Console

Get media

.md

GET

https://whatsapp.paaltech.org/api/v1/businesses/{external_id}/media/{id}

Token ability: messages.read · Authentication

A media file's details and a fresh signed url to its bytes (while status is stored). The link needs no token and expires after 15 minutes - fetch the media again for a new one; never store or share the link. Incoming attachments are pending until PaalChat has downloaded them from Meta (media.updated says when).

Path parameters

external_id string required

Your own ID for the business (Multi-SKUUL - the tenant ID).

Max 191 characters. Pattern ^[A-Za-z0-9._:-]+$.

id integer required

PaalChat's media ID (media_id on a message, or data.id from Upload media).

Responses

200

The media.

401

unauthenticated - missing, invalid, revoked or expired token

403

missing_ability, product_suspended or product_token_required

404

not_found - not yours, or does not exist

429

rate_limited - over 300 requests/minute for this product

Errors always look like {"error": {"code", "message"}} - see Errors and status codes.

Language

Credentials

Authorization Bearer $PAALCHAT_TOKEN

Request

cURL

curl --request GET \
  --url 'https://whatsapp.paaltech.org/api/v1/businesses/presec/media/2' \
  --header "Authorization: Bearer $PAALCHAT_TOKEN" \
  --header 'Accept: application/json'

const response = await fetch('https://whatsapp.paaltech.org/api/v1/businesses/presec/media/2', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.PAALCHAT_TOKEN}`,
    Accept: 'application/json',
  },
});

const data = await response.json();
console.log(response.status, data);

use Illuminate\Support\Facades\Http;

$response = Http::withToken(env('PAALCHAT_TOKEN'))
    ->acceptJson()
    ->get('https://whatsapp.paaltech.org/api/v1/businesses/presec/media/2');

$data = $response->json();

import os
import requests

response = requests.get(
    "https://whatsapp.paaltech.org/api/v1/businesses/presec/media/2",
    headers={"Authorization": f"Bearer {os.environ['PAALCHAT_TOKEN']}", "Accept": "application/json"},
)

print(response.status_code, response.json())

require 'net/http'
require 'json'

uri = URI('https://whatsapp.paaltech.org/api/v1/businesses/presec/media/2')
request = Net::HTTP::Get.new(uri)
request['Authorization'] = "Bearer #{ENV['PAALCHAT_TOKEN']}"
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }
puts response.code, JSON.parse(response.body)

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest("GET", "https://whatsapp.paaltech.org/api/v1/businesses/presec/media/2", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("PAALCHAT_TOKEN"))
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.StatusCode, string(out))
}

Try it with a test key

Only sk_test_ keys: requests reach your sandbox businesses, never real ones. The key is not saved.

Test key

external_id

id

Response

Response

{
  "data": {
    "id": 12,
    "direction": "incoming",
    "status": "stored",
    "mime_type": "image/jpeg",
    "filename": null,
    "size": 48213,
    "sha256": "8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4",
    "url": "https://whatsapp.paaltech.org/media/12?expires=1759242000&signature=3c1d...",
    "url_expires_at": "2026-10-02T09:15:00+00:00",
    "error": null,
    "created_at": "2026-10-02T08:59:58+00:00",
    "stored_at": "2026-10-02T09:00:01+00:00"
  }
}

{
  "error": {"code": "unauthenticated", "message": "A valid product token is required."}
}

{
  "error": {
    "code": "missing_ability",
    "message": "This token does not have the ability this request needs."
  }
}

{"error": {"code": "not_found", "message": "Business not found."}}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Slow down and retry after the Retry-After header."
  }
}