Send WhatsApp messages with C# (.NET) via REST API

Program.cs (registro do cliente)

using Microsoft.Extensions.DependencyInjection;

var services = new ServiceCollection();

services.AddHttpClient<ZapZapClient>(http =>
{
    http.BaseAddress = new Uri("https://api.zapzapapi.com/api/v1/");
    http.Timeout = TimeSpan.FromSeconds(30);
    http.DefaultRequestHeaders.Add("x-api-key", Environment.GetEnvironmentVariable("ZAPZAP_API_KEY"));
    http.DefaultRequestHeaders.Add("x-api-secret", Environment.GetEnvironmentVariable("ZAPZAP_API_SECRET"));
});

var provider = services.BuildServiceProvider();
var zap = provider.GetRequiredService<ZapZapClient>();

var id = await zap.SendTextAsync("5511999999999", "Olá! Seu pedido saiu para entrega.");
Console.WriteLine("texto enviado: " + id);

var idDoc = await zap.SendMediaAsync("5511999999999", "document", "https://exemplo.com/nota.pdf", "Segue a sua nota fiscal.");
Console.WriteLine("documento enviado: " + idDoc);

ZapZapClient.cs

using System.Net.Http.Json;
using System.Text.Json;

public class ZapZapClient
{
    private readonly HttpClient _http;
    private readonly string _instance = Environment.GetEnvironmentVariable("INSTANCE_ID")!;

    public ZapZapClient(HttpClient http) => _http = http;

    public Task<string?> SendTextAsync(string number, string text) =>
        PostAsync($"{_instance}/send/text", new { number, text });

    public Task<string?> SendMediaAsync(string number, string type, string fileUrl, string? caption = null)
    {
        var body = new Dictionary<string, object> { ["number"] = number, ["type"] = type, ["file"] = fileUrl };
        if (!string.IsNullOrEmpty(caption)) body["text"] = caption;
        return PostAsync($"{_instance}/send/media", body);
    }

    // devolve apenas os numeros que existem no WhatsApp
    public async Task<List<string>> ExistentesAsync(IEnumerable<string> numbers)
    {
        using var resp = await _http.PostAsJsonAsync($"{_instance}/chat/check", new { numbers });
        var json = await resp.Content.ReadAsStringAsync();
        if (!resp.IsSuccessStatusCode)
            throw new HttpRequestException($"zapzap {(int)resp.StatusCode}: {json}");

        var ok = new List<string>();
        using var doc = JsonDocument.Parse(json);
        foreach (var item in doc.RootElement.EnumerateArray())
        {
            if (item.GetProperty("isInWhatsapp").GetBoolean())
                ok.Add(item.GetProperty("query").GetString()!);
        }
        return ok;
    }

    private async Task<string?> PostAsync(string path, object body)
    {
        using var resp = await _http.PostAsJsonAsync(path, body);
        var json = await resp.Content.ReadAsStringAsync();
        if (!resp.IsSuccessStatusCode)
            throw new HttpRequestException($"zapzap {(int)resp.StatusCode}: {json}");

        using var doc = JsonDocument.Parse(json);
        return doc.RootElement.TryGetProperty("messageId", out var id) ? id.GetString() : null;
    }
}

WebhookApi/Program.cs (ASP.NET Core minimal API)

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

var app = WebApplication.CreateBuilder(args).Build();
var secret = Environment.GetEnvironmentVariable("ZAPZAP_WEBHOOK_SECRET")!;

app.MapPost("/webhooks/zapzap", async (HttpRequest req) =>
{
    using var ms = new MemoryStream();
    await req.Body.CopyToAsync(ms);
    var raw = ms.ToArray();

    if (!Valida(secret, raw, req.Headers["X-ZapZap-Signature"].ToString()))
        return Results.Unauthorized();

    var deliveryId = req.Headers["X-ZapZap-Id"].ToString(); // chave de deduplicacao
    using var doc = JsonDocument.Parse(raw);
    var root = doc.RootElement;

    if (root.GetProperty("event").GetString() == "messages"
        && root.TryGetProperty("data", out var data)
        && data.TryGetProperty("message", out var msg)
        && !(msg.TryGetProperty("fromMe", out var fm) && fm.GetBoolean()))
    {
        Console.WriteLine($"{deliveryId}: {msg.GetProperty("chatid").GetString()} -> {msg.GetProperty("text").GetString()}");
        // aqui: enfileirar o trabalho em vez de processar na requisicao
    }
    return Results.Ok();
});

static bool Valida(string secret, byte[] raw, string header)
{
    long t = 0; string v1 = "";
    foreach (var parte in header.Split(','))
    {
        var kv = parte.Trim().Split('=', 2);
        if (kv.Length != 2) continue;
        if (kv[0] == "t") long.TryParse(kv[1], out t);
        if (kv[0] == "v1") v1 = kv[1];
    }
    if (t == 0 || v1.Length == 0) return false;
    if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - t) > 300) return false;

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var payload = Encoding.UTF8.GetBytes(t + ".").Concat(raw).ToArray();
    var esperado = Convert.ToHexString(hmac.ComputeHash(payload)).ToLowerInvariant();
    return CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(esperado), Encoding.UTF8.GetBytes(v1));
}

app.Run();

Teste de envio com curl

curl -X POST "https://api.zapzapapi.com/api/v1/$INSTANCE_ID/send/text" \
  -H "x-api-key: $ZAPZAP_API_KEY" \
  -H "x-api-secret: $ZAPZAP_API_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"number":"5511999999999","text":"Teste de envio"}'
# resposta esperada: {"messageId":"...","status":"sent"}