Product boundary
This first slice lets ReplyBox publish text to a confirmed WhatsApp Channel target while keeping discovery, permission checks, inbox records, and live development sends outside the feature boundary.
@newsletter JID
Human target confirmation
Token-authenticated public API
Step 1
A user or coding agent supplies an invitation link or known @newsletter JID. The API asks the existing connector session to resolve it without following the Channel or accepting an invitation.
POST /public/channel-targets/resolve
Step 2
ReplyBox returns the resolved display name and safe JID. A human explicitly confirms that this is the intended publishing target before it is stored.
ChannelPublicationTarget
Step 3
A public API token can send text only to a stored target. Every post request confirms the intended target and final text, then queues a send_newsletter job.
Supported scope
The Baileys version pinned by ReplyBox supports metadata lookup for one invitation key or one @newsletter JID. It does not prove broader account-level Channel access or admin role information.
Safe workflow
Start with an invitation link or known @newsletter JID.
The API routes lookup through the existing HMAC-protected connector boundary.
ReplyBox shows the resolved display name and safe JID for human confirmation.
The target is keyed by organisation, sending ReplyBox Channel, and newsletter JID.
Each post request confirms both the intended target and the final text.
Queued, sent, and failed states live on a dedicated publication post.
API surface
POST /public/channel-targets/resolve performs token-authenticated metadata lookup through the connector.
POST /public/channel-targets stores the resolved target after human confirmation.
POST /public/channel-targets/{targetId}/posts publishes confirmed text with a retry-safe idempotency key.
GET /public/channel-targets/posts/{postId} reports queued, sent, or failed without adding the destination to the inbox.
Non-goals
Verification
Posting model
The API inserts a dedicated publication post and queues connector work. It does not create a contact or inbox conversation, and WhatsApp permission failures remain visible on the publication post instead of being hidden in the shared inbox.