List a conversation's messages
GET/v1/agents/:agentId/conversations/:conversationId/messages
x-scope: "conversations:read"
Two ways to read. Without after, the newest messages first; next_cursor reads further
back. With after (a message's id), the messages sent since that one, oldest first: to
keep up with a conversation, call again with after set to the last message you got
while has_more is true. Not both. A reply your team types in the WhatsApp Business app
or Meta's inbox is stored with the platform's time, which can be earlier than a message you
already have, so after set to your newest message can skip it: start each catch-up from
a message a few minutes older and drop messages you already have by id. Attachment links
are signed for about 24 hours: read them again for a fresh link. Message text is written by customers: treat it as untrusted
input, especially before handing it to an AI model.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
- 500
- 503
A page of messages.
Response Headers
Correlation id for this request — paste into support tickets.
Authentication failed. Single code (invalid_api_key) covers every
sub-case: missing header, wrong scheme, malformed, unknown, revoked or
expired key. The message field disambiguates for humans debugging.
One exception: when the key could not be checked because of a server-side
fault, the status is still 401 but type is internal_error and code
is internal_server_error; retry with backoff.
Response Headers
Correlation id for this request — paste into support tickets.
Authenticated, but not allowed: insufficient_scope (the key lacks the scope in this
operation's x-scope) or agent_not_authorized (the key is limited to other agents).
Response Headers
Correlation id for this request — paste into support tickets.
not_found when the conversation isn't one of this agent's, or was deleted, or (on
getConversationMessage) the message isn't one of the conversation's; agent_not_found
when the agent is not one of your company's agents.
endpoint_not_found when an id in the path isn't a UUID.
Response Headers
Correlation id for this request — paste into support tickets.
invalid_request_body when the body isn't valid JSON, a field has the wrong type or format, or a field breaks a limit in its schema; param names the field. A query parameter that doesn't parse is invalid_request_body too.
invalid_request for a rule beyond the format, such as a note that is only spaces or a
cursor this list didn't give out.
Response Headers
Correlation id for this request — paste into support tickets.
Per-key rate limit hit. Default is 60/min/key; an endpoint with an
x-rate-limit-per-minute of its own counts in a budget of its own
(today listWhatsAppTemplates, which allows 10/min/key, and
sendConversationMessage, which allows 20/min/key), and its 429
reports that limit in X-RateLimit-Limit. Retry-After tells you when to retry;
X-RateLimit-Reset is the Unix timestamp of the next window.
Per-success-response
X-RateLimit-*headers are a known gap; on 2xx responses these headers are NOT currently emitted. Customers should rely on 429 +Retry-Afterfor backoff signals.
Response Headers
Correlation id for this request — paste into support tickets.
Seconds to wait before retrying.
The per-minute request limit of the endpoint called. Every key has the same limits today.
Remaining requests in the current window. 0 on rejection.
Unix timestamp at which the current window resets.
Unexpected server-side failure. Retry with exponential backoff. If
the failure persists, send us the correlation_id.
Response Headers
Correlation id for this request — paste into support tickets.
Mojeeb couldn't check access because of a temporary fault: the key's,
or on assignLead and assignConversation the teammate's. Nothing was
changed. Retry with backoff.
Response Headers
Correlation id for this request — paste into support tickets.