WhatsApp Calling API

WhatsApp Business voice/video call capability management Base path: /api/v1/whatsapp Endpoint count: 3

title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

Errors worth branching on

These five failures cover the call initiate (POST /api/v1/whatsapp-calling/calls), on every click-to-call. Each block below is a full { error, meta } envelope as the API returns it, and the matrix at the bottom answers retry vs surface for the same five classes. For the platform-wide decision table these branches plug into, see the error handling guide.

401 — Unauthorized

  {
    "error": {
      "code": "UNAUTHORIZED",
      "message": "The API key is invalid, expired, or lacks the required scope.",
      "status": 401
    },
    "meta": {
      "request_id": "req_whatsappa1",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

A 401 on this page is the bearer key failing before the route ran — it never means the resource is wrong. Rotate the key or re-mint the scoped token; retrying the same request changes nothing.

403 — Forbidden

  {
    "error": {
      "code": "FORBIDDEN",
      "message": "The key is valid but does not have the scope this operation requires.",
      "status": 403
    },
    "meta": {
      "request_id": "req_whatsappa1f",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

A 403 means the key authenticated but the operation is gated by scope — check the key’s scopes on the developer page; a 403 is never a data-not-found shape.

422 — Schema

  {
    "error": {
      "code": "VALIDATION_ERROR",
      "message": "The request failed input validation.",
      "status": 422,
      "details": { "field": "to", "value": "+1 555 0123", "expected": "an E.164 MSISDN with no spaces" }
    },
    "meta": {
      "request_id": "req_whatsappb2",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

A 422 means the payload did not match the request schema — branch on error.details.field and resend with the MSISDN in E.164 form instead of blind-retrying the same body.

429 — Rate

  {
    "error": {
      "code": "RATE_LIMITED",
      "message": "Too many requests in the current window.",
      "status": 429,
      "details": { "retry_after": 12 }
    },
    "meta": {
      "request_id": "req_whatsappc3",
      "timestamp": "2026-09-03T12:00:00Z",
      "docs_url": "https://docs.orbit.devotel.io/errors/RATE_LIMITED"
    }
  }

The Retry-After header and error.details.retry_after are both set on every 429 — resend the SAME request after the lower of the two.

402 — Feature gate

  {
    "error": {
      "code": "WHATSAPP_CALLING_NOT_ENABLED",
      "message": "WhatsApp calling is not enabled on this WABA sender.",
      "status": 402,
      "details": { "waba_id": "waba_0192" }
    },
    "meta": {
      "request_id": "req_whatsappd4",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

Surface the WABA enablement screen; the voice fallback still works for the number.

60-second retry matrix

Class	Meaning	Branch response
401 `UNAUTHORIZED`	the bearer key itself fails	Surface. Rotate the key or re-mint the scoped token; do not retry the same request.
403 `FORBIDDEN`	the key lacks this operation’s scope	Surface. Fix the key’s scope set; a retry with the same key never heals it.
422 `VALIDATION_ERROR`	the payload does not match the schema	Fix, then resend intentionally. Branch on `error.details.field`; a blind retry repeats the same 422.
429 `RATE_LIMITED`	the window quota is exhausted	Retry after `error.details.retry_after` (or the `Retry-After` header) with the same request body.
`WHATSAPP_CALLING_NOT_ENABLED` (402 feature gate)	page-specific gating	Branch on `error.code`. Surface the WABA enablement screen; the voice fallback still works for the number.

WhatsApp Business Calling KPIs

GET /api/v1/whatsapp/calling/analytics

Returns aggregated KPIs (totals, answered, declined, missed, failed, avg duration, total cost) plus a per-day call-volume trend over a configurable window (1-365 days, default 30).

string

—

string

—

integer

—

string (enum: true|false)

Sandbox opt-in for Clerk-session-authenticated requests. Set to true to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response meta.test_mode: true. Ignored for live API keys (dv_live_sk_*) — server-to-server clients must use a test-prefixed key (dv_test_sk_*) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/whatsapp/calling/analytics" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/whatsapp/calling/analytics', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/whatsapp/calling/analytics", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/whatsapp/calling/analytics", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/whatsapp/calling/analytics')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/whatsapp/calling/analytics');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "totals": {
      "total_calls": 0,
      "answered_calls": 0,
      "declined_calls": 0,
      "missed_calls": 0,
      "failed_calls": 0,
      "avg_duration_seconds": 0,
      "total_cost_cents": 0,
      "cost_currency": null
    },
    "trend": [
      {
        "day": "string",
        "calls": 0,
        "answered": 0,
        "declined": 0
      }
    ]
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z"
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0,
    "details": {}
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z",
    "docs_url": "https://example.com"
  }
}

