Skip to main content
POST
cURL (Windows)
The playground on this page is live. There is no test mode and no sandbox: pressing Send authenticates with the key you paste and really calls https://api.bulkneo.com — a send delivers a real WhatsApp message to the number you type, and an instance call really changes your account. Use your own number while you are exploring, and paste a key only from a machine you trust.Your browser remembers what you type into the playground, so a key you paste here is still in the Authorization box on your next visit. Nobody else sees it — it never leaves your machine and it is not part of this site — but on a shared or borrowed computer, clear the site data when you are done.
Invoices, receipts, statements, tickets, price lists. Anything that is a file.
There is no file upload. You host the file at a public link and we fetch it from there. See Sending media.
Nothing to hand? Send https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf — a small public test PDF published by the W3C. It proves the whole path works before you host anything of your own. See Sending media.

Notes

  • Set filename. It is the name the recipient sees and the name they get if they save the file. Without it the name is taken from the link, which is often something like download.php or a long signed-URL blob.
  • filename is capped at 255 characters. Slashes (/ and \) and control characters are rejected, as are . and .. on their own. Nothing is silently rewritten — an unsafe name comes back as 400 invalid_request.
  • caption is shown with the file and capped at 1,024 characters.
  • mime_type is an optional hint such as application/pdf.

Example — an invoice

If your invoice link is a signed URL that expires, make sure it is still valid at the moment you call this endpoint — we fetch the file during the request, not later. An expired link comes back as 422 media_fetch_failed.

Authorizations

apikey
string
header
required

Your API key, sent in an apikey request header. Never in the URL, never as a Bearer token.

Headers

Idempotency-Key
string

OPTIONAL. A unique string you choose, 8-255 characters of letters, digits or . _ : ~ -

Send the same key with the same body again within 24 hours and the ORIGINAL result is returned without sending a second message — which is what makes a network retry safe. A different body on the same key is refused with 422 idempotency_key_reused rather than silently overwriting either result.

Responses carry Idempotency-Replayed: true|false while this is active. If that header is ABSENT, idempotency is not enabled on this deployment and retries will send again.

Required string length: 8 - 255
Pattern: ^[A-Za-z0-9._:~-]{8,255}$

Body

application/json
instance_id
string<uuid>
required

Which of your connected numbers to send FROM. Copy it from your numbers screen in the portal, or from GET /v1/instances. It must belong to your account.

Example:

"3f9c1a2b-7d4e-4c81-9f0a-2b6d5e8c1a34"

to
string
required

The recipient, with country code and no leading zero — for example 919000000000. Spaces, dashes, brackets and a leading + are accepted and stripped; 6 to 15 digits must remain.

Example:

"919000000000"

url
string
required

A public http(s) link to the file. There is no upload endpoint — we fetch the file from this link, so it must be reachable from the internet and be a direct link to the file itself, not a preview or share page. Private, internal and loopback addresses are refused, as are links containing a username or password.

Maximum string length: 2048
Example:

"https://example.com/receipt-2043.png"

filename
string

The name the recipient sees, for example invoice-2043.pdf. Up to 255 characters. Slashes and control characters are rejected, as are . and ... If you omit it, the name is taken from the link.

Maximum string length: 255
Example:

"invoice-2043.pdf"

caption
string

Text shown with the file. Up to 1,024 characters.

Maximum string length: 1024
Example:

"Your receipt"

mime_type
string

Optional content-type hint such as application/pdf. It is checked for the shape type/subtype only — we do not verify it matches the file. Usually you can leave it out.

Maximum string length: 128
Example:

"application/pdf"

quoted_message_id
string

Send this message as a reply, quoting an earlier one. Use the data.message_id returned by a previous send.

Maximum string length: 128
Example:

"3EB0C1D2F4A5B6C7D8E9"

quoted_from_me
boolean
default:false

Set true when the quoted message is one you sent from this number. Only valid together with quoted_message_id.

Response

Accepted for delivery. data.type is always document on this endpoint.

success
boolean
data
object
request_id
string<uuid>