, promo spesial buat kamu",
        "mode": "balanced",
        "session_id": "SESSION_ID",
        "skip_night": True,
        "recipients": [
            {"phone": "628111111111", "name": "Budi"},
            {"phone": "628222222222", "name": "Ani"},
        ],
    })
    r.raise_for_status()
    return r.json()

def wait_complete(id):
    while True:
        c = requests.get(f"{BASE}/blast/{id}", headers=HEADERS).json()
        print(f"[{c['status']}] {c['sent']}/{c['total']} OK:{c['ok']} Fail:{c['failed']}")
        if c["status"] in ("completed", "cancelled", "failed"):
            return c
        time.sleep(3)

campaign = launch()
print("Launched:", campaign["id"])
final = wait_complete(campaign["id"])
print("Done:", final)

PHP:

<?php
$TOKEN = getenv("MAUBLAST_TOKEN");
$BASE = "https://maublast.net/api/v1";

function req($method, $path, $token, $body = null) global $BASE;
function apiCall($method, $path, $token, $body = null) {
  global $BASE;
  $ch = curl_init($BASE . $path);
  $headers = ["Authorization: Bearer $token"];
  if ($body !== null) {
    $headers[] = "Content-Type: application/json";
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
  }
  curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => $method,
    CURLOPT_HTTPHEADER => $headers,
    CURLOPT_RETURNTRANSFER => true,
  ]);
  $resp = curl_exec($ch);
  curl_close($ch);
  return json_decode($resp, true);
}

$campaign = apiCall("POST", "/blast", $TOKEN, [
  "name" => "Promo weekend",
  "message" => "Halo {{nama}}, promo spesial",
  "mode" => "balanced",
  "session_id" => "SESSION_ID",
  "recipients" => [
    ["phone" => "628111111111", "name" => "Budi"],
    ["phone" => "628222222222", "name" => "Ani"],
  ],
]);

$id = $campaign["id"];
echo "Launched: $id\n";
while (true) {
  $c = apiCall("GET", "/blast/$id", $TOKEN);
  echo "[{$c['status']}] {$c['sent']}/{$c['total']}\n";
  if (in_array($c["status"], ["completed", "cancelled", "failed"])) break;
  sleep(3);
}

List semua kontak yang tersimpan di session. Query param: limit, offset.

[
  {
    "jid": "628123456789@s.whatsapp.net",
    "phone": "628123456789",
    "push_name": "Budi S",
    "is_business": false
  }
]

Cek apakah nomor terdaftar di WhatsApp (sebelum blast).

// Request
{ "phones": ["628111111111", "628222222222"] }

// Response
[
  { "phone": "628111111111", "exists": true, "jid": "628111111111@s.whatsapp.net" },
  { "phone": "628222222222", "exists": false }
]

List grup WA. JID grup format xxxxx@g.us.

Ambil riwayat chat untuk JID tertentu. Query: limit, before_id.

Daftar event

Format payload

Semua payload dikirim sebagai POST application/json. Struktur dasar:

{
  "event": "message",
  "session_id": "SESSION_ID",
  "timestamp": 1734000000,
  "data": {
    "from": "628123456789@s.whatsapp.net",
    "from_me": false,
    "push_name": "John Doe",
    "message_id": "3EB0ABC...",
    "type": "text",
    "text": "Halo admin"
  }
}

Payload media (image/video/document) tambah field media:

{
  "event": "message",
  "data": {
    "type": "image",
    "caption": "Invoice",
    "media": {
      "mime_type": "image/jpeg",
      "file_length": 45678,
      "url": "https://cdn.maublast.net/media/abc.jpg"
    }
  }
}

Verifikasi signature HMAC

Kalau secret diset, tiap request membawa header X-MAUBLAST-Signature berisi HMAC SHA256 dari raw body. Verifikasi di server Anda:

import crypto from "crypto";
import express from "express";

const app = express();

// IMPORTANT: pakai raw body, bukan parsed JSON
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.headers["x-maublast-signature"];
  const expected = crypto
    .createHmac("sha256", process.env.WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");

  if (sig !== expected) return res.status(401).end();

  const payload = JSON.parse(req.body);
  console.log(payload.event, payload.session_id);
  res.json({ ok: true });
});

import hmac, hashlib, os
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["WEBHOOK_SECRET"].encode()

@app.post("/webhook")
def webhook():
    sig = request.headers.get("X-MAUBLAST-Signature", "")
    expected = hmac.new(SECRET, request.data, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        return "", 401
    payload = request.json
    print(payload["event"], payload["session_id"])
    return {"ok": True}

<?php
$raw = file_get_contents("php://input");
$sig = $_SERVER["HTTP_X_MAUBLAST_SIGNATURE"] ?? "";
$expected = hash_hmac("sha256", $raw, getenv("WEBHOOK_SECRET"));

if (!hash_equals($expected, $sig)) {
  http_response_code(401);
  exit;
}

$payload = json_decode($raw, true);
error_log($payload["event"] . " dari " . $payload["session_id"]);
echo json_encode(["ok" => true]);

Retry policy

Kalau endpoint Anda tidak balas 2xx dalam 10 detik, kami retry:

Idempotency: karena ada retry, endpoint Anda bisa terima event yang sama lebih dari sekali. Gunakan data.message_id untuk dedupe di Redis/DB (TTL 24 jam).