The pricing page has a new cost
estimator. Enter your Standard and Pro numbers and online days to see their
usage, the monthly bonus and what you pay each month, in total or per number,
in USD, BRL, INR or credits. The monthly bonus is now explained per credit:
depending on your monthly top-up total, each credit you buy becomes 1, 1.1,
1.25, 1.75 or 2.5 credits. Prices and the bonus itself are unchanged. The
pricing page is also available in Brazilian Portuguese at
/pt-br/pricing. See
Monthly bonus.
You can now use the Console in Brazilian Portuguese. Choose Automatic,
English or Português (Brasil) in the new Language card under
Account > Settings or from the account menu. A language you choose is
saved on your account and follows you to every browser; Automatic follows
your browser’s languages. Nothing changes unless you choose Portuguese or
your browser lists it before English. API responses, webhook payloads, the
CLI and SDKs stay in English. Portuguese versions of polymorfa.com pages are
available under
/pt-br. See Language.Each webhook now chooses the first day it receives
session.phone_offline,
from day 7 to day 13 without the phone. Set phoneOfflineStartDay when you
create or update a webhook, or use the Phone offline warning section of a
project endpoint in the Console. Existing webhooks keep day 10, so their
deliveries are unchanged. Console Logs and Insights now include warnings from
day 7. See Phone offline warnings.www.polymorfa.com now answers AI agents directly. The homepage returns
Markdown to requests that send
Accept: text/markdown, /openapi.json serves
the API description, /.well-known/api-catalog lists the API, and MCP clients
can reach the documentation search server at /mcp. /llms.txt now says when
to use Polymorfa and how to call it. See
Discovery for agents.Message events from Linked Devices numbers now include the display details
WhatsApp sends with a message: image and video size, audio and video
duration, voice-note waveform, document page count, the embedded JPEG
preview, and link previews on text messages. When a contact sends a photo or
video in HD, the HD copy arrives with
association.parentMessageId naming the
standard message, so you can show one message instead of two. Images you send
now include their size and a preview, and you can supply a preview for video
and documents. Existing fields are unchanged and no action is required. See
Media previews and HD images.Each offered beta now appears as one row with its status and a Join or
Leave button. The terms, terms version and who can change enrollment open
in a confirmation dialog when you join or leave. Team owners and admins
confirm with Accept and join or Leave beta. See Test numbers,
Event streams, Link tracking,
Number capabilities and
Message history.
Deleting a team now shows each number the team still has and the credit
balance that will be lost, and asks you to type the team name and confirm
your identity with an emailed code, plus your authenticator code if
two-factor authentication is enabled.Any owner can cancel within 24 hours of confirmation, and every owner receives an
email with the cancellation deadline. Until then the team is read-only: requests that
change it return
409 team_deletion_scheduled, while numbers stay connected
and webhooks keep delivering. Any owner can cancel from the Console banner to
restore the team before the deadline. After it, cancellation is closed and
deletion starts once nothing blocks it, including a payment still processing. The team then disappears for every member, and
each number is deleted in full, including its WhatsApp login, Cloud API
connection and hosted message history, before the team is removed. See
Delete a team. If the owner who
scheduled deletion loses owner access first, the deletion is cancelled.The Polymorfa Help Center now answers 123 questions
in English and Brazilian Portuguese, organized into nine topics covering
access, payments, connection problems, delivery, limits, privacy, and support.
New billing answers cover Pay-As-You-Go upgrades, credits, saved payment
methods, and automatic top-ups. Existing article links still work.Enter your support code when contacting us through the Help Center chat.
Polymorfa emails also link to the Help Center in your language. See
Help Center.
Browse answers about setup, accounts, numbers, billing, integrations, and
troubleshooting at faq.polymorfa.com, without
signing in. Search in English or Brazilian Portuguese. See Help Center.
Install
@polymorfa/cli@0.1.0-dev.0 with Node.js 22 or later to make API
requests, inspect sessions, search documentation, and configure the local
MCP server. See CLI installation and commands.Pages such as Numbers, Campaigns, Templates, Calls, Customers, Logs, and
Webhooks now have a
</> button beside their main action. It lists the API requests
that do the same work as the page, with samples in Node.js, cURL, Python, Go,
PHP, and Ruby, the permission each request needs, and a link to its reference.
Copy for your coding agent copies a prompt that links each request’s
reference as Markdown.
See Code samples for each page.Submitting a project template for approval now accepts any number. Numbers
that are not Cloud API numbers need no Meta review, so the request returns
200 with submission.status APPROVED and submission.autoApproved true
instead of a 400 error, and nothing is sent to Meta. Cloud API numbers are
submitted to Meta as before and return submission.status PENDING. Every
successful response now includes the submission object. If you skipped this
call for other numbers, you can now call it for all numbers from one code
path. See Submit a project template for approval.When WhatsApp caps how many new chats a linked-device number starts in a cycle,
Get session now returns the number’s
newChatCapping: whether WhatsApp enabled
the cap, the limit, usage and reset time WhatsApp reported. While the number is
capped, sends that would start a new chat return 429
new_chat_limit_reached with Retry-After before they reach WhatsApp, and
campaigns hold the number until the cycle resets. Numbers without a cap from
WhatsApp are unchanged, and no action is required. See
WhatsApp new-chat cap.@polymorfa/sdk@0.1.0-dev.20261001124422 types campaign send windows: campaign create on both
APIs and the organization client’s campaign update accept sendWindow, and
campaign records return it. Flow draft list and retrieve now return the
drafts in response.data instead of response.data.data. See
Flow drafts.When WhatsApp redelivers a Cloud API account, template, Business app echo,
contact sync, or history sync notification that carries its time, the
redelivery keeps the same event
id. Each number under a WhatsApp Business
Account receives its own copy of account and template changes, and the event timestamp is
the time WhatsApp reports.Webhooks with format: "meta" now receive account_alerts and
account_update notifications on their original field. Account and template
events include wabaId, and template quality changes include
previousQualityScore and newQualityScore. See
Template updates.Teams that upgrade to Pay-As-You-Go before October 20, 2026 at 00:00 UTC
receive 25,000 launch credits. Team owners and admins of eligible Free teams
see a launch offer banner in the Console until they upgrade. See
Launch week credit.The Console also invites teams to the
Builders Program: 30 days of working
sessions with the Polymorfa team, with usage and add-ons covered. You can
dismiss the invitation.Teams that reach the 150% monthly bonus see an invitation to Enterprise
pricing, which sets a negotiated rate per number. See
Monthly bonus.
