WhatsApp for your product.

Before you start

• Campfire owns the Meta app, webhook endpoint, and encrypted channel credentials.
• Use a partner API key in Authorization: Bearer <key>.
• All partner IDs are opaque prefixed IDs such as mw_… and msg_…; never persist raw database UUID assumptions.
• Every command requires an Idempotency-Key header. Retry the same key and body after a transport failure.

Customer-owned number flow

1. Create an idempotent managed workspace for your external tenant.
2. Set the customer return origin in returnUrlAllowlist when the workspace is created.
3. Create an expiring setup link and present its URL to the customer.
4. Campfire hosts Meta Embedded Signup at /partners/connect; the URL bearer secret stays in the fragment, not request logs.
5. Poll installation status or consume signed partner events. A number is ready only after the Meta webhook subscription succeeds.

Minimal HTTP flow

# 1. Create a workspace once per external tenant
curl -X POST https://api.campfire.is/api/partners/v2/workspaces \
  -H 'Authorization: Bearer $CAMPFIRE_PARTNER_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "externalTenantId":"gym_123",
    "name":"Northside Fitness",
    "returnUrlAllowlist":["https://app.example.com"]
  }'

# 2. Create an expiring customer setup link
curl -X POST "https://api.campfire.is/api/partners/v2/workspaces/$WORKSPACE_ID/setup-links" \
  -H 'Authorization: Bearer $CAMPFIRE_PARTNER_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "externalTenantId":"gym_123",
    "redirectUrl":"https://app.example.com/campfire/whatsapp-complete",
    "allowedConnectionTypes":["whatsapp"],
    "expiresInHours":24
  }'

The create response contains the setup URL exactly once. List responses intentionally omit it; create a fresh link when it must be reissued.

Trace a delivery

Given a Meta wamid, call the workspace-scoped logs endpoint. It returns command acceptance, durable delivery job state, Meta receipt status/error code, and signed partner-webhook retry diagnostics. It never returns message body content.

curl "https://api.campfire.is/api/partners/v2/workspaces/$WORKSPACE_ID/logs?wamid=$WAMID" \
  -H 'Authorization: Bearer $CAMPFIRE_PARTNER_API_KEY'