API Reference
Four endpoints, all under /api/. Used by both the web UI and anything external — like a WhatsApp bot checking if a number is registered before pairing.
https://your-app.vercel.app
POST
/api/listdb
username + password
Lists WhatsApp numbers or Telegram tokens. Requires the same username and password used to log in — this is what replaces reading
raw.githubusercontent.com directly, since that doesn't work for private repos.Body (JSON)
| Param | Type | Required | Notes |
|---|---|---|---|
| username | string | Yes | Login username |
| password | string | Yes | Login password |
| type | string | No | "whatsapp" or "telegram". Omit to get both lists. |
curl -X POST https://your-app.vercel.app/api/listdb \
-H "Content-Type: application/json" \
-d '{"username":"your_username","password":"your_password","type":"whatsapp"}'
import axios from 'axios'
const { data } = await axios.post('https://your-app.vercel.app/api/listdb', {
username: 'your_username',
password: 'your_password',
type: 'whatsapp'
})
console.log(data.entries)
import requests
res = requests.post(
"https://your-app.vercel.app/api/listdb",
json={"username": "your_username", "password": "your_password", "type": "whatsapp"}
)
print(res.json()["entries"])
Response
{
"success": true,
"type": "whatsapp",
"entries": [
{
"number": "628123456789",
"online": false,
"blacklist": false,
"createdAt": "2026-07-11T10:00:00.000Z"
}
]
}
POST
/api/adddb
username + password
Adds a WhatsApp number or Telegram token. Requires the same username and password used to log in. Blocked if the entry is currently blacklisted.
Rate limited to 1 successful add per IP every 30 seconds. A request during cooldown gets HTTP 429 with a
retryAfterSeconds field.
Body (JSON)
| Param | Type | Required | Notes |
|---|---|---|---|
| username | string | Yes | Login username |
| password | string | Yes | Login password |
| type | string | Yes | "whatsapp" or "telegram" |
| number | string | if type=whatsapp | Digits only, country code included |
| token | string | if type=telegram | Format: 123456789:AAabc... |
curl -X POST https://your-app.vercel.app/api/adddb \
-H "Content-Type: application/json" \
-d '{"username":"your_username","password":"your_password","type":"whatsapp","number":"628123456789"}'
import axios from 'axios'
await axios.post('https://your-app.vercel.app/api/adddb', {
username: 'your_username',
password: 'your_password',
type: 'whatsapp',
number: '628123456789'
})
import requests
requests.post(
"https://your-app.vercel.app/api/adddb",
json={
"username": "your_username",
"password": "your_password",
"type": "whatsapp",
"number": "628123456789"
}
)
Response — rate limited (429)
{
"success": false,
"message": "Please wait 23s before adding another entry.",
"retryAfterSeconds": 23
}
DELETE
/api/deldb
apikey or admin login
Admin only. Accepts either
apikey in the body, or the admin's username and password. A regular user's username/password is not enough — the server checks the role is admin either way.
Permanently deletes an entry.
Body (JSON) — option A: apikey
| Param | Type | Required | Notes |
|---|---|---|---|
| apikey | string | Yes | Admin API key |
| type | string | Yes | "whatsapp" or "telegram" |
| number | string | if type=whatsapp | |
| token | string | if type=telegram |
Body (JSON) — option B: admin login
| Param | Type | Required | Notes |
|---|---|---|---|
| username | string | Yes | Must resolve to the admin account |
| password | string | Yes | |
| type | string | Yes | "whatsapp" or "telegram" |
| number | string | if type=whatsapp | |
| token | string | if type=telegram |
curl -X DELETE https://your-app.vercel.app/api/deldb \
-H "Content-Type: application/json" \
-d '{"apikey":"your_admin_api_key","type":"whatsapp","number":"628123456789"}'
import axios from 'axios'
await axios.delete('https://your-app.vercel.app/api/deldb', {
data: { apikey: 'your_admin_api_key', type: 'whatsapp', number: '628123456789' }
})
import requests
requests.delete(
"https://your-app.vercel.app/api/deldb",
json={"apikey": "your_admin_api_key", "type": "whatsapp", "number": "628123456789"}
)
Response
{ "success": true, "message": "Entry deleted." }
POST
/api/blacklistdb
apikey or admin login
Admin only. Accepts either
apikey in the body, or the admin's username and password, same as /api/deldb.
Toggles the blacklist flag on an entry. Once blacklisted, it can't be re-added via
/api/adddb — enforced server-side, not just hidden in the UI.Body (JSON) — option A: apikey
| Param | Type | Required | Notes |
|---|---|---|---|
| apikey | string | Yes | Admin API key |
| type | string | Yes | "whatsapp" or "telegram" |
| number | string | if type=whatsapp | |
| token | string | if type=telegram | |
| blacklist | boolean | Yes | true to blacklist, false to remove |
Body (JSON) — option B: admin login
| Param | Type | Required | Notes |
|---|---|---|---|
| username | string | Yes | Must resolve to the admin account |
| password | string | Yes | |
| type | string | Yes | "whatsapp" or "telegram" |
| number | string | if type=whatsapp | |
| token | string | if type=telegram | |
| blacklist | boolean | Yes | true to blacklist, false to remove |
curl -X POST https://your-app.vercel.app/api/blacklistdb \
-H "Content-Type: application/json" \
-d '{"apikey":"your_admin_api_key","type":"whatsapp","number":"628123456789","blacklist":true}'
import axios from 'axios'
await axios.post('https://your-app.vercel.app/api/blacklistdb', {
apikey: 'your_admin_api_key',
type: 'whatsapp',
number: '628123456789',
blacklist: true
})
import requests
requests.post(
"https://your-app.vercel.app/api/blacklistdb",
json={
"apikey": "your_admin_api_key",
"type": "whatsapp",
"number": "628123456789",
"blacklist": True
}
)
Response
{ "success": true, "message": "Entry blacklisted." }