Is the WhatsApp Business API a REST API?

Yes, in practice. The WhatsApp Cloud API is an HTTP API on Meta's Graph API that exchanges JSON over HTTPS with standard methods. The Graph API adds its own conventions, such as node IDs and versioned paths.

What is the difference between a REST API and the Graph API?

REST is a general architectural style, and the Graph API is Meta's specific API built in that style. It models data as nodes and edges, lets you pick fields with `?fields=`, and puts a version in every path.

What is the difference between REST and SOAP?

REST uses plain HTTP methods on resource URLs, usually with JSON. SOAP wraps every call in an XML envelope defined by a formal contract. Modern messaging APIs are almost all REST-style.

Do I need an SDK to use a REST API?

No. Any language that can make HTTPS requests can call a REST API directly, and cURL is enough to test one. SDKs add convenience such as types, retries and helpers on top.

What Is a REST API? Basics for Messaging APIs

01 · Definition

What is a REST API?

A REST API (Representational State Transfer) is a web API designed around resources such as orders, messages, templates and contacts. Each resource is reachable at its own URL and handled with the standard HTTP methods: GET to read, POST to create, PUT or PATCH to update and DELETE to remove. The term comes from Roy Fielding's 2000 doctoral dissertation, which described the architectural constraints behind the web itself.

In practice, a REST API means a few habits. Requests are stateless, so each one carries its own credentials (usually an Authorization: Bearer token) and everything needed to process it. Resources are represented as JSON. Outcomes are signalled with HTTP status codes: 2xx for success, 4xx for client errors and 5xx for server errors. Responses can be cached where that is safe. Very few APIs follow every constraint Fielding described, so most are really "REST-style" HTTP APIs. The shared conventions are what let any developer pick up a new API quickly with cURL or an HTTP client.

Almost every messaging and CPaaS API is built this way, from SMS gateways and voice APIs to email and the WhatsApp Cloud API. Meta's Graph API, which the Cloud API is part of, follows REST's basics but adds its own model. Everything is a node with an ID (/{PHONE_NUMBER_ID}), and related collections are edges (/{WABA_ID}/message_templates). You choose the returned fields with ?fields=, updates are usually POST rather than PUT, and every path starts with a Graph API version (/vNN.0/).

Key takeaways

A REST API exposes resources at URLs, and clients act on them with standard HTTP methods such as GET, POST and DELETE.
REST requests are stateless: each one carries its own authentication and everything the server needs to answer it.
Most messaging and CPaaS APIs, including the WhatsApp Cloud API, are REST-style HTTP APIs that exchange JSON.
Meta's Graph API adds its own conventions on top: node IDs, edges, ?fields= selection and a version in every path.
Status codes signal the class of outcome, but the platform error code in the JSON body carries the detail you act on.

See InfiQ pricing

02 · Rationale

Why does a REST API matter?

Knowing what REST means makes every messaging API easier to read. You can guess that a GET is safe to retry and a POST may not be, that a 401 is about credentials and that a 5xx is worth retrying, and that the URL names the thing you act on. It also explains where the WhatsApp Cloud API differs, so its node IDs, ?fields= and version prefixes stop being surprises. For business readers, "it has a REST API" means any developer, in any language, can integrate it without special tooling.

03 · Specifications

A REST API: key facts and limits

Origin	Roy Fielding's doctoral dissertation, 2000
Core methods	GET, POST, PUT, PATCH, DELETE
State	Stateless; every request carries its own auth
Usual format	JSON over HTTPS
Status classes	2xx success · 4xx client error · 5xx server error
Graph API additions	Nodes, edges, ?fields=, versioned paths

04 · Operation

How does a REST API work?

Name the resource
Each thing has a URL. In the Cloud API, the sending number is /{PHONE_NUMBER_ID} and its messages edge is /{PHONE_NUMBER_ID}/messages.
Pick the method
GET reads without side effects, POST creates something or triggers an action such as sending a message, and DELETE removes. Classic REST updates with PUT or PATCH; the Graph API mostly uses POST for updates.
Authenticate every request
There is no session. Send the access token in the Authorization header on every call.
Send and receive JSON
Request bodies and responses are JSON documents, sent with a Content-Type: application/json header.
Read the status, then the body
The HTTP status gives the class of outcome, and the JSON body gives the detail. On the Graph API, that is an error object with code, message and fbtrace_id.

05 · Code samples

A REST API in code

1curl "https://graph.facebook.com/v26.0/{PHONE_NUMBER_ID}?fields=display_phone_number,quality_rating" \
2  -H "Authorization: Bearer {ACCESS_TOKEN}"
3# → {"display_phone_number":"+91 98765 43210","quality_rating":"GREEN","id":"{PHONE_NUMBER_ID}"}

A Graph API node read: GET on the node's URL, with `?fields=` choosing what comes back.

