Newest first. Anything that changes how an existing integration behaves is listed under Changed, with how to keep the old behaviour. Subscribe with the RSS feed.
A number whose QR code was never scanned is no longer marked as needing repair when its session restarts, and no longer gets the “needs to be linked again” email. The dashboard offers Pair, not Re-pair, for a number that never linked.
The welcome email and the setup nudges for new sign-ups now go out. They had been switched off since they were written.
Changed
A number that stops working is emailed once, reminded twice 72 hours apart, and then left alone until it is linked again. Before, the reminders never stopped.
A feature the plan does not include now answers 402 with error code PLAN_UPGRADE_REQUIRED: AI keys, media, groups, scheduling, team members, per-number webhooks, proxies and managed AI. QUOTA_EXCEEDED stays for an allowance that is used up, the monthly message allowance and the number limit. Status codes are unchanged. Every plan refusal now carries its reason in details, for example { "reason": "feature_not_on_plan", "feature": "ai", "plan": "sandbox", "upgrade_to": "Core + AI" }.
A ChatRail key pasted as an AI provider key is refused with 400 and never stored. Stored, it would have been sent to the model provider on every call.
Fixed
A request with Content-Type: application/json and no body is treated as having no body, so DELETE from n8n, axios and similar clients returns 204 instead of INVALID_JSON. Routes that need a body still answer VALIDATION_FAILED.
A connection can carry its own HTTP proxy (Team plan), so a number links to WhatsApp from its own address instead of the shared one. Send proxy on POST /v1/connections or PATCH /v1/connections/{connection}: { "server": "203.0.113.10:8080", "username": "…", "password": "…" }; null removes it. A public IP address and port only, HTTP proxies only, and set while the number is created or requires_repair, not on a linked number (409). The login is encrypted at rest and never returned; responses show server and has_credentials. Other plans get 402.
Changed — check this if you use automatic AI replies
An automatic reply that names a link or a phone number found nowhere in your instruction, your attached context, this number’s earlier messages in the conversation or the recipient’s own number is not sent. It is held as a draft for a person, with held_reason set to unknown_link or unknown_number. There is no switch: a link or number the customer did not configure is exactly what an injected instruction asks for. To let the AI use a link or number, put it in the instruction or the context.
MCP OAuth redirect addresses must use https://, or http:// on localhost. The consent page now names the host the code will be sent to and lists the scopes requested.
ChatRail describes itself to agents. An MCP server card at /.well-known/mcp/server-card.json, an AI catalog at /.well-known/ai-catalog.json, an Agent Skills index at /.well-known/agent-skills/index.json and a SKILL.md, so an assistant can find, set up and call ChatRail without a person pasting docs into it.
An opt-out list.GET, POST and DELETE /v1/opt-outs read and change the numbers your workspace must not message. Reading needs messages:read; changing it needs messages:write.
A recipient.opted_out event. When someone writes a stop word, it is sent once, with the number, the message that said so and when. Subscribe by name or with recipient.*.
Changed — check this if people reply STOP to your messages
A message that is only “STOP” opts that number out. The whole message has to be a stop phrase in a direct chat: stop, unsubscribe, opt out, “please stop messaging me” and a few close forms. English only. A sentence that contains the word, a photo with a caption and a group message do not count, and “cancel” is not a stop word, because it usually answers an appointment reminder.
Sends to an opted-out number are refused.POST /v1/messages/text returns 422 with error code RECIPIENT_OPTED_OUT. Messages already queued or scheduled for that number fail just before they would be sent, with failure class recipient_opted_out, and the AI does not reply (ai.reply_blocked with the same reason).
There is no switch to turn this off, because messaging someone who asked you to stop is how numbers get reported. If a number was added by mistake, or the person asks to hear from you again, remove it with DELETE /v1/opt-outs/{phone}.
Check up to 10 numbers at once.POST /v1/numbers/check takes connection and phones and returns one result per number, in order. A number that cannot be parsed, or that a spent budget could not reach, gets a reason on its own line instead of failing the request.
The WhatsApp chat id. Checks now return chat_id, WhatsApp's own id for the chat (…@s.whatsapp.net), when it gives one.
