API CST ACS (Dial WABA)

A Dial WABA v1.6-compatible WhatsApp template-send endpoint. Unlike the Sandeza API (H2H & CGW): there is no HMAC, no webhook secret, and the status webhook is plain.

Authentication

The Authorization header carries your RAW secret (sk_ prefix), with no "Bearer" prefix and no HMAC. The body carries your public key (pk_ prefix) in the key field. There is no webhook secret and no signature — do not add either.

Example request

curl -X POST https://chat.diginov.co.id/waba/v2/message \
  -H 'Authorization: sk_SEKRET_ANDA' \
  -H 'Content-Type: application/json' \
  -d '{
  "clientSid": "PHONE_NUMBER_ID",
  "refId"    : "INV-2026-0001",
  "key"      : "pk_PUBLIC_KEY_ANDA",
  "to"       : "628123456789",
  "template" : {
    "name"     : "order_update",
    "language" : "id",
    "body"     : { "{{1}}": "Eko" }
  }
}'

Reply codes (rc)

rc is sent as a STRING. HTTP status is always 200 for every envelope; a 4xx would make an HTTP client (e.g. Guzzle) throw before reading rc.

rc	Meaning	When
`1`	Accepted	The message is queued through your selected channel. It does not mean it was delivered — the real outcome arrives via the status webhook.
`2`	Internal error	An unexpected failure on our side. Safe to retry with the same refId.
`3`	Duplicate refId	This refId was accepted before. No second send is scheduled, so retrying the exact same request is safe.
`4`	Invalid request	Bad credentials, channel, template, or payload. The reply is deliberately generic so it does not reveal which one.
`5`	Gateway failure	A true downstream failure. Never used for input errors.

Status webhook

Sent when a message status changes. The body is four keys, and status uses the 1..6 scale below.

{"status":"2","refId":"INV-2026-0001","media":"whatsapp","timestamp":"1788300000"}

status	Meaning
`1`	Sent
`2`	Delivered
`3`	Read
`4`	Deleted
`5`	Failed
`6`	Unknown

ACS status webhooks are sent plain: no webhook-id, webhook-timestamp, webhook-sequence, or webhook-signature. Reply with ANY HTTP 2xx to acknowledge receipt.

Egress CIDR

ACS status webhooks use no HMAC or webhook secret. Ask the onboarding team for the published SIPESAN egress CIDR(s), then allowlist them on your firewall. SIPESAN does not display an IP on screen because the value can change.