Pages that belong to one project, such as Campaigns, Customers, Flows,
Templates, and Safety, open directly for your project when your team has only
one. With more projects, the project list and the project selector include
Find project, and Esc closes the selector. Team settings can filter
the project list the same way.In All projects, Usage and Analytics now include a By project
table showing how each project contributes to the totals. See
All projects.
Free-tier numbers now include 1 GB of data, 5 inbound and 5 outbound calls a
month with no overage, and 1,000 serverless calls a month. Standard and Pro numbers include
unlimited inbound calls. Outbound and serverless allowances for Standard and
Pro are unchanged. See Number tiers.
The MCP server now has read tools.
events_list and events_get read your
event history, including retained message payloads when hosted message storage
is on. events_wait waits up to 60 seconds for new events and returns a cursor
for the next call. webhook_deliveries_list and webhook_deliveries_get show
webhook delivery status. The tools use the events:read and
webhook-deliveries:read scopes, and results are marked as untrusted content.
A new follow_up_incoming_messages prompt reads incoming messages and drafts
replies for you to approve. See Read events.Teams enrolled in the message history beta can also read stored conversations
and messages with chats_list, chats_get, messages_list, and
messages_get. See Read message history.Enrolled teams can list stored conversations and page through stored messages
for Numbers with hosted message storage enabled. Use
GET /messaging/{session}/chats and
GET /messaging/{session}/chats/{conversation}/messages, with filters for
time range, direction, and message type, and cursors in both directions.
Media is returned as downloadable media IDs, never as keys or storage URLs.Opening the Console returns you to the team and project you last worked in,
in the browser you used. A team you no longer belong to is skipped and your
first team opens instead.Settings and Logs now open on their first pane in one step, and every
Console link keeps the team and project in the address. This fixes opening
Settings shortly after the Console loaded, which could drop the team and
project from the address and leave the page unable to load until a reload.Returning to a screen you already opened is now immediate, and a screen you
have not opened shows its layout while it loads instead of holding the
previous page. See
Console overview.
The TypeScript SDK adds
client.operations.list, get, listTransitions,
wait, and cancel. The CLI adds polymorfa operation list, view,
wait, watch, and cancel; wait and watch follow an operation with
server long-polls and exit 0 on success, 1 on failure or cancellation,
and 8 when --timeout ends first. See Operations.Team API keys and project tokens can now list, inspect, wait for, and cancel
asynchronous operations such as campaign sends and production enrollments.
GET /platform/operations lists operations with filters for project,
resource, and status. GET /platform/operations/{operationId}?wait=30 holds
the request until the operation finishes or changes. POST /platform/operations/{operationId}/cancel stops operations that report
capabilities.cancellable. Reads need the operations:read scope, and
cancellation needs operations:cancel. The MCP server adds
operations_list, operations_get, and operations_wait. See
Operations.Read call volume, outcomes, answer rate, talk time and an hour-of-week
heatmap with
GET /platform/calls/stats, grouped by day, hour, number or
outcome. List call detail records with GET /platform/calls, or export them
as CSV or NDJSON with GET /platform/calls/export. Organization keys and
project tokens with sessions:read can use them; the other party appears
only as a team-specific pseudonym. The Console’s Calls page now shows the
same summary with charts. See
Call analytics and call records.The MCP server adds 38 tools
for projects, Customers, campaigns, templates, audiences, opt-outs, webhook
secret rotation and test sends, event replay, and delivery retry, plus reads
for the audit log, incidents, Health, billing, and members. Each tool
requires the same scope as its Platform API operation. Launching, resuming,
or stopping a campaign, archiving a Customer, deleting a template, and
webhook actions that send a delivery or rotate a secret require
confirm: true.GET /platform/sip/endpoint returns the host, SIP ports, SRTP requirement,
and RTP port range your PBX connects to and allows in its firewall. When the
environment has no SIP address, it returns status: "sip_not_hosted" and no
address. The Console’s SIP trunks page shows the same address. You no
longer need to ask support for it. See
Find the SIP address.Polymorfa no longer delivers
bartender.* proxy telemetry events to
webhooks, the events API, event streams, polymorfa listen, or MCP tools.