Answers are reused for 24 hours. A number checked in the last day is answered from the previous result (cached: true) without asking WhatsApp again, and does not count against any limit.
Changed — check this if you call the number-check endpoint
Lookups are limited to 10 a minute per workspace, down from 60 checks. Each GET /v1/numbers/check asks WhatsApp through your own connected number, and WhatsApp flags accounts that look up many numbers they have no chat with. The limit is shared by every number in a workspace. Over the limit, the endpoint returns 429 with error code RATE_LIMITED. Use it to check a recipient before sending, not to sweep a list.
Sandbox can look up 30 numbers a day. Answers reused from the last day do not count. Past the limit, a single check returns 429 until midnight UTC.
Context carries through the conversation. Each AI reply keeps the context of the message it answered, so a follow-up that quotes nothing — or arrives days later — is still answered about the same listing, order or booking. Correlation reported to your webhooks stays strict.
A person can take over. When your team answers a lead by hand, automatic replies pause in that conversation for human_takeover_minutes (a day by default; 0 turns it off). Replies skipped during the pause arrive as ai.reply_blocked with reason human_takeover. Messages with context (alerts) and scheduled sends do not pause; send pause_ai to decide explicitly.
Bursts get one answer. "hi" / "is the flat" / "still available??" now gets one reply that answers all three. Replies wait reply_delay_seconds (5 by default) for the rest of a burst; the earlier runs show as superseded.
Edit what the AI answers from.PATCH /v1/messages/{id} takes context with or without new text. A context-only edit has no time limit, never reaches WhatsApp, and also updates AI replies that carried the old context forward. Guide →
Group reply setting. The AI policy's group_replies: addressed, all or off. Guide →
Nested context reaches the model.{"property": {"address": …}} is flattened to property.address, up to four levels. Arrays are still left out and listed in omitted_keys.
API keys can manage webhooks and read usage./v1/webhook-endpoints accepts a key with webhooks:read / webhooks:write, so a deploy script can register its own receiver; every change is audited. The new usage:read scope opens GET /v1/usage.
Changed — check these if you use AI replies
Automatic replies now wait 5 seconds before answering. Set reply_delay_seconds: 0 for the old behaviour.
A hand-written reply to a lead who wrote in the last day pauses AI replies in that conversation for a day. Set human_takeover_minutes: 0 to turn this off.
In a WhatsApp group, the AI now answers only messages addressed to your number — an @-mention, or a reply to one of your messages. Set group_replies: "all" to answer every message as before.
A nested context field used to be left out of AI replies; it is now sent. To keep a field from the model, mark the context context_sensitivity: "restricted".
Fixed
Webhook signatures now verify. Deliveries were signed with the encrypted form of the endpoint's secret rather than the whsec_… secret you were given, so signature checks failed. No change is needed on your side. Deliveries your endpoint rejected in that time are not retried; anything it accepted was genuine.
23 September 2026 — Richer WhatsApp messaging, managed AI, and social sign-in
New
Managed AI on Core + AI: 10,000 AI replies a month on ChatRail's model key — no API key of your own needed. Team includes 50,000 and MCP.
Quote, mention, polls and contact cards on POST /v1/messages/text: reply_to, mentions (including "all" in groups), link_preview, poll, contact. Guide →
Act on sent messages: reactions, mark read, edit (15 minutes) and delete for everyone. Guide →
Typing indicator via POST /v1/connections/{c}/presence, and AI replies that mark the question read and show typing first (humanize, on by default).
New webhook events:message.reaction, message.edited, message.revoked, poll.vote, group.participants_changed, call.received, and automatic call rejection per connection.
Group management: create groups, add and remove members, promote admins, change settings and invite links — with a limit of 20 member adds per hour to protect the number. Guide →
Link a number with a pairing code instead of a QR. Guide →
Group discovery over REST and MCP.
Sign in with Google or GitHub in the dashboard.
Fixed
The retention sweep no longer fails on alerts that had replies.
Deleting a connection now also ends its WhatsApp session.
Send WhatsApp messages with delivery tracking, scheduling, media, context attached to alerts and replies correlated to them, signed webhooks, AI replies, and MCP tools. Documentation →
