Alerts from your own system
When an alarm goes off, a cold store fails or your website goes down, the right person should know straight away. One call from your own system sends a WhatsApp message from your business number. Home Assistant, n8n and any tool that can call a URL can do it.
What you need
A WhatsApp number connected to Tobachat. Alerts come from that number, under your business name.
- An approved template in the Utility category, with fixed text around the variables. For example: Alert from {{1}}: {{2}}. You get this message because you signed up for our outage alerts. A template cannot start or end with a variable.
- An API key. Create it under Integrations, in Webhook / API. You see the key once, so put it in your password manager right away.
- The recipient's number, with country code. That is someone who asked for it: you, your team, or a customer who signed up for alerts.
The call
POST to https://api.tobachat.nl/v1/send-template with your key in the X-API-Key header. The body holds the phone number, the template name as the Templates page shows it, the language and the values for the variables.
Key the values by the numbers in your template ("1", "2"), or by the names if your template uses named variables. You can leave out the language when that template name exists in one language only.
Add an Idempotency-Key, your own code per alert. If your system retries because it never got an answer, Tobachat recognises the alert and does not send it twice. This holds for 24 hours.
curl -X POST https://api.tobachat.nl/v1/send-template \
-H "X-API-Key: tc_live_..." \
-H "Content-Type: application/json" \
-H "Idempotency-Key: cold-store-2-2026-10-30T08:15" \
-d '{
"phone": "+31612345678",
"template": "outage_alert",
"language": "en",
"variable_mapping": { "1": "Cold store 2", "2": "8.4 degrees" }
}'Home Assistant
Home Assistant does this with a rest_command. The key goes in secrets.yaml, the command in configuration.yaml, and an automation calls it. Restart Home Assistant once and the command is ready.
The example fires when a leak sensor trips. Any other trigger works the same way: a door left open, a battery running low, a freezer getting warm.
tobachat_api_key: tc_live_...rest_command:
tobachat_alert:
url: https://api.tobachat.nl/v1/send-template
method: POST
headers:
X-API-Key: !secret tobachat_api_key
content_type: "application/json"
payload: >-
{"phone": "{{ phone }}",
"template": "outage_alert",
"language": "en",
"variable_mapping": {"1": {{ where | to_json }}, "2": {{ what | to_json }}}}- alias: "Leak in the plant room"
triggers:
- trigger: state
entity_id: binary_sensor.leak_sensor_plant_room
to: "on"
actions:
- action: rest_command.tobachat_alert
data:
phone: "+31612345678"
where: "Plant room"
what: "water on the floor"n8n
In n8n, use the HTTP Request node. Pick POST and enter https://api.tobachat.nl/v1/send-template. Under Authentication choose Generic Credential Type, then Header Auth, with X-API-Key as the name and your key as the value.
Turn on Send Body, choose JSON and Using JSON, and switch the field to Expression so n8n fills in values from the previous step, such as an uptime monitor reporting a site that stopped answering. To stop repeats, turn on Send Headers and set Idempotency-Key to {{ $execution.id }}-{{ $itemIndex }}, so each recipient in the same run gets a code of its own.
{
"phone": "+31612345678",
"template": "outage_alert",
"language": "en",
"variable_mapping": {
"1": "{{ $json.monitor }}",
"2": "{{ $json.status }}"
}
}What comes back
A 200 means Meta accepted the message. Whether it arrived shows as ticks on the alert in your inbox, in the conversation with the recipient. On an error, the code is in the error field.
| Response | Meaning | What to do |
|---|---|---|
| 200 with wamid | Sent. | Nothing. |
| 200 with duplicate: true | This Idempotency-Key was used in the last 24 hours. | Nothing, the alert already went out. |
| 401 MISSING_AUTH | The key is missing, wrong or revoked. | Check the X-API-Key header. |
| 403 CONTACT_OPTED_OUT or CONTACT_BLOCKED | The recipient unsubscribed or is blocked. | Do not retry. |
| 404 RESOURCE_NOT_FOUND | No approved template with that name and language. | Check the name and status under Templates. |
| 409 TEMPLATE_NAME_AMBIGUOUS | The name exists in more than one language. | Add language. |
| 429 RATE_LIMIT_EXCEEDED | More than 120 calls a minute with this key. | Wait a moment, then retry. |
| 500 or higher | Something failed on our side or at Meta. | Retry later with the same Idempotency-Key. |
The rules
Alerts follow the same rules as any message you start. They only go to people who asked for them. Once someone sends STOP, or another opt-out word from your settings, Tobachat refuses every alert to that number.
Meta decides for itself whether a template is a notification or an advert. Keep offers out of it, or Meta may move the template to Marketing. It then costs more and may only go to contacts who agreed to marketing.
Meta charges per template you send; the Costs page has the price per country. When someone replies to an alert, the reply lands in your inbox.
Treat the key like a password. Whoever has it can send messages from your number. If it leaks, revoke it under Integrations, in Webhook / API, or create a new one. The old one stops working at once.