The Console webhook event picker no longer lists them. Adding one to
a webhook’s events now returns 400. A webhook that already lists one keeps
receiving its other events. See
Current event catalog.Webhooks, event history, event streams,
polymorfa listen, and the MCP event
tools now deliver only the event types documented in the
webhook reference. Endpoints that receive all events no
longer receive internal session events, and event history no longer lists
them. Test events you create are unchanged. See
Event history.The Platform API event-stream frame union points each frame type at its
schema, so generated clients can decode frames by
type. An earlier version
of this entry listed BanSafe events that Polymorfa does not send. See
BanSafe events for the delivered event types.Client-token session rules accept
conversationTtlSeconds, which sets how
long a contact stays replyable in conversation mode after their latest
message. Choose a value from 300 seconds (5 minutes) to 604800 seconds
(7 days). The default is 86400 seconds (24 hours), so you don’t need to
change existing rules. GET for session rules returns the value. Each
contact’s window now starts from that contact’s own latest message.Session rules persist until you replace or delete them, and every change
appears in the audit log. When a per-minute rateLimit or the conversation
window can’t be checked, client-token requests now fail with 503 and a
Retry-After header instead of proceeding without the check. See
Client tokens and
Set client rules.
Minting requirements and issuance errors are documented in
Mint a client token.Mint one client token for a Customer instead of one per session. Pass
customer instead of session to POST /platform/client-tokens, with an
optional allow list to narrow the token’s actions. The token covers the
numbers the Customer owns when you mint it. A number that moves to another
Customer stops working with the token immediately, and a number that moves
in needs a new token. Session rules still apply to every request.
Customer-scoped tokens are a beta; a team owner or admin enrolls the team.
See Customer-scoped tokens.The MCP server now has read tools.
events_list and events_get read your
event history, including retained message payloads when hosted message storage
is on. events_wait waits up to 60 seconds for new events and returns a cursor
for the next call. webhook_deliveries_list and webhook_deliveries_get show
webhook delivery status. The tools use the events:read and
webhook-deliveries:read scopes, and results are marked as untrusted content.
A new follow_up_incoming_messages prompt reads incoming messages and drafts
replies for you to approve. See Read events.Every Messaging and Platform error now includes
error.request_id, which
matches the X-Request-Id header. Requests made with a team API key or a
project token also return error.request_log_url, which opens the request in
the Console’s API request log. See
Request IDs and log links.New codes identify WhatsApp failures that previously returned a generic code:
recipient_not_on_whatsapp, conversation_window_closed,
template_not_approved, media_too_large, whatsapp_rate_limited,
new_chat_limit_reached, and whatsapp_account_restricted. BanSafe refusals
now return their documented bansafe_* and campaigns_not_entitled codes.
Some of these failures also changed HTTP status. Check
Codes added on September 18, 2026
before you update error handling.Every 429 now includes a Polymorfa-RateLimit-Reason header that names the
limit, such as request_rate or whatsapp. See
Rate-limit reasons.Message sends, reactions, message edits and deletions, channel message
reactions, and project campaign creation and launch accept an optional
Idempotency-Key header. A retry with the same key and request within 24
hours never sends again: it returns 409 idempotency_completed after a
success, or the original server error, with Idempotent-Replayed: true.
Reusing a key for a different request returns 409 idempotency_conflict, a
retry while the original is still running returns
409 idempotency_in_progress, and a retry after an unrecorded outcome returns
409 idempotency_outcome_unknown. Polymorfa keeps only the response status
and error code, never message content or the response body. See Retry sends safely.ConsoleBillingTeams
Claim the launch trial, unlimited members on Pay-As-You-Go, and plan labels on teams only
If your team doesn’t have a launch trial while the launch offer is open, the
Console shows a notice, and onboarding shows a claim card. Team owners and
admins select Claim your launch trial to start the 30-day trial: up to 15
real numbers on Standard or Pro at no charge, every add-on, and shareable
QuickLinks. Free and Pay-As-You-Go teams can claim. Each account gets one launch
trial: belonging to or joining a team with a trial uses it, and a team can’t
claim when any member already used one, including a new team created after
upgrading to Pay-As-You-Go. The notice explains when that is the reason.
Owners and admins can see the free real numbers left and cancel the trial in
Billing; a cancelled trial can’t be claimed again. See
Cancel the launch trial. Other members see a prompt to ask an owner or admin.
See Launch trial.Pay-As-You-Go teams have no member limit. Free teams keep up to two member
accounts, and pending invitations count toward that limit. When a Free team
is full, the Console offers the upgrade. See
Free and Pay-As-You-Go teams.The billing mode is shown only for the team: under the team switcher, on the
Projects page, and on the credit balance card in Billing, which also shows
launch trial days left and the claim. Projects no longer
show a Free or Pay-As-You-Go label, and Billing no longer has a separate
billing mode section.
After you create a team, onboarding now shows whether the team is on Free
or Pay-As-You-Go and what each includes. If your team has a launch trial,
onboarding shows the days left and how many real numbers it covers. The team
plan picker with paid subscription checkout is no longer part of onboarding.
The last step offers Upgrade to Pay-As-You-Go for Free teams. See
Teams and projects.
If Polymorfa can’t check whether a phone number is on WhatsApp, you can now
continue with Linked Devices. Before this fix, choosing Linked Devices for
such a number failed with “The connection type could not be selected.” Only a
number confirmed as not on WhatsApp is limited to Meta Cloud API. When a
connection choice or start is refused, the page now gives the reason, such as
a team that must upgrade to Pay-As-You-Go. See
QuickLink.
The Console now fits phone and tablet screens. On screens narrower than 768
pixels, open navigation with the menu button at the top left; it closes after
you choose a page. Wide tables scroll horizontally, and detail panels such as
the audit log event details appear below their table. See
Phones and tablets.
Retrying a failed webhook delivery or replaying an event now sends only that
delivery. Previously, the same request could also resend other failed
deliveries for the same webhook, so your endpoint could receive events you did
not ask to resend. You don’t need to change anything. See
retry a delivery and replay an event.
