P-API - WhatsApp API

Automate WhatsApp messaging, interactive content, instance and group management, catalogs, and webhooks via a scalable microservices API with an admin panel.

Security Scan

The skill is an instruction-only WhatsApp API integration that appears coherent in purpose, but its manifest omits required credentials/configuration and the source/ownership is unclear — this mismatch warrants caution.

Purpose & Capability

The SKILL.md clearly describes a WhatsApp automation API (endpoints, x-api-key header, base URL, integrations). However the registry metadata lists no required environment variables or primary credential despite the instructions explicitly requiring an API key and base URL; that inconsistency is unexplained.

Instruction Scope

Instructions remain within the stated WhatsApp API scope (send messages, manage instances, webhooks, integrations). They direct network calls to an external service (papi.api.br or a user-provided base URL) and reference configuring TOOLS.md (which is not included). The instructions do not request unrelated local files or system state.

Install Mechanism

No install spec and no code files — this is instruction-only documentation, so nothing will be written to disk at install time (lowest install risk).

Credentials

The skill's docs require an API key (x-api-key) and a base URL and reference other service tokens (e.g., Chatwoot token) for integrations, but the manifest declares no required env vars or primary credential. Requesting external service tokens would be proportionate for this functionality, but the omission in the manifest is a red flag (either an oversight or incomplete packaging).

Persistence & Privilege

always is false and there is no install script. The skill does allow normal autonomous invocation (platform default), which is expected for an integration skill. It does not request persistent system privileges or modify other skills.

What to consider before installing

This skill appears to be documentation for a WhatsApp API (papi.api.br) and will instruct the agent to call external endpoints using an API key and base URL. Before installing, confirm who operates the endpoint (papi.api.br), and do not provide platform-wide secrets unless you trust the provider. Ask the publisher to: (1) update the manifest to declare required env vars (base URL and API key) so the platform can request them explicitly, (2) provide a privacy/security statement and contact, and (3) supply the missing TOOLS.md or clear instructions on where the agent should store credentials. If you plan to use webhooks, ensure your webhook endpoint validates incoming requests (signature or IP allowlist) and avoid exposing high-privilege credentials. If you cannot verify the provider or the missing manifest fields, treat installation as higher-risk and consider alternative well-known integrations.

P-API - WhatsApp Connections Hub

The WhatsApp automation you've been waiting for.

Complete redesign with microservices architecture — modular, scalable, and independent.

🌐 Official Website: https://papi.api.br
🤝 Partner: Mundo Automatik

---

📑 Table of Contents

1. Features
2. Configuration
3. Authentication
4. Main Endpoints
5. Detailed References
6. Credits

---

✨ Features

📊 Admin Panel (Free)

• Multi-language interface (PT-BR, EN, ES)
• Instance management
• Real-time monitoring
• Behavior configuration
• Usage statistics

🔥 Pro Features

Feature	Capabilities
📞 Phone Calls	Chip-based calls, WhatsApp calls, Extension system, Call management
💬 RCS Messaging	Rich media sending, Buttons & carousels, Read receipts, Typing indicator
📱 Call Center	Chip rotation (30 ports), Bulk SMS sending, Configurable rate limiting
✉️ Professional SMS	Individual/bulk sending, Smart chip rotation, Port configuration
🔢 Virtual Numbers	Instant purchase, Auto activation, Full management

---

⚙️ Configuration

Before using, configure in TOOLS.md:

### P-API (WhatsApp)
- Base URL: https://your-server.com
- API Key: your-api-key
- Default Instance: instance-name

🔐 Authentication

All requests require the x-api-key header:

curl -X GET "https://your-server.com/api/instances" \
  -H "x-api-key: YOUR_KEY"

---

📡 Main Endpoints

Instances

Method	Endpoint	Description
GET	/api/instances	List all instances
POST	/api/instances	Create instance {"id": "name"}
GET	/api/instances/:id/qr	Get QR code
GET	/api/instances/:id/status	Instance status
DELETE	/api/instances/:id	Remove instance

Send Messages

JID format: [e-mail]

Type	Endpoint	Required Fields
Text	POST /send-text	jid, text
Image	POST /send-image	jid, url or base64, caption
Video	POST /send-video	jid, url or base64
Audio	POST /send-audio	jid, url, ptt
Document	POST /send-document	jid, url, filename
Location	POST /send-location	jid, latitude, longitude
Contact	POST /send-contact	jid, name, phone
Sticker	POST /send-sticker	jid, url
Reaction	POST /send-reaction	jid, messageId, emoji

Interactive Messages

Type	Endpoint	Description
Buttons	POST /send-buttons	quick_reply, cta_url, cta_call, cta_copy
List	POST /send-list	Menu with sections
Carousel	POST /send-carousel	Sliding cards (mobile only)
Poll	POST /send-poll	Voting up to 12 options

Groups

Method	Endpoint	Description
POST	/groups/create	Create group
GET	/groups/:groupId/metadata	Group info
POST	/groups/:groupId/participants	Manage members (add/remove/promote/demote)

Webhook

POST /api/instances/:id/webhook
{
  "url": "https://your-server/webhook",
  "enabled": true,
  "events": ["messages", "status"]
}

---

📚 Detailed References

File	Content
references/interactive.md	Buttons, lists, carousel, polls examples
references/groups.md	Group management
references/catalog.md	Product catalog
references/integrations.md	Typebot, Chatwoot integrations

---

👥 Credits

Developed by: Pastorini
Website: https://papi.api.br
Partner: Mundo Automatik
Skill maintained by: @rafacpti23