Incoming media
When a customer sends a photo, a document or a voice note, WhatsApp only passes an identifier. These routes fetch the file.
Download
POST /whatsapp/media/{mediaId}/download
{ "downloadAndStore": true, "filename": "invoice.pdf" }
With downloadAndStore, the file is placed in the store's storage and the returned URL is durable. Without it, you get Meta's temporary URL, which expires quickly.
filename carries the document's original name. It is the only place the real extension survives: the stored name is derived from the MIME type, and an .xlsx becomes a .zip there.
Transcribe a voice note
POST /whatsapp/media/transcribe
Returns the text of a voice message. In markets where voice dominates writing, this is what makes it possible to process requests that never arrive as text.
You do not specify a WhatsApp account
The WhatsApp Business account is derived from your key, as everywhere else in this API. It has been in the database since you linked your number in settings.
A wabaId field in a request is rejected: this function authorises on that field alone, so accepting it from the client would grant access to media received by any store on the platform.
If no number is linked, the response is whatsapp_not_connected.