> ## Documentation Index > Fetch the complete documentation index at: https://docs.thinnest.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create Template > Saves a WhatsApp template as a draft, after the console's own checks of WhatsApp's rules for the body, header, footer, buttons and an authentication template's code. Review is a separate, deliberate step — Submit Template, or `submit: true` here — because once a name is approved it can never be reused for different words; if that submission is refused, the draft is kept and `message` says why. Limited-time offers, carousels and buttons that open a WhatsApp form are made in the console. Needs a **full** key. ## OpenAPI ````yaml /api-reference/openapi.json post /templates openapi: 3.1.0 info: title: ThinnestAI API version: 1.0.0 description: >- Build voice and WhatsApp agents, place calls, message customers and run a platform of your own customers on one API. servers: - url: https://app.thinnest.ai/api/v1 description: Production security: - bearerAuth: [] tags: - name: Agents description: >- An agent is one assistant with its instructions, model, languages, website widget and call settings — the same thing the console's Agent page builds. Create one here, then give it knowledge, actions and channels. - name: Knowledge description: >- The documents an agent searches and cites when it answers — a web page or pasted text, split into passages and indexed. Use it for facts (prices, policies, opening hours) rather than putting them in the instructions. - name: Actions description: >- Calls to your own HTTPS API that an agent can make mid-conversation, with arguments it fills from what the customer said — how an agent uses data that stays in your own system. Create one, test it, then switch it on. - name: Tools description: >- Everything else an agent can do besides answer: its built-in tools, the MCP tool servers it is connected to, and the accounts it works in (calendar, spreadsheets, CRMs, records kept here, helpdesks). Every tool starts off. - name: Channels description: >- Where an agent answers: the website widget, WhatsApp, Telegram and calls. Read an agent's channels here and connect a Telegram bot; WhatsApp is connected in the console, because Meta's sign-up runs in the business owner's own browser. - name: Calls description: >- A call is one phone, web or WhatsApp conversation with an agent — one you placed through the API, a campaign's, or one a customer made to you. Place calls here, one at a time or in a batch, and read each one back with its summary, collected details and transcript. - name: Post-call description: >- What happens after a call ends: the outcome, a short summary and the details the agent collects. Read a call's analysis here, and set what an agent does after every call. - name: Recordings description: >- A call's audio, for agents that record their calls. Fetch it with your key, or hand a CRM user the signed link a call report carries — that one needs no key. - name: Conversations description: >- A conversation is one customer's thread with your workspace on one channel — WhatsApp, the web widget, Telegram, voice or email. Read threads and their messages (including to catch up on a webhook you missed), answer a WhatsApp customer from your own agent platform, and resolve, take over or assign threads as the inbox does. - name: Messages description: >- Send one approved WhatsApp template to one customer, because something happened in your own system — an order confirmation, a delivery update, an appointment reminder. No agent is needed: this is how your software starts a WhatsApp conversation. - name: One-time codes description: >- Deliver a login or verification code you generated over WhatsApp, without handling templates yourself, and set up the authentication templates it sends with. WhatsApp writes these messages — "*394812* is your verification code." — so you choose only the expiry, the security line and the button. - name: Contacts description: >- The people your workspace knows — kept in step with your CRM by phone number and your own `externalId`, with marketing consent recorded alongside where it came from. - name: Do not call description: >- Numbers your agents must never ring. Every outbound call refuses a number on this list — Create Call answers `409`, a batch refuses that entry, a calling campaign skips the person and records why, and a booked callback is given up — while inbound calls from it are answered as usual. The same list as **Contacts → Do not contact** in the console, and the one your voice agent adds to on its own when a caller asks not to be called again (in any language), which also sends the `contact.opted_out` webhook event. - name: Events description: >- Tell us something happened in your system — `order.delivered`, `trial.ended` — and the sequences and tags you set up in the console decide what follows. Your code says what happened; the console says what happens next. - name: Templates description: >- WhatsApp message templates: the pre-approved messages your business may send to a customer first, or outside the 24 hours after they last wrote. A template is saved as a draft, sent to WhatsApp for review, and can be sent (Send Message, Create Campaign) only once it is `approved`. Templates are named, not numbered, and one name can exist in several languages. - name: Campaigns description: >- A campaign sends one thing to many people. It is either a WhatsApp **broadcast** (`kind: "whatsapp"`), which sends one approved template to everyone in its audience, or a **calling campaign** (`kind: "voice"`), where an agent phones each person from its own number within the hours you set. Who is in the audience is decided by consent, exactly as in the console, and every campaign is created as a draft that you then launch, schedule, pause, resume or cancel. - name: Sequences description: >- A sequence sends one person several approved WhatsApp templates over days — "your order shipped", then "how was it?" two days later — and stops by itself when they reply, are tagged, or an event says so. People join by tag, by event, or one at a time through Enrol in Sequence. Sequence ids are bare uuids. - name: Forms description: >- A WhatsApp form is a screen your customer fills in without leaving the chat — a delivery address, an appointment request, a short survey. Build it here, publish it to your own WhatsApp Business Account, then send it from a template's button, an agent, the inbox or Reply to Conversation. - name: Phone numbers description: >- The numbers your agents answer and call from. A workspace holds them two ways: numbers it **rents** here, charged every month from your balance, and numbers it **brings** from its own carrier account, which we never bill. Each number is answered by at most one agent (its line) and may be lent to one agent to call out on. A number is named by the number itself, in any spelling: `918041234567`, `+918041234567` and `%2B918041234567` in a path are the same number. - name: Voices description: >- The voices an agent can speak with, as the console's voice picker lists them. An item's `id` is what an agent's `voice.voice` takes. - name: Voice clones description: >- Your workspace's own cloned voices, made from a short recording with the speaker's consent. A clone is listed with the Studio voices and can be put on an agent like any other voice. - name: Models description: >- The language models an agent can answer with, as the console names them. An item's `id` is what an agent's `model` takes. - name: Bring your own keys description: >- Run your agents on your own provider accounts and pay a flat platform fee instead of our usage rates. Bring all three keys (speech-to-text, LLM, voice): ₹0.02 a chat reply and ₹1 a call minute, all-in. Or bring only your voice key (scope voice): our speech-to-text, model and telephony, a call billed at the voice-only BYOK rate (₹1.50 / $0.02 a minute by default), chat replies as usual. There is no fallback to our providers when one of your keys fails. - name: Webhooks description: >- Endpoints an agent's events are sent to as they happen — a CRM, a sheet, Slack, Zapier, or a helpdesk email address. Each delivery is a signed JSON `POST` of `{ "id", "event", "sentAt", "data" }`. **Headers on every attempt** | Header | What it is | |---|---| | `x-thinnest-signature` | `sha256=` under the endpoint's signing secret. | | `x-thinnest-signature-v2` | `sha256=.">` — the delivery time, signed. | | `x-thinnest-delivered-at` | When this attempt left (ISO 8601). | | `x-thinnest-event-id` | `evt_…`, the same as the body's `id` — stable across every retry and re-send. | | `x-thinnest-attempt` | `1` for the first attempt, then `2`, `3`, … | **Retries.** A delivery that fails — any answer other than 2xx, a timeout after 10 seconds, or an address we cannot reach — is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours (six attempts over about 8½ hours). Every attempt sends the **same bytes**, so `sentAt` is when the event happened, not when the attempt left. Payloads are kept for 7 days; within that time any failed delivery can be sent again with Redeliver Webhook Events. **Dedupe** on `x-thinnest-event-id` (or the body's `id`): a retry after a timeout can reach you after you already processed the first attempt. Answer 2xx quickly and do the work afterwards. **Freshness.** To refuse replayed requests, verify `x-thinnest-signature-v2` and reject an `x-thinnest-delivered-at` more than five minutes from your clock. Do not check freshness on `sentAt`: a retry's `sentAt` is hours old by design. **Switch-off.** An endpoint is switched off after five events in a row that each failed every attempt — single failed attempts that later succeed do not count. Events that happen while it is off are recorded as not sent; switch it back on and re-send them. The events an endpoint can subscribe to: | Event | When it fires | |---|---| | `lead.captured` | The agent collected a name, email or phone from somebody who showed real interest. | | `conversation.escalated` | The agent handed a conversation to a person — asked for, or because it could not answer. | | `conversation.resolved` | A teammate marked a conversation done; `data.conversationId` is its `conv_…` id, as Get Conversation takes it. | | `call.completed` | A call the agent placed or answered ended — how it ended and how long it lasted, sent the moment it ends. | | `call.analysed` | A call's results are ready: its summary, the details it collected, the transcript, a recording link and what the call cost (`costMicro`, `currency`) — the same shape as Get Call. | | `campaign.finished` | Every person on a broadcast or a calling campaign has been