Update WhatsApp Flow Metadata
Update Flow metadata. Send at least one of name, categories, endpointUri.
endpointUri is the HTTPS URL of your data-channel server. WhatsApp calls it with an encrypted POST; those requests are not the channel webhook. The field description has the request fields, decryption, and the nfm_reply completion path.
JWT tokentoken<token>flowId*stringFlow identifier
application/json- body
At least one of name/categories/endpointUri required
name?stringNew Flow name
categories?array<>Replacement Flow categories
endpointUri?stringHTTPS URL of your server for this Flow data channel. This is not a 1msg route, and these calls are not delivered to the channel webhookUrl.
WhatsApp POSTs JSON with encrypted_flow_data, encrypted_aes_key, and initial_vector. Decrypt encrypted_aes_key with the RSA private key that matches the uploaded business_public_key (RSA-OAEP, SHA-256), then decrypt encrypted_flow_data with AES-128-GCM (initial_vector is the IV; the last 16 bytes of the ciphertext are the auth tag). Respond with that ciphertext as a base64 string and header Content-Type: text/plain. Encrypt the response with the same AES key and the IV after inverting every byte. If decryption fails, respond with HTTP 421 so the WhatsApp app fetches the public key again.
The same URL receives the service ping. Answer it in the same encrypted form; the decrypted body is {"data":{"status":"active"}}. ping and screen exchanges do not arrive on the channel webhook. When the user submits the form, the result is delivered to the channel webhookUrl as messages[].interactive.type = nfm_reply.
Upload the public key with POST /whatsapp_business_encryption and call GET /whatsapp_business_encryption until business_public_key_signature_status is VALID.
uriUpdated
application/json- response
success?booleancurl -X PATCH 'https://api.1msg.io/123/flows/string/metadata' \ -H 'Content-Type: application/json' \ -d '{ "name": "lead_form_v2", "endpointUri": "https://example.com/flow"}'{ "success": true}