ConsoleBillingProjectsAPI
Free and Pay-As-You-Go teams, upgrade checklist, billing alerts, and projects without expiry
Teams now use one of two billing modes. Free teams have one project,
one real number at no charge, and 5 testing numbers per project.
Pay-As-You-Go teams can create more projects and send QuickLinks for real
numbers, and every real number uses credits. New teams start on Free. See
Free and Pay-As-You-Go teams.The Console now shows the team’s billing mode, Free or
Pay-As-You-Go, where projects showed Sandbox or Live. Go live
is now Upgrade to Pay-As-You-Go, and it upgrades the whole team. The checklist shows every step in one column.
You can reopen any step you have reached, and adding credits is optional.
After the upgrade, every real number, including the free one, uses credits
starting with its next billing window. The upgrade can’t be reversed. See
Upgrade to Pay-As-You-Go.Teams created during the launch offer stay on Free with a 30-day launch
trial: up to 15 real numbers on Standard or Pro at no charge, every add-on,
and QuickLinks for real numbers. Projects and Billing show the days left. See
Launch trial.When a Free team reaches a limit, the Console shows an upgrade prompt. The
API returns
409 with the error code payg_required when a Free team creates
a second project, adds a real number beyond its allowance, or creates a
QuickLink for a real number without an active launch trial. Handle this code
in integrations that create projects, numbers, or QuickLinks.Until you own a Pay-As-You-Go team, you can create a team only while you
don’t belong to any team. Invitations are not limited, and you can accept
them without creating a team first; the Console lists pending invitations before team
creation. See
Free and Pay-As-You-Go teams.Team owners and admins now see a banner at the top of the Console when
billing needs attention, such as a failed payment or suspended numbers. See
Billing alerts.Projects on Free no longer stop accepting new numbers 21 days after creation.Numbers, Calls, Logs, Usage, and Analytics now total every
project when you choose All projects. Calls, Logs, and Numbers include a
Project column. Campaigns, Customers, Flows, Templates, and Safety
list your projects so you can choose one. Switching projects keeps the current
page open. See All projects.
The Numbers table has a Device column. It shows each number’s
operating system and account type: Normal, WABA, Cloud, or
Coex. A purple Hybrid Link badge marks a phone number connected in
the project both as a linked device and through Meta Cloud API.
GET /platform/sessions/{sessionId}/me, GET /messaging/{session}/profile,
and the session.connected webhook no longer return platform. Read
phonePlatform and accountType instead.
The getClientRules response schema no longer lists verifiedJids; the API
never returned that field. See
connection methods.The Console now shows Catalogs only for teams with access. This does not
change Catalog API access or requests. See
Catalogs and commerce.
Standard team keys and project tokens can no longer retrieve raw QR
codes or pairing codes from
/api/{session}/pair/*. Create a QuickLink and
open or share its short-lived URL to connect a number. Console uses the same
QuickLink flow when you choose Link a real number now. Raw session.qr
events are no longer sent to customer webhooks or event streams. See
QuickLink.Expand event prefixes and select subscriptions with checkboxes. Search opens matching groups, and collapsing a group preserves its selections. See webhook setup.
Add multiple filters and ordered sorts to Console tables. Each active rule
appears as an editable pill above the table, and empty results keep the table
columns visible. The Projects table places its purple New action beside
these controls. Number menus now include management, API log, Customer, copy,
connection, and removal actions when applicable. See
Console overview and
Numbers.
Create personal or service-account keys with All, Restricted, or
Read only permissions. Restricted team keys can act across the team and
its projects; project keys stay within one project. Personal keys are revoked
when their owner loses the required access. Browser-token issuance also checks
every scope that session client rules can enable. See API keys.Webhook subscriptions use None / Receive dropdowns. Endpoint forms have
one scrolling area with visible action buttons. See webhook setup.
Webhook settings now list the event catalog for the selected team or project.
Search by event name, select matching events together, and review saved types
outside the catalog without losing them. Team endpoints offer an explicit
All team events option. See webhook setup.
Team owners and admins can manage message and number webhook endpoints
under project Settings → Webhooks. Save the signing secret shown when you
create an endpoint. Team-level endpoints remain separate and receive team
events. See webhook setup.