reached, or given up on. | | `contact.opted_out` | During a call, somebody asked not to be called again; their number (`data.phone`) is now on the do-not-call list. | - name: Usage description: >- Read what your workspace used and spent — replies, calls, WhatsApp, the balance history and invoices — the same figures as the console's Usage and Billing pages. All reads. - name: Analytics description: >- The Dashboard's counts and each agent's Analytics page, for building a dashboard of your own that agrees with the console. - name: Customers description: >- Workspaces you create for your own customers when you build a product on this API. Each customer has its own agents, contacts, knowledge, phone numbers and WhatsApp; your one key reaches any of them by adding `Thinnest-Workspace: ` to a request, and everything they use is charged to you. Manage customers from your own workspace, without that header. - name: Workspace description: >- Your workspace's own settings — its name and time zone — as Settings → General shows them. With `Thinnest-Workspace`, the customer's workspace instead. - name: Projects description: >- Projects group a workspace's agents, and are what a team's access is scoped by. Every workspace has a default project that cannot be deleted; a second project needs a plan with teams and projects. - name: Teams description: >- Teams are groups of members and the projects they can reach. A project granted to no team is open to the whole workspace; granting it to a team restricts it to that team's members (owners and admins always see everything), and removing its last grant opens it up again. - name: Members description: >- The people in your workspace and their roles. An API key acts as an admin, never an owner: it can make people admins or members and remove them, but cannot make anybody an owner, and the last owner can be neither demoted nor removed. - name: Invitations description: >- Invitations to join your workspace, as Settings → Members sends them: an email with a link that works for 14 days. Pending invitations count towards your plan's seats. - name: Notifications description: >- What each kind of notification does in your workspace: shown in the console's feed or muted, and whether it is emailed through the email sender you connected in the console. - name: Saved replies description: >- Sentences your team sends often, offered in the inbox composer as `/shortcut`. paths: /templates: post: tags: - Templates summary: Create Template description: >- Saves a WhatsApp template as a draft, after the console's own checks of WhatsApp's rules for the body, header, footer, buttons and an authentication template's code. Review is a separate, deliberate step — Submit Template, or `submit: true` here — because once a name is approved it can never be reused for different words; if that submission is refused, the draft is kept and `message` says why. Limited-time offers, carousels and buttons that open a WhatsApp form are made in the console. Needs a **full** key. operationId: createTemplate parameters: - $ref: '#/components/parameters/Workspace' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/WhatsAppTemplateCreate' examples: utility: summary: A utility template with a link button value: name: order_ready language: en category: utility body: >- Hello {{1}}, your Kesar Naturals order {{2}} is packed and on its way. samples: - Priya - '#10432' footer: Kesar Naturals, Jaipur buttons: - kind: url label: Track order url: https://kesarnaturals.in/track/{{1}} sample: '10432' submit: false authentication: summary: An authentication (one-time code) template value: name: login_code language: en category: authentication auth: expiryMinutes: 10 securityRecommendation: true otpType: copy_code submit: true responses: '201': description: >- Saved. The template as Get Template shows it, plus `message`: saved as a draft, sent for review, or saved as a draft with the reason the submission was refused. content: application/json: schema: $ref: '#/components/schemas/WhatsAppTemplateSaved' example: name: order_ready language: en category: utility status: draft agent: ag_5c4a5f93-2b1e-4c0a-9d3f-7e8a1b2c3d4e body: >- Hello {{1}}, your Kesar Naturals order {{2}} is packed and on its way. variableCount: 2 variableLabels: - position: 1 sample: Priya - position: 2 sample: '#10432' buttonVariableCount: 1 headerKind: none createdAt: '2026-10-06T10:00:01.874Z' headerText: null footer: Kesar Naturals, Jaipur buttons: - kind: url label: Track order url: https://kesarnaturals.in/track/{{1}} reviewNote: null message: Saved as a draft. '400': description: >- A field is missing or has the wrong type, `agent` is not an agent id, `submit` is not a boolean, or the body carries an offer or carousel (made in the console). The message names the field. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: >- `name` is lowercase letters, numbers and underscores only — no spaces or capitals. '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: No agent with that id in this workspace. