Bring Lahabali into
your own software.

Start with your balance

1. Create an account and activate an API-enabled annual subscription.
2. Open API & integrations, name your application, select permissions and create a key.
3. Copy the key once and store it securely on your server. Make your first request below.

curl --request GET 'https://www.lahabali.com/api/v3/balance' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Accept: application/json'

Base URL: https://www.lahabali.com/api/v3. Use the public HTTPS address of your Lahabali installation in production; localhost addresses only work on the local machine. Responses are JSON. A successful HTTP response may still include a provider or validation failure in the response body, so inspect both.

One key for each connected application

Send your key in the Authorization: Bearer header. Do not put keys in browser JavaScript, URLs or public repositories. Company keys are displayed once and stored as hashes, with an expiry you choose. You can revoke individual keys without disconnecting other applications.

Scopes limit each key to account reads, sending messages, reports, reading contacts or changing contacts. Your existing account permissions and subscription channel restrictions still apply. Subscription expiry or removal of API access blocks further calls.

Existing legacy credentials remain available under their original authentication policy. New company keys use the authenticated /api/v3 endpoints, not the legacy query-token API.

Available endpoints

Use the public UID returned by the API for resource addresses. Only resources belonging to your account are accessible. Contact creation uses PHONE and the contact group’s configured custom-field tags; creating a group requires name.

Send a message

curl --request POST 'https://www.lahabali.com/api/v3/sms/send' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
    "recipient": "233XXXXXXXXX",
    "sender_id": "YOUR_APPROVED_SENDER",
    "type": "plain",
    "message": "Your appointment is confirmed."
  }'

The phone and sender above are placeholders. Use an international recipient number and your own approved sender. Supported message types depend on your plan and configured provider: plain, unicode, voice, whatsapp, mms, viber and otp. Voice requires language and gender; supported media messages require media_url. Delivery may remain asynchronous; use reports to track it.

Campaign requests use contact_list_id, message, the approved sender_id and type. Review your audience and credit balance before sending. The API does not currently guarantee idempotent message submission: do not blindly repeat a send after a network timeout, because it could deliver twice.

Your plan includes API capacity

Monthly request allowances reset at the start of each calendar month in UTC. Calls that pass the API access check count, including downstream validation or provider errors. Unauthorized calls rejected before that check do not consume the monthly allowance. Messaging charges consume your existing message-credit balance separately.

Responses include X-RateLimit-Limit, X-RateLimit-Remaining, X-API-Monthly-Limit and X-API-Monthly-Remaining headers. Limits are shared across your company’s keys. Reducing the key allowance blocks creation of additional keys; it does not silently revoke existing integrations.

Handle errors clearly

• 401: missing, invalid, expired or revoked key.
• 402: inactive subscription or a channel outside your plan.
• 403: API not included or key/account lacks permission.
• 404: resource unavailable to this account.
• 422: request data needs correction.
• 429: per-minute or monthly request allowance reached. Respect Retry-After.

For reads, retry temporary network failures with a delay. For sends, check delivery history before resubmitting. No credentials or message contents are required by the website editor.