List WhatsApp Business Call logs

GET /api/v1/whatsapp/calling/calls

Cursor-paginated list of wa_call_logs rows. Phone columns are masked for viewer/billing roles; owner/admin/developer see raw E.164. The q search covers phone + contact_name + conversation_id columns.

string

CSV of statuses to include. Allowed: queued, ringing, in_progress, completed, failed, missed.

string (enum: inbound|outbound)

—

string

—

string

—

string

—

string

—

string

—

string

—

integer

—

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": [
    {
      "id": "msg_3f6a81c2d4e5471a9b0c2d5e",
      "meta_call_id": null,
      "waba_id": null,
      "phone_number_id": null,
      "direction": "inbound",
      "status": "queued",
      "end_reason": null,
      "from": null,
      "to": null,
      "contact_id": null,
      "contact_name": null,
      "conversation_id": null,
      "duration_seconds": null,
      "cost_amount_cents": null,
      "cost_currency": null,
      "recording_consent": null,
      "started_at": null,
      "ended_at": null,
      "created_at": "1970-01-01T00:00:00.000Z"
    }
  ],
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z",
    "pagination": {
      "cursor": "string",
      "has_more": false,
      "total": 0
    }
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0,
    "details": {}
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z",
    "docs_url": "https://example.com"
  }
}

Initiate an outbound WhatsApp Business Call (Phase 5)

POST /api/v1/whatsapp/calling/calls

Initiate a WhatsApp Business outbound call. Walks pre-flight gates: connection lookup + access-token decrypt, country block-list (WA_CALLING_BLOCKED_COUNTRIES), calling-enabled flag on the WABA, and recipient call-permission grant. Permission-missing returns 422 with code WHATSAPP_CALLING_NO_PERMISSION; the dashboard surfaces a CTA to send the call-permission template first.

string

Stripe-style idempotency token. Pass a stable, client-generated value (1-255 chars) to dedupe retries on transient timeouts. The same key+credential+path replays the original response for 24h on 2xx (5min on 4xx, 30s on 5xx). Returns 409 if a concurrent request with the same key is already in flight; replayed responses include the Idempotency-Replay: true response header.

string (enum: true|false)

string

required

Recipient phone number (E.164, optional leading +).

string

required

Meta phone_number_id of the sender WABA number.

string

—

string

Echoed back on every webhook event for the call (correlation handle).

string

SDP offer for browser-side WebRTC. Omit for server-bridged calls.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "to": "+14155552671",
  "from_phone_number_id": "+14155552671"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "to": "+14155552671",
  "from_phone_number_id": "+14155552671"
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls", headers=headers, json={
  "to": "+14155552671",
  "from_phone_number_id": "+14155552671"
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls", bytes.NewBuffer([]byte(`{
  "to": "+14155552671",
  "from_phone_number_id": "+14155552671"
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "to": "+14155552671",
  "from_phone_number_id": "+14155552671"
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/whatsapp/calling/calls');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "to": "+14155552671",
  "from_phone_number_id": "+14155552671"
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "id": "msg_3f6a81c2d4e5471a9b0c2d5e",
    "meta_call_id": null,
    "status": "delivered"
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z"
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0,
    "details": {}
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z",
    "docs_url": "https://example.com"
  }
}

API Reference

All Endpoints

WhatsApp Calling API

WhatsApp Calling API

title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

Errors worth branching on

401 — Unauthorized

403 — Forbidden

422 — Schema

429 — Rate

402 — Feature gate

60-second retry matrix

WhatsApp Business Calling KPIs

List WhatsApp Business Call logs

Initiate an outbound WhatsApp Business Call (Phase 5)

​WhatsApp Calling API

​title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

​Errors worth branching on

​401 — Unauthorized

​403 — Forbidden

​422 — Schema

​429 — Rate

​402 — Feature gate

​60-second retry matrix

​WhatsApp Business Calling KPIs

​List WhatsApp Business Call logs

​Initiate an outbound WhatsApp Business Call (Phase 5)

WhatsApp Calling API

title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

Errors worth branching on

401 — Unauthorized

403 — Forbidden

422 — Schema

429 — Rate

402 — Feature gate

60-second retry matrix

WhatsApp Business Calling KPIs

List WhatsApp Business Call logs

Initiate an outbound WhatsApp Business Call (Phase 5)