Drive calls over the API
A session can now originate calls:POST /messaging/voip/calls rings to from
the named session and returns the callId while the callee’s phone rings;
call.accepted and call.ended webhooks follow. POST /messaging/voip/mode
chooses how a session answers inbound calls — browser (default), agent,
or sdk, which lets the call ring until your code answers with
POST /messaging/voip/calls/{id}/accept (optionally with video) or declines with
/reject. A ringing call nobody decides on ends with call.missed.Group calls
POST /messaging/voip/calls/{id}/participants rings another person into a live
call. Roster changes reach the media socket as participant_joined,
participant_state, and participant_left frames, and the browser lifecycle
feed publishes the matching call.participant_* events.Media socket framing
The per-call media WebSocket accepts thepmfa.calls.v1 subprotocol: tagged
audio and H.264 video frames, a ready frame with the sample rate, and
ping/pong liveness. The ticket rides as the pmfa.ticket.<token>
subprotocol. Media connections require a ticket for the same call and
team. The raw-PCM socket keeps working unchanged.Outbound placement applies each Number’s call-start rate limit across server
keys and client tokens. A placement above the limit returns 429 before
ringing the destination; retry in the next minute.Client tokens gate placements and invites behind voip_place and answering
behind voip_answer; allowed_number applies to the callee. See the
Calls guide.QuickLink: connect a number with one hosted link
QuickLink is now a hosted page behind a 15-minute URL instead of an embeddable component. Create a link from Numbers › New number › Send a QuickLink, fromPOST /messaging/quicklinks with an team key or project
token, or through a Customer pairing link; then send the URL to the person
holding the phone. The page offers a QR code and a pairing code, asks for
confirmation once WhatsApp links, and returns the person to your allowlisted
callback URL. Creators follow progress with GET /messaging/quicklinks/{id} or in
Console, and cancel with DELETE /messaging/quicklinks/{id}.Link a real number now in Console creates a QuickLink and runs its pairing
flow inside the dialog.Personalize the hosted page
Settings → QuickLink replaces Embedded Signup. Set the headline, description, and success message, add support, privacy, and terms links, upload a logo or reuse the team logo or project icon, choose which method opens first, and preview the page as you type.POST /messaging/quicklinks accepts
expiresInSeconds (5–60 minutes). Saved settings moved to
GET/PUT /platform/quicklink with typed responses; the permission is now named
quicklink:manage, and keys that carry widget:create keep working.Removed: POST/DELETE /api/widget/sessions, GET/PUT /platform/widget, the
widget handoff routes, the hosted embed script, the React connect component,
and the widget_start, widget_pair, widget_status,
widget_embedded_signup, and widget_handoff client-token actions. Client
tokens no longer pair numbers. Integrations that created widget sessions
must create QuickLinks instead and send the returned URL; integrations that
called /platform/widget must switch to /platform/quicklink and drop modesAllowed,
allowedOrigins, and colors. See QuickLink.Projects use the shared resizable table with column filters and right-click
actions. Project overviews show number health, recent campaigns, template
approvals, and Flow counts. Copy the labeled project ID or select the icon to
edit project settings. Sandbox and Live labels are consistent, and number
plan defaults are separate from team subscriptions. See
Teams and projects.
Table toolbars also expose sorting and editable active filters. Text filters
wait for Enter or Apply, date filters use a calendar, and number ownership
filters offer team-member choices. See Numbers.
Organize Numbers by Customer
Signed-in project members can enable Customers, assign existing Numbers to a protected Default customer, create Customer records, and send a revocable link for a customer to connect one Number without Console access. Platform integrations need the newcustomers:read or customers:manage
scope for Customer operations. Existing projects require no action until a
project member enables the feature. Inspector shows Customer assignment
separately from device ownership and can filter sessions by Customer. See
Customers.Webhooks have explicit ownership and one-time secrets
The Platform API now manages team webhooks separately from project webhooks. Create and secret-rotation responses return generated signing secrets once; later reads expose only secret metadata, and custom header values remain write-only. Mutations require idempotency keys, and project credentials cannot access team webhook endpoints. See Webhooks.Paste Inspector device codes
The browser authorization page can paste and normalize the device code shown by Inspector. Clipboard access happens only after you choose Paste. Manual entry remains available when the browser blocks access or the clipboard does not contain a code. See Authorize Inspector.ConsoleSessionsSandbox
Console explains number connection issues and offers the matching recovery action
Connection issues show their cause and recovery action
The Numbers page now shows each number’s connection state and a plain-language reason when it needs attention. Connected numbers can be stopped, manually stopped numbers can be started, failed runtimes can be retried, and logged-out numbers direct you to link again. Project health now recognizes connected runtime statuses consistently. See Sessions.Claimed testing numbers finish reconnecting
Reopening or switching between claimed testing numbers now restores the saved companion identity and keeps the selected chat view visible instead of remaining on the startup screen. No action is required. See Claims and devices.Testing numbers share complete simulated session state
Testing numbers now simulate the public messaging and session command surface, including media, message mutations, groups, channels, contacts, presence, profiles, privacy, labels, and business catalogs. API actions and Inspector use the same simulated account and conversation state. Testing numbers still cannot contact real WhatsApp recipients. No action is required. See What is Sandbox?.Testing-number API devices reconnect across restarts
The API-controlled device for a testing number now stays linked across service and app restarts, so message requests resume without pairing the device again. It accepts messages while the recipient’s Inspector companion is closed and delivers them after that companion reconnects. Removing the testing number invalidates the linked device and cancels pending delivery. Stopping the API-controlled device no longer unlinks a claimed Inspector device. No action is required. See Sandbox quickstart.Testing-number contact lookup keeps accounts distinct
Searching for another testing number in the same project now resolves that number’s own simulated WhatsApp identity instead of opening the signed-in number’s self chat. Restarting a testing number whose API-controlled device was reset now pairs its replacement automatically instead of remaining in a connecting state. No action is required. See Number pool.Testing-number names stay separate from phone numbers
Testing numbers created without an optional display name now keep the name unset and use the generated phone number only as a visual fallback. Existing testing numbers whose generated phone was copied into the name are corrected automatically. No action is required. See Number pool.Claimed Inspector devices persist across restarts
Closing Inspector now keeps the claimed device linked. Reopening the same number on that computer reconnects the saved device without another pairing step. Messages between testing numbers now reach both the API-controlled and Inspector devices, including messages sent immediately after Inspector finishes connecting. Self-sends no longer disconnect the Inspector device. Choose Release or sign out to unlink it. No action is required. See Claims and devices.Send to a testing number by phone number
