The WACRM Core API for developers and agents

Auth, scopes and idempotency

Every v1 route checks the credential's scopes before it checks anything else: a key minted without contacts:write, for example, gets 403 insufficient_scope on POST /v1/contacts regardless of which plan the project is on. Most scopes are opt-in at mint time — only a handful of defaults (like templates:read for a store key) are granted automatically, so a key only ever carries the access it was actually given.

A write that should never run twice — sending a message, proposing an agent action, creating a task from a conversation — requires a caller-supplied Idempotency-Key header. Retrying the exact same request with the same key replays the first response verbatim instead of sending or creating anything a second time, which is what lets a flaky network connection retry safely. For POST /v1/messages that replay window is 24 hours; for proposing an agent action or creating a task, the key is unique per project with no expiry.

Endpoint reference

Generated at build time from the same openapi-v1.yaml spec the Core API itself is contract-tested against — every path, method and required scope below comes straight from that file, grouped by its OpenAPI tag.

Error shape

Every non-2xx response is a JSON object with the same shape:

{ "error": { "code": "insufficient_scope", "message": "human-readable reason" } }