> ## Documentation Index > Fetch the complete documentation index at: https://docs.prov.ae/llms.txt > Use this file to discover all available pages before exploring further. # Check whether numbers are on WhatsApp > Tells you, for up to 50 phone numbers of any country, whether each has a WhatsApp account. Answers are kept for 30 days; send `fresh: true` to ask again, which is billed to Provident. `unknown` means the check could not tell and is not a no. A number that cannot be answered gets its own status and does not fail the request. Enabled on your credentials separately. ## OpenAPI ````yaml /api-reference/openapi.json post /public/whatsapp-check openapi: 3.0.3 info: title: Provident — Lead Intake API version: 1.13.0 description: >- Server-to-server API for pushing leads into the Provident CRM. Core endpoints: 1. `POST /oauth2/token` — exchange client credentials for a bearer token. 2. `POST /public/leads` — create a CRM lead. 3. `PUT /public/leads/{id}` — add details you did not have when you created it (quiz answers the customer finished afterwards, a budget, an area). Send only what changed; phones and emails are appended, never replaced, and the lead's stage, status, owner and funnel are not writable. Both the create and the update body accept `comments[]` (max 5 per request, each with its own `date`), which writes a conversation that happened elsewhere onto the lead's thread; the response reports `comments: { added, skipped }` and going over the cap skips rather than fails. Optional read-only reference data, using the same token: locations, developers, projects and project statuses. Use them to send values that match ours, or to show project content on your own pages. They share the lead endpoint's rate limit, so cache them. Optional compliance check, using the same token: `POST /public/dncr/check` checks up to 20 UAE mobile numbers against the UAE Do Not Call Registry before you contact them. Answers are cached for 180 days, and `fresh: true` asks the registry again. Authentication is OAuth 2.0 Client Credentials; there is no user login. Note that the `/v2` prefix is part of the server URL and is mandatory. The intake is deliberately forgiving: name-based lookup fields that cannot be matched do NOT fail the request — the lead is still created and the unmatched values are returned in `intakeUnresolved`. The endpoint is not idempotent at the transport level, but intake hygiene runs before the lead is created: a second enquiry from the same phone/email for the same funnel within the merge window (~24h) is MERGED into the existing lead (its details are folded onto the lead add-only: languages added, phones/emails appended, empty fields filled, nothing overwritten; attribution stays the first enquiry's; an enquiry for a different funnel always becomes its own lead) and returns a different, much shorter 201 body — `{ id, merged: true, matchedOn }` — with no contactId, intakeUnresolved, needsIntakeReview or createdAt. Always branch on `merged` before reading anything else. Enquiries from property-portal sources (Property Finder, Bayut, Dubizzle) are exempt and never merge. Retry only on network timeouts, 429 and 5xx. contact: name: Provident API support servers: - url: https://devapi.prov.ae/v2 description: Staging / development — build and test here - url: https://prodapi.prov.ae/v2 description: Production — live leads security: [] tags: - name: Authentication description: OAuth 2.0 client-credentials token issuance - name: Lead intake description: Public lead creation - name: Reference data description: Read-only lookups — locations, developers, projects, project statuses - name: Lead follow-up description: >- Reading back who a lead was assigned to, and recording the agent response time - name: Do Not Call Registry description: >- Check UAE mobile numbers against the Do Not Call Registry before contacting them - name: Phone screening description: >- Find which phone numbers belong to real-estate brokers or to Provident staff, to take them off a contact list - name: WhatsApp check description: Find out whether phone numbers are on WhatsApp before you message them - name: Webhooks description: >- Calls Provident makes to YOUR server. Documented here for the payload shape; these are not endpoints you call. paths: /public/whatsapp-check: post: tags: - WhatsApp check summary: Check whether numbers are on WhatsApp description: >- Tells you, for up to 50 phone numbers of any country, whether each has a WhatsApp account. Answers are kept for 30 days; send `fresh: true` to ask again, which is billed to Provident. `unknown` means the check could not tell and is not a no. A number that cannot be answered gets its own status and does not fail the request. Enabled on your credentials separately. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/WhatsappCheckRequest' example: phones: - '+971501234567' - '0507654321' - '+447700900123' fresh: false responses: '200': description: One answer per number sent, in the order sent content: application/json: schema: $ref: '#/components/schemas/WhatsappCheckResponse' example: data: - input: '+971501234567' e164: '+971501234567' status: on_whatsapp onWhatsapp: true checkedAt: '2026-11-04T09:30:02.871Z' source: fresh error: null - input: '0507654321' e164: '+971507654321' status: not_on_whatsapp onWhatsapp: false checkedAt: '2026-10-28T14:02:11.204Z' source: cache error: null - input: '+447700900123' e164: '+447700900123' status: unknown onWhatsapp: null checkedAt: '2026-11-04T09:30:03.112Z' source: fresh error: null meta: requested: 3 unique: 3 invalid: 0 fromCache: 1 fromProvider: 2 unavailable: 0 fresh: false cacheTtlDays: 30 maxNumbersPerRequest: 50 '400': description: >- `phones` is empty (`WHATSAPP_CHECK_NO_NUMBERS`) or has more than 50 numbers (`WHATSAPP_CHECK_TOO_MANY_NUMBERS`). Nothing was checked. content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 400 code: WHATSAPP_CHECK_TOO_MANY_NUMBERS message: A WhatsApp check takes at most 50 phone numbers; 51 were sent. path: /v2/public/whatsapp-check timestamp: '2026-11-04T09:30:02.871Z' details: max: 50 received: 51 '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '422': $ref: '#/components/responses/ValidationFailed' '429': $ref: '#/components/responses/RateLimited' '502': description: >- Checks could not be run (`WHATSAPP_CHECK_UPSTREAM_ERROR`). Numbers already answered are kept, so a retry costs nothing for those. content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 502 code: WHATSAPP_CHECK_UPSTREAM_ERROR message: WhatsApp checks could not be run. Try again in a few minutes. path: /v2/public/whatsapp-check timestamp: '2026-11-04T09:30:02.871Z' '503': description: >- Checks are not enabled on this environment (`WHATSAPP_CHECK_NOT_CONFIGURED`) or have stopped on Provident's side (`WHATSAPP_CHECK_NO_BALANCE`). content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 503 code: WHATSAPP_CHECK_NO_BALANCE message: >- WhatsApp checks have stopped: the account has run out of balance. path: /v2/public/whatsapp-check timestamp: '2026-11-04T09:30:02.871Z' security: - bearerAuth: [] components: schemas: WhatsappCheckRequest: type: object required: - phones properties: phones: type: array items: type: string minItems: 1 maxItems: 50 description: >- Phone numbers to check, any country. International form is best; the spellings accepted by phone screening also work. Duplicates are checked once. fresh: type: boolean default: false description: >- Ask again for every number instead of using a stored answer. Each new answer is billed to Provident, so use it sparingly. WhatsappCheckResponse: type: object required: - data - meta properties: data: type: array items: $ref: '#/components/schemas/WhatsappCheckResult' description: One row per number sent, in the order sent. meta: type: object properties: requested: type: integer unique: type: integer description: Distinct valid numbers. invalid: type: integer fromCache: type: integer fromProvider: type: integer description: Numbers answered on this request. unavailable: type: integer description: Numbers the check could not answer on this request. fresh: type: boolean cacheTtlDays: type: integer maxNumbersPerRequest: type: integer ApiError: type: object description: Common error envelope used by every endpoint. properties: statusCode: type: integer example: 400 code: type: string description: >- Stable machine-readable error code — branch on this, not on `message`. example: BAD_REQUEST message: type: string description: Human-readable description. errors: type: array items: type: string description: 'Present on 422 only: one entry per field that failed validation.' details: type: object additionalProperties: true description: Optional structured extras attached by the failing handler. path: type: string example: /v2/public/leads timestamp: type: string format: date-time WhatsappCheckResult: type: object required: - input - e164 - status - onWhatsapp - checkedAt - source - error properties: input: type: string description: The number exactly as sent. e164: type: string nullable: true description: The number that was checked; null when it could not be read. status: type: string enum: - on_whatsapp - not_on_whatsapp - unknown - invalid - unavailable description: >- `on_whatsapp`: has a WhatsApp account. `not_on_whatsapp`: does not. `unknown`: the check could not tell, which is not a no. `invalid`: not a phone number, not checked. `unavailable`: the check failed for this number; try it again later. onWhatsapp: type: boolean nullable: true description: true on WhatsApp, false not, null when there is no answer. checkedAt: type: string nullable: true format: date-time description: When this answer was obtained. source: type: string nullable: true enum: - cache - fresh description: Served from the store or fetched on this request. error: type: string nullable: true responses: Unauthorized: description: Missing, invalid, revoked or expired bearer token. content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 401 code: OAUTH_TOKEN_EXPIRED message: OAuth access token expired path: /v2/public/projects/filters timestamp: '2026-07-27T06:31:04.512Z' Forbidden: description: >- Your credentials are not enabled for this endpoint (or your IP is not on the client's allowlist). content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 403 code: OAUTH_CLIENT_GRANT_MISSING message: >- This client is not allowed to use this endpoint. It needs the "client:dncr:check:create" grant. details: requiredGrant: client:dncr:check:create path: /v2/public/dncr/check timestamp: '2026-10-06T12:00:00.000Z' ValidationFailed: description: >- A parameter or field failed validation. Note that an UNRECOGNISED query parameter is rejected, not ignored — this is how a call written against the old `page`-based developers endpoint now fails. Fix the request; never retry it unchanged. content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 422 code: VALIDATION_ERROR message: Validation failed errors: - property page should not exist path: /v2/public/developers?page=1&limit=2 timestamp: '2026-08-19T07:20:28.507Z' RateLimited: description: >- Request quota for this client exceeded. Wait `Retry-After` seconds, then resume. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer X-RateLimit-Limit: $ref: '#/components/headers/XRateLimitLimit' X-RateLimit-Remaining: $ref: '#/components/headers/XRateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/XRateLimitReset' content: application/json: schema: $ref: '#/components/schemas/ApiError' example: statusCode: 429 code: RATE_LIMITED message: Too Many Requests path: /v2/public/leads timestamp: '2026-07-27T06:31:04.512Z' headers: XRateLimitLimit: description: Requests allowed in the current window. schema: type: integer XRateLimitRemaining: description: Requests remaining in the current window. schema: type: integer XRateLimitReset: description: Seconds until the counter resets (end of the UTC day). schema: type: integer securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: Opaque description: >- The `access_token` returned by `POST /oauth2/token`, sent as `Authorization: Bearer `. It is an opaque string, not a JWT. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.