Testing-number message requests now accept the recipient as an E.164 phone number with a leading+. The recipient must be an active testing number in the same
project. See Sandbox quickstart.Inspector claim release keeps API sessions available
Releasing or switching a testing number in Inspector no longer interrupts that number’s API-controlled session. The testing number remains connected for messaging and can be claimed again without recreating it. No action is required. See Claims and devices.Project credentials now match team-key capabilities inside one project
Project credentials can now use every machine API operation that Polymorfa can confine to their authenticated project, including project and session operations in the Platform API, widget sessions, sandbox pools, and linked device business reads. Team membership, team billing and settings, team API-key administration, and dashboard-only operations remain unavailable. Existing integrations need no action. See Authentication.Testing-number deletion closes active sessions
Deleting a testing number now closes its active Inspector connection and clears its simulated state before removing the number. If teardown is temporarily unavailable, deletion fails without removing the number so you can retry. No action is required. See Number pool.Real and simulated sessions in Inspector
Inspector now opens both production WhatsApp numbers and simulated testing numbers through the same exclusive claim flow. Production sessions warn before first use because Inspector can act as and send from the real number. The Console and Inspector identify who holds a session without displaying a device identifier.Production sessions load retained history when Hosted Message Storage is enabled and remain usable for live activity if retained history is temporarily unavailable. Testing-number creation succeeds only after its API-controlled device is ready. Repeated start, stop, and restart requests update simulated availability consistently, and Inspector offers a focused retry screen instead of exposing WhatsApp pairing UI after a runtime failure. See Install Polymorfa Inspector and Claims and devices.Three number tiers
Free, Standard, and Pro are the available number tiers. Premium and Enterprise volume pricing changes the Standard or Pro rate instead of assigning a separate tier. The number-pricing page now links to team plans in a separate full-width callout and introduces number tiers and team plans as two separate choices. Both pricing pages include detailed comparisons below their cards. Team-plan pricing defines seats as team-member accounts and identifies that self-hosting has no per-number charge. Session-management requests no longer acceptscale as a tierOverride. Existing scale overrides move to Pro.
See Billing and the Platform
API.Polymorfa product identity
The Console, APIs, documentation, and Inspector now use the Polymorfa name consistently. New credentials and Inspector deep links use the Polymorfa identifiers documented in API keys, Client tokens, and Polymorfa Inspector.Guided project creation
New project now opens a three-step flow for the project identity, starting path, default number tier, and final review. Projects are created in Sandbox; you can choose the active Standard or Pro rate, then open the new workspace or continue directly into Go Live setup. See Create a project.One flow for adding numbers
Numbers now opens one closeable setup flow for linking a real number in Console, creating a 15-minute pairing link, viewing Baileys or whatsmeow migration guidance, or adding a free testing number. Each option includes a time estimate, and the testing-number option appears first. Sandbox keeps only the testing-number path enabled. Testing numbers now support 243 country formats through a searchable SVG-flag picker with country names, short names, and calling codes. Phone-format metadata validates generated identities. Closing an unfinished in-Console QuickLink cancels the pending connection. See Sessions.Account settings and invitations
Pending team invitations now appear under Account > Invites, where you can accept or decline them. Accepting refreshes team access before opening the Console, and an expired session returns through sign-in to Invites. Account settings use the same centered content width as authentication settings. You can update your profile photo beside your display name, and the saved photo appears in the Console account menu. The Support page now shows the case workspace and clearly identifies that case submission is not available yet. General account settings can restore dismissed onboarding tips or permanently delete your personal account after email confirmation. A team’s only owner must assign another owner or delete the team first, and team-owned resources remain with the team. See Teams and projects.Inspector desktop navigation
Inspector now groups testing numbers beneath collapsible project sections in a resizable team sidebar and opens sessions as tabs above WhatsApp. The home dashboard, account and number menus, project actions, copy controls, and appearance settings remain available without replacing the active WhatsApp view. Inspector and WhatsApp now share the selected light, dark, or system appearance. See Install Polymorfa Inspector.Internal billing and reliable balance controls
Low-balance reminder and auto-top-up triggers now display and save as credits. Team owners and admins can choose email, a public HTTPS webhook, both delivery methods, or turn the reminder off. Private and reserved webhook destinations are rejected. My Notifications links directly to the active team’s reminder controls. Billing items now lists only teams the user can manage, and invoice history can load older records. Reminder copy now states that a low balance can be reported again after 24 hours. Automatic top-up controls now refresh immediately after the default payment method changes.Team owners and admins now manage subscriptions and Tax IDs directly in the Console. Plan changes use the saved default payment method, cancellations take effect at the end of the billing period, and a scheduled cancellation stays scheduled across plan changes until it is explicitly resumed. Default payment-method changes now apply to subscription renewals as well as future invoices. Existing defaults are reconciled for teams moving from the previous billing settings, and all attached payment methods are available in the new page. When the billing provider no longer has a saved default, the stale reference is cleared and auto-top-up is disabled until another default is selected. An incomplete first payment returns to its existing secure Checkout session instead of showing unavailable plan controls. Adding a Tax ID preserves existing identifiers, while removal targets only the selected ID. Clearing a purchase order now removes it from future invoices. The Tax ID selector covers every supported type, shows its expected format, and returns type-specific guidance when a value is rejected. Successful Checkout returns now wait for the active team’s durable credit or subscription update before reporting success. The payment-method setup action is hidden when secure collection is unavailable, and saved methods are limited to cards, Pix, and UPI methods compatible with future automatic charges. See Billing settings.Polymorfa credential prefixes
Team, project, and client credentials usepmfa_, pmfa_pt_, and
pmfa_ct_. See API keys and Client
tokens.Portable OpenAPI document
Import the public Messaging, Polymorfa Graph, and Platform API contracts from one vendor-neutral OpenAPI 3 document. The document works with Swagger UI and OpenAPI client generators, includes standard webhook contracts, and excludes private contracts. Existing API paths and request shapes are unchanged.API contract updates
Private clients generated from an older Platform OpenAPI document must be regenerated because its operation identifiers are now dot-free method names. HTTP methods and paths are unchanged. See SDK availability.Contact registration checks accept both repeatedphone query keys and one
comma-delimited phone value, matching Linked Device clients.
