> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kapso.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API reference

> Three APIs, one API key

Kapso exposes three APIs. They are documented separately because they have different base URLs and different jobs, but a single project API key authenticates all of them.

<Tabs>
  <Tab title="WhatsApp">
    Send and read messages, templates, and media. Mirrors Meta's Graph API shapes, so existing Cloud API code ports over with a base URL change.

    ```
    https://api.kapso.ai/meta/whatsapp/v24.0
    ```

    [Browse endpoints](/api/meta/whatsapp/messages/list-messages)
  </Tab>

  <Tab title="Platform">
    Everything around the messages: onboarding customers, provisioning numbers, generating setup links, running broadcasts, and managing webhooks.

    ```
    https://api.kapso.ai/platform/v1
    ```

    [Browse endpoints](/api/platform/v1/customers/list-customers)
  </Tab>

  <Tab title="Workflows">
    Trigger and inspect automation runs, read execution history, and deploy serverless functions.

    ```
    https://api.kapso.ai/platform/v1
    ```

    Shares a base URL with the Platform API and is the same service. They are split here only to keep the reference navigable.

    [Browse endpoints](/api/platform/v1/functions/workflows/list-workflows)
  </Tab>
</Tabs>

## Authentication

Send your project API key in the `X-API-Key` header:

```bash theme={null}
curl https://api.kapso.ai/platform/v1/customers \
  -H "X-API-Key: YOUR_API_KEY"
```

The WhatsApp API also accepts a bearer token, which is what lets Meta Cloud API code work unchanged:

```bash theme={null}
curl https://api.kapso.ai/meta/whatsapp/v24.0/{phone_number_id}/messages \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## Response shape

Most endpoints return a `data` object:

```json theme={null}
{
  "data": {
    "id": "..."
  }
}
```

List endpoints also include a `meta` object with pagination state.

## Before you start

* All requests are HTTPS. Plain HTTP is rejected
* Requests and responses are JSON unless the endpoint handles media
* [Rate limits](/api/rate-limits) apply per API key and depend on your plan