Documentação
ZAP-API

Authorization: Bearer tk_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

const axios = require('axios');

const api = axios.create({
  baseURL: 'https://api.zap-api.tech/v1',
  headers: {
    'Authorization': 'Bearer tk_xxxxxxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json',
  },
});

const response = await api.post('/instances/inst_xxx/send', {
  phone: '5511999999999',
  type: 'text',
  body: 'Olá! Mensagem via ZAP API.',
});
console.log(response.data);

import requests

headers = {
    "Authorization": "Bearer tk_xxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "Content-Type": "application/json",
}

resp = requests.post(
    "https://api.zap-api.tech/v1/instances/inst_xxx/send",
    json={"phone": "5511999999999", "type": "text", "body": "Olá via Python!"},
    headers=headers,
)
print(resp.json())

curl https://api.zap-api.tech/v1/instances \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx"

{
  "instances": [
    {
      "id": "inst_abc123",
      "name": "Suporte",
      "status": "connected",
      "phone": "+5511999999999",
      "plan": "pro",
      "createdAt": "2026-01-15T10:00:00Z"
    }
  ]
}

curl -X POST https://api.zap-api.tech/v1/instances/inst_abc123/connect \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx"

curl https://api.zap-api.tech/v1/instances/inst_abc123/qrcode \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx"

{
  "instanceId": "inst_abc123",
  "qrCode": "data:image/png;base64,iVBORw0KGgo...",
  "status": "qr_required"
}

{
  "instanceId": "inst_abc123",
  "waStatus": "CONNECTED",
  "connected": true,
  "number": "5511999999999",
  "name": "Suporte",
  "profilePicUrl": null,
  "qrcode": null
}

curl -X POST https://api.zap-api.tech/v1/instances/inst_abc123/send \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "5511999999999",
    "type": "text",
    "body": "Seu pedido #1234 foi confirmado. ✅"
  }'

curl -X POST https://api.zap-api.tech/v1/instances/inst_abc123/send \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "5511999999999",
    "type": "document",
    "mediaUrl": "https://exemplo.com/boleto.pdf",
    "fileName": "boleto-fev-2026.pdf",
    "caption": "Seu boleto de fevereiro"
  }'

curl -X POST https://api.zap-api.tech/v1/instances/inst_abc123/send \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "5511999999999",
    "type": "poll",
    "pollQuestion": "Qual horário fica melhor para a entrega?",
    "pollOptions": ["Manhã (8h–12h)", "Tarde (12h–18h)", "Não estarei em casa"],
    "pollMultiSelect": false
  }'

curl -X PUT https://api.zap-api.tech/v1/instances/inst_abc123/webhook \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://seu-servidor.com/webhook",
    "events": ["message.received", "message.status"],
    "secret": "sua_chave_secreta"
  }'

{
  "event": "message.received",
  "instanceId": "inst_abc123",
  "timestamp": "2026-02-15T14:30:00Z",
  "data": {
    "messageId": "msg_xyz789",
    "phone": "5511999999999",
    "name": "João Silva",
    "type": "text",
    "body": "Olá, quero saber sobre o produto",
    "fromMe": false,
    "timestamp": 1771166400
  }
}

{
  "event": "message.received",
  "data": {
    "type": "location",
    "latitude": -23.55052,
    "longitude": -46.633308
  }
}

{
  "event": "message.received",
  "data": {
    "type": "text",
    "body": "Quero falar com vendas",
    "buttonReply": { "id": "opt_vendas", "text": "Quero falar com vendas" }
  }
}

{
  "event": "message.received",
  "data": {
    "messageId": "msg_xyz789",
    "phone": "5511999999999",
    "type": "audio",
    "mediaUrl": "https://.../zap-inbound-media/...?X-Amz-Signature=...",
    "mimeType": "audio/ogg; codecs=opus"
  }
}

curl https://api.zap-api.tech/v1/instances/inst_abc123/messages/msg_xyz789/media \
  -H "Authorization: Bearer tk_xxxxxxxxxxxx"

{
  "messageId": "msg_xyz789",
  "type": "audio",
  "mediaUrl": "https://.../zap-inbound-media/...?X-Amz-Signature=...",
  "mimeType": "audio/ogg; codecs=opus",
  "bytes": 14238,
  "expiresIn": 604800,
  "expiresAt": "2026-08-25T14:30:00.000Z"
}

{
  "event": "message.received",
  "data": {
    "phone": "5535997022148",       // número real — USE este para enviar
    "lid": "143435449282736@lid",   // identificador — NÃO use para enviar
    "name": "Contato",
    "type": "text",
    "body": "..."
  }
}

const crypto = require('crypto');

app.post('/webhook', (req, res) => {
  const payload = JSON.stringify(req.body);
  const header = req.headers['x-zapapi-signature-256'] || '';
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');

  // comparação em tempo constante (evita timing attack)
  const ok = header.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
  if (!ok) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  const { event, data } = req.body;
  console.log('Evento recebido:', event, data);
  res.json({ ok: true });
});