QR retrieval accepts format=image for PNG output and defaults to JSON in
the Linked Device API.Settings page reliability
Billing, Webhooks, and Embedded Signup settings now load when their API requests succeed, including teams that have not saved widget settings yet. Billing displays active numbers and consumed credits from the authoritative usage response. Webhook settings remain team-scoped and never reveal a stored signing secret. See Usage and credits, Webhooks, and QuickLink.PUT /platform/widget now rejects malformed or non-object JSON, unknown settings,
invalid enum values, query parameters, and incorrect field types with 400.
Redirect and embed allowlists now accept HTTPS entries only. Remove
undeclared fields before updating saved widget settings. See
Saved settings.Label observation and history sync
Label observation is off until you turn it on, matching presence and typing observation. In-memory label observations expire after 15 minutes and expose their observation and expiry timestamps. Lowering label retention now removes durable projections for connected and disconnected sessions before project retention can be re-enabled. See Linked-device controls.History sync now defaults to metadata-only acceptance instead of forwarding every history body. Sessions can opt into durablehistory.sync webhook
delivery, full-history requests are explicit and bounded, and processing
metadata has fixed retention limits. Runner recovery preserves the session’s
project-scoped history and observation behavior.A chunk the linked device re-uploads after a failure resolves to the original
record rather than arriving twice. deliver refuses a chunk larger than the
event transport carries and records it without acknowledging it. A policy
change made while a session waits for a QR scan reaches that pairing. Deleting
a session deletes its history-sync metadata with it. The history.sync
payload carries the chunk identity, mode, encrypted size, and item counts. See
Linked-device controls.Console insights
Analytics, usage, and activity logs now load selected date ranges without failing the surrounding console page. No action is required. See Usage and credits and Audit logs.Presence observation
Presence and typing observation are off until you turn them on. Set the maximum policy for a project, then set a per-session policy within that ceiling. A session policy cannot exceed the project ceiling, and lowering the ceiling lowers any session already above it.Reading a contact’s presence never subscribes and never performs a live WhatsApp lookup. Responses report whether the value isfresh, stale, or
unknown, and why an unknown result carries no data.Presence observations are never written to the database. In events mode
nothing is kept: each observation is delivered as a webhook and discarded. In
cache mode the most recent observation per contact is held in the session’s
bounded in-memory cache so a read can answer without a lookup; it is marked
stale after 180 seconds and is dropped when the cache evicts it, when the
policy is lowered, when a limit suspends observation, or when the session
ends.Policy changes require the presence:observe scope, reads require
presence:read, and changing the session’s own presence requires
presence:write. See Linked-device controls.The presence types in @polymorfa/types changed. available is now
optional, lastSeen is an ISO 8601 string rather than Unix seconds, and the
composing and paused arrays are replaced by a single chatState object.
Regenerate any client built against the previous shape. See
SDK availability.Stable user identities
Native Messaging API contact and webhook objects now expose the ID as one stableid. Phone numbers and WhatsApp usernames remain optional aliases,
and alias resolution accepts phone numbers, usernames, and existing IDs.
This gives integrations one key for contact upserts even when a phone number
is hidden or a username changes. Deprecated identity field names remain in
responses for clients pinned to the March 2026 API version. See User identities.Integrations can now read WhatsApp’s 60-digit identity verification code and
display-QR payload for a stable stable user ID. The API does not expose
the underlying identity-key payload. See Verify a user’s encryption
identity.WhatsApp Business App commerce
The native Messaging API now reads live catalogs, products, collections, and order details from connected WhatsApp Business App sessions. These operations require thebusiness:read scope and do not retain returned commerce data.
Existing clients do not need to change. See Catalogs and commerce.WhatsApp Business App profile
The native Messaging API now reads and updates the connected WhatsApp Business App profile, including its description, address, email, websites, weekly hours, and cover photo. Existing commerce clients do not need to change. Profile reads requireprofile:read; updates and cover-photo actions
require profile:write. See Business profile.Connected WhatsApp Business App sessions can also create, replace, and
delete catalog products. Product image uploads accept bounded HTTPS or
base64 sources, while existing WhatsApp media URLs can be reused without
another transfer. Catalog changes require profile:write.Catalog management now includes collection creation, name and product
membership updates, ordering, and deletion. Collection changes use live
WhatsApp Business App state and require profile:write.Connected accounts can create their first Business App catalog, enable or
disable its cart, change product visibility without replacing the product,
and submit eligible product or collection review requests. These controls
require profile:write. See Catalogs and commerce.Eligible connected accounts can now read and replace their live merchant
compliance record, including legal entity, customer-care, and grievance
officer details. Reads require profile:read; replacements require
profile:write. Polymorfa does not retain a compliance mirror. See
Merchant compliance details.Connected accounts can now create, replace, and delete WhatsApp Business App
quick replies. Projects can keep the default webhook-only behavior, disable
observation, or enable a bounded in-memory projection for best-effort list
reads. Quick-reply content is not written to PostgreSQL; projects that need
a durable list can subscribe to business.quick_reply.update and maintain
their own projection. See
Quick replies.The Messaging API can send Business App product cards, product lists,
catalog orders, single-select lists, and typed native-flow buttons through
the existing message-send operation. Existing message payloads do not need
to change. See Send a message.The same operation now sends address collection prompts and published
WhatsApp Flows. Completed interactions arrive through a typed
native_flow_response webhook payload. Cloud API consumers using native
webhook format must handle that type; Meta-format webhooks retain
interactive.nfm_reply. See Send a message.Business App clients can read live Facebook, Instagram, catalog-link, and
advertising-identity metadata, plus WhatsApp’s feature eligibility statuses.