06Playground

A working model of REST. Use its controls to replay it step by step.

Where does the Graph API bend REST?

8 / 8

Compared on

REST (the style)

Resources, verbs and stateless JSON: a set of conventions

Graph API (Meta's implementation)

REST-style HTTP with nodes, edges, fields and versions

REST (the style)Resource paths such as /orders/42
Graph API (Meta's implementation)Node IDs and edges: /{WABA_ID}/message_templates
REST (the style)PUT or PATCH
Graph API (Meta's implementation)Mostly POST to the node
REST (the style)The server decides the representation
Graph API (Meta's implementation)Opt in with ?fields=id,status
REST (the style)Optional: header, path or none
Graph API (Meta's implementation)Required in the path; each version supported for at least two years
REST (the style)HTTP status codes; body varies by API
Graph API (Meta's implementation)HTTP status plus an error object: code, error_subcode, fbtrace_id
REST (the style)Varies: pages, offsets or cursors
Graph API (Meta's implementation)Cursor paging: paging.cursors.before / after
REST (the style)Varies: API keys, OAuth, basic
Graph API (Meta's implementation)Access token, usually Authorization: Bearer

Verdict

The WhatsApp Cloud API is REST-style. If you know REST you can call it, but read the Graph conventions before assuming textbook behaviour.

Classic REST conventions on the left, and Meta's Graph API (home of the WhatsApp Cloud API) on the right. Step through the rows to see what carries over and what changes.

07 · Worked example: One order, three REST calls

Example: One order, three REST calls

A Surat textile wholesaler's backend handles each new order with three requests. It sends a GET for the customer's record to its own CRM's REST API. It sends a POST with an order-confirmation utility template to /{PHONE_NUMBER_ID}/messages on the Cloud API, and stores the returned wamid. Then it sends a PATCH to update the order in its ERP with that message ID. Each call is self-contained and authenticated with its own token, and is retried only when that is safe. GETs are retried freely, but the WhatsApp POST is retried only after checking that the first attempt did not already send.

08 · Cautions

Common mistakes with a REST API

Retrying POSTs blindly
A POST /messages that timed out may already have sent. Retrying it can deliver, and bill, the message twice. Retry GETs freely, but for POSTs check your webhooks or your own idempotency records first.
Trusting the status code alone
Two different 400 responses can need opposite fixes. Read the platform's error code in the body before deciding what to do.
Expecting textbook REST from the Graph API
Updates are often POST, fields are opt-in with ?fields=, and paths carry a version. Read the endpoint's reference instead of guessing from REST conventions.
Putting secrets in URLs
Query strings end up in server logs, proxies and browser history. Send tokens in the Authorization header instead.

09 · Recommended practice

Best practices for a REST API

Set a timeout on every request. A hung connection is worse than an error.
Log the request ID the platform returns with every failure (on Meta, the fbtrace_id).
Reproduce a call with cURL before you start debugging your own code.
Respect Retry-After headers wherever an API sends them.

10 · Questions and answers

REST FAQs

Is the WhatsApp Business API a REST API?: Yes, in practice. The WhatsApp Cloud API is an HTTP API on Meta's Graph API that exchanges JSON over HTTPS with standard methods. The Graph API adds its own conventions, such as node IDs and versioned paths.
What is the difference between a REST API and the Graph API?: REST is a general architectural style, and the Graph API is Meta's specific API built in that style. It models data as nodes and edges, lets you pick fields with ?fields=, and puts a version in every path.
What is the difference between REST and SOAP?: REST uses plain HTTP methods on resource URLs, usually with JSON. SOAP wraps every call in an XML envelope defined by a formal contract. Modern messaging APIs are almost all REST-style.
Do I need an SDK to use a REST API?: No. Any language that can make HTTPS requests can call a REST API directly, and cURL is enough to test one. SDKs add convenience such as types, retries and helpers on top.

REST API(REST)

Properties

What is a REST API?

Why does a REST API matter?

A REST API: key facts and limits

How does a REST API work?

Name the resource

Pick the method

Authenticate every request

Send and receive JSON

Read the status, then the body

A REST API in code

06Playground

Where does the Graph API bend REST?

Example: One order, three REST calls

Common mistakes with a REST API

Retrying POSTs blindly

Trusting the status code alone

Expecting textbook REST from the Graph API

Putting secrets in URLs

Best practices for a REST API

REST FAQs

See how this works on InfiQ

Put REST to work

See how this works on InfiQ