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: That agent was not found. '409': description: >- A template with this name and language already exists, or the workspace has no agent yet (a template belongs to one). content: application/json: schema: $ref: '#/components/schemas/Error' example: error: A template with that name and language already exists. '422': description: >- The template breaks one of WhatsApp's rules: placeholders out of order or at the very start or end, a missing example, too many blanks for the length, a footer or header over 60 characters, too many buttons of a kind, a marketing template with no way to opt out, or an authentication template's expiry or button. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: >- Marketing templates need a way out. Add a "Stop promotions" quick reply, or put "Reply STOP to opt out" in the footer. '429': $ref: '#/components/responses/TooManyRequests' components: parameters: Workspace: name: Thinnest-Workspace in: header required: false description: >- Developers only: the customer workspace this request acts in — its `org_…` id from `POST /customers`. Leave it out to act in your own workspace. schema: type: string example: org_3fKq9TzQ1mN8vB2xR7cLpA schemas: WhatsAppTemplateCreate: type: object required: - name - category properties: name: type: string pattern: ^[a-z0-9_]{1,512}$ description: >- Lowercase letters, numbers and underscores only. Unique per language in your workspace. example: order_ready language: type: string default: en description: >- A language WhatsApp templates support, such as `en`, `en_US` or `hi`. example: en category: type: string enum: - utility - marketing - authentication description: >- `utility` for something the customer is expecting (an order or appointment update), `marketing` for promotions, `authentication` for one-time codes. body: type: string maxLength: 1024 description: >- The message, with blanks numbered `{{1}}`, `{{2}}` … in order. A blank cannot be at the very start or end, two cannot sit next to each other, and there must be enough words around them. Required unless `category` is `authentication`, where WhatsApp writes the body. example: >- Hello {{1}}, your Kesar Naturals order {{2}} is packed and on its way. samples: type: array maxItems: 20 items: type: string description: >- One example value per body blank, in order. WhatsApp's reviewers read the template with these filled in, so every blank needs one. example: - Priya - '#10432' header: $ref: '#/components/schemas/WhatsAppTemplateHeader' footer: type: - string - 'null' maxLength: 60 description: >- One line of small print, with no blanks. A marketing template needs a way to opt out — "Reply STOP to opt out" here, or a quick-reply button. example: Reply STOP to opt out buttons: type: - array - 'null' maxItems: 10 items: $ref: '#/components/schemas/WhatsAppTemplateButton' description: The template's buttons, in order. auth: $ref: '#/components/schemas/WhatsAppTemplateAuth' agent: type: - string - 'null' description: >- The agent the template belongs to (`ag_…`). Leave it out for the agent on your connected WhatsApp number (or your oldest agent). example: ag_5c4a5f93-2b1e-4c0a-9d3f-7e8a1b2c3d4e submit: type: boolean default: false description: >- `true` also sends it to WhatsApp for review, as Submit Template does. If that is refused, the draft is kept and `message` says why. WhatsAppTemplateSaved: description: The template, plus a sentence about what just happened. allOf: - $ref: '#/components/schemas/WhatsAppTemplateDetail' - type: object required: - message properties: message: type: string description: >- What happened: saved as a draft, sent for review, or — with `submit: true` — saved as a draft with the reason the submission was refused. example: Saved as a draft. Error: type: object required: - error properties: error: type: string description: What went wrong, in a sentence you can show a person. example: error: That agent was not found. WhatsAppTemplateHeader: type: - object - 'null' description: The line or media above the body. `null` means no header. required: - kind properties: kind: type: string enum: - none - text - image - video - document description: What the header is. text: type: string maxLength: 60 description: A `text` header's words. Required for `text`; no placeholders. mediaUrl: type: string format: uri maxLength: 2000 description: >- For `image`, `video` or `document`: an https link to an example file WhatsApp's reviewers can fetch. Required for those kinds. WhatsAppTemplateButton: type: object description: >- One button. A template takes at most three quick replies, two link buttons and one call button, and quick replies cannot be mixed with the other kinds. required: - kind properties: kind: type: string enum: - url - phone - quick_reply - copy_code description: >- A link, a call, a quick reply, or a button that copies an offer code. label: type: string maxLength: 25 description: >- What the button says. Required for every kind but `copy_code`, whose label WhatsApp writes. url: type: string description: >- For `url`: an https address. It may end with one `{{1}}`, filled per send. phone: type: string description: >- For `phone`: the number in full international form, like `+919812345678`. sample: type: string description: >- For a `url` that ends in `{{1}}`: an example value for the reviewers. Required then. code: type: string description: >- For `copy_code`: the example coupon WhatsApp reviews the template against. WhatsAppTemplateAuth: type: object description: >- An authentication template's settings. WhatsApp writes the message itself ("*123456* is your verification code."), so these are