These reads require business:read and do not start background tracking or
retain a projection. See Linked accounts and feature eligibility.Flow authoring
Projects now include a WhatsApp Flow builder with route-aware screen editing, lossless JSON import and export, structural validation, revision-safe autosave, and an interactive recipient preview. Cloud API and linked-device projects share the same draft authoring experience; Meta-hosted preview and asset lifecycle controls remain Cloud API capabilities. See WhatsApp Flow builder.Production enrollment
Moving a Sandbox project to Live now returns an operation identifier while provisioning continues. Platform API clients can read the operation, resolve approval requirements, or cancel an active enrollment without treating the initial request as completed provisioning. See Project stages.Team billing
Team billing settings now cover invoice recipients, company and address details, purchase-order references, tax identifiers, saved payment methods, and hosted invoice downloads. Billing data remains scoped to the selected team. See Billing settings.Message delivery
Messaging API sends now begin without an automatic typing or recording delay. Sending a message no longer changes the session’s presence or emits a chat indicator; applications that need those signals must call the presence or typing operation explicitly. No action is required for other clients. See Send a message.Linked-device controls
The native Messaging API now covers privacy settings, direct and group-chat disappearing timers, group permissions, live contact and business metadata, blocklist reads, channel message history and reactions, temporary channel live-update subscriptions, and incoming-call rejection. Existing clients do not need to change. See Linked-device controls.Label observation is now configurable alongside presence observation. Label and chat-label reads preserve the existing array response by default;includeObservation=true adds whether data is disabled, unknown, partial, or
based on a complete snapshot. Clients that replace chat labels must handle
409 until a cached or project-retained view is authoritative. The
labels.update webhook includes observed label names, colors, ordering,
deletion state, association state, and timestamps when those fields apply.API names
Public documentation now groups messaging operations under Messaging API and team and project automation under Platform API. Endpoint paths, credential formats, and version headers are unchanged.Account security
Account settings now support multiple verified email addresses and a primary sign-in address. Authentication settings now group email, passkeys, and connected social providers in one Sign-in methods card, with additional providers available from the same card. A separate Two-factor authentication card shows enrollment status and authenticator controls. Browser, Inspector, and command-line sessions remain below these cards. Active sessions show their IP address, estimated location, and last active time, and you can log out every other session without ending the session on the device you are using. See Security. Adding an email address now explains when it is already in use instead of showing a generic failure. If a session check fails repeatedly, the Console now stops retrying and gives you actions to retry the check or return to sign in.Personal notification preferences now live under Team settings > My Notifications. Each team has its own default verified inbox, email choices, and project-specific routes. In-app notifications remain enabled. Changes save automatically, so there is no separate save action. See Security.Team owners can now delete a non-final team without entering an authenticator code when authenticator two-factor authentication is not enabled on their account. Enrolled owners are still asked for a current six-digit code. See Teams and projects.Team and project settings
Team and project API keys now share the Settings experience while preserving their separate authority. Team settings also provide webhook endpoint management, including event selection, delivery format, signing-secret rotation, and retry controls. See API keys and Webhooks.Moving a Sandbox project to Live now uses a production enrollment checklist for business details, expected traffic, recipient consent, and the credit requirement shown in Checkout. See Project stages.Privacy controls
Analytics remain disabled until you allow them. Use Cookie settings in the site footer to change the choice later; essential account and security cookies remain enabled.Embedded signup
Added public Platform API operations to read and update team or project embedded-signup settings atGET /platform/widget and PUT /platform/widget. See
Saved settings.The hosted widget loader at /widget/embed.js remains publicly available
when Meta-compatible Messaging API routes are enabled. Project credentials
can cancel only widget sessions owned by the same project.Inspector team identity
Inspector’s team switcher now uses the authorized teams’ display names and profile images instead of their URL slugs. The account menu also uses your account photo, with the Console’s generated Glass avatar when no photo is set. See Install Polymorfa Inspector.Platform API
Platform API endpoints identify whether they accept an team key or require a signed-in Console session. Message-template endpoints require explicit project context. Their responses useid and createdAt
consistently, and template lists are bounded to 500 drafts.
Template, team, and member changes verify current owner or admin
authority. See Platform API.Session management
Added typed public Platform API endpoints for stopping, removing, and updating sessions; stopping or removing up to 100 sessions in one request; and creating testing numbers. Testing numbers support US, GB, BR, and IN formats. See Session-management endpoints.Session tier overrides now use the number-tier namesfree, standard,
pro, and scale. Team-plan names are not accepted as number tiers.Widget handoff state responses now use Cache-Control: no-store so browsers
and shared caches do not retain the QR or session status. See
QuickLink.Inspector authorization
Inspector authorization now confirms the signed-in account and team before accepting a device code. The approval review shows the requesting app, request time, available city and IP information, selected team, and active projects. See Install Polymorfa Inspector.Account and onboarding
Social sign-in no longer creates an account implicitly; social account creation starts from sign-up. Onboarding now offers English and Brazilian Portuguese, previews available languages, and shows each team once in the team switcher.Added the date-pinned
Polymorfa-Version request header. The header keeps its
existing name for compatibility after the Polymorfa product rename.