all you choose. properties: expiryMinutes: type: integer minimum: 1 maximum: 90 default: 10 description: How long the code is valid, shown as "Expires in 10 minutes." securityRecommendation: type: boolean default: true description: Adds "For your security, do not share this code." otpType: type: string enum: - copy_code - one_tap default: copy_code description: >- `copy_code`: a button that copies the code. `one_tap`: fills it into your Android app, which needs `supportedApps`. supportedApps: type: array items: $ref: '#/components/schemas/WhatsAppTemplateAuthApp' description: 'Required for `one_tap`: the apps the code fills into.' WhatsAppTemplateDetail: description: A WhatsApp template with its parts and review note. allOf: - $ref: '#/components/schemas/WhatsAppTemplate' - type: object required: - headerText - footer - buttons - reviewNote properties: headerText: type: - string - 'null' description: A text header's words. `null` for any other header. footer: type: string description: The footer line. Empty when there is none. buttons: type: array items: $ref: '#/components/schemas/WhatsAppTemplateButtonView' description: The template's buttons, in order. reviewNote: type: - string - 'null' description: Why WhatsApp refused it, when it did. `null` otherwise. WhatsAppTemplateAuthApp: type: object description: An Android app a one-tap code fills into. required: - packageName - signatureHash properties: packageName: type: string description: The app's package name. example: in.kesarnaturals.app signatureHash: type: string description: The app's signing-key hash. example: K8a2mPq9Lx3 WhatsAppTemplate: type: object description: A WhatsApp template, with what a send needs from it. required: - name - language - category - status - agent - body - variableCount - variableLabels - buttonVariableCount - headerKind - createdAt properties: name: type: string description: The template's name — what Send Message and Create Campaign take. example: order_ready language: type: string description: Its language code. example: en category: type: string enum: - utility - marketing - authentication description: WhatsApp's category, which decides its price and its rules. status: type: string enum: - draft - pending - approved - rejected - paused description: >- `draft` until submitted, `pending` while WhatsApp reviews it, then `approved` or `rejected`. WhatsApp may later `pause` an approved template that recipients flag. Only `approved` can be sent. agent: type: string description: The agent the template belongs to (`ag_…`). example: ag_5c4a5f93-2b1e-4c0a-9d3f-7e8a1b2c3d4e body: type: string description: >- The message, with `{{1}}`, `{{2}}` … for the blanks. For an authentication template, the sentence WhatsApp writes around the code. variableCount: type: integer minimum: 0 description: >- How many body values a send must carry, in order: the highest `{{n}}` in the body. variableLabels: type: array items: $ref: '#/components/schemas/WhatsAppTemplateVariableLabel' description: The example given for each body blank. buttonVariableCount: type: integer minimum: 0 description: >- How many button values a send must carry: one per link button whose address ends in a blank. headerKind: type: string enum: - none - text - image - video - document description: >- The header. `image`, `video` or `document` means a send must pass a media link for it. createdAt: type: string format: date-time description: When it was created. WhatsAppTemplateButtonView: type: object description: One of a template's buttons. required: - kind - label properties: kind: type: string description: >- `url`, `phone`, `quick_reply`, `copy_code`, or `flow` for a button made in the console that opens a WhatsApp form. label: type: string description: >- What the button says. Empty for `copy_code`, whose label WhatsApp writes. url: type: string description: A link button's address. A trailing `{{1}}` is filled per send. phone: type: string description: A call button's number. WhatsAppTemplateVariableLabel: type: object description: >- The example value given for one body blank when the template was written. properties: position: type: integer minimum: 1 description: 'The blank''s number: 1 is `{{1}}`.' sample: type: string description: The example value WhatsApp's reviewers read in its place. responses: Unauthorized: description: The key is missing, wrong or revoked. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: 'Send a valid API key as `Authorization: Bearer `.' Forbidden: description: >- The key's access level (read-only or build) does not allow this request, or the plan does not include it. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: >- This API key is read-only: it can read everything but change nothing. TooManyRequests: description: Over the per-minute limit. Wait for `Retry-After` seconds. headers: Retry-After: schema: type: integer description: Seconds to wait. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: Over 240 requests a minute. Slow down and retry. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your API key (`ta_live_…`) from **Settings → API keys**, sent as `Authorization: Bearer `. Keep it on a server: it can message every customer you have. A key is full, build or read-only; a request its level does not allow is refused with `403`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.