A linked-device WhatsApp API is reasonably safe when you use it for real one-to-one conversations, and risky when you use it to message people who never asked to hear from you. WhatsApp restricts numbers mainly for behavior, like spam reports, cold outreach and sudden volume on new numbers, and no provider, us included, can promise a number will never be banned.
Below: how these APIs actually work, what gets numbers in trouble, what we do to keep the risk low, and what to do when WhatsApp does restrict a number. If you want the short version, see the connection and health features.
How does a linked-device WhatsApp API work?
It connects as a linked device. The owner opens WhatsApp on their phone, goes to Linked devices and scans a QR. From then on the API is one of that account’s linked devices: it receives what the phone receives and sends as that number. The phone stays the main device and keeps working normally, on personal WhatsApp and the WhatsApp Business app alike.
That is a different model from Meta’s WhatsApp Business API, where the number is registered with Meta, conversations start from approved templates and every delivered message is billed. Our Business API vs personal API explainer compares the two in depth. With Mossmoon, each linked number is a line: a connection that runs around the clock on our servers, from its own static IP, at $15 a month (pricing).
Does WhatsApp ban numbers for using an API?
WhatsApp’s terms restrict automated and bulk messaging, and its anti-abuse systems are built to catch accounts that behave like bulk senders. Meta doesn’t approve third-party linked-device APIs, and we won’t pretend otherwise. In practice, though, the thing that gets judged is what a number does.
A number answering its own customers through a CRM looks like a busy person. A number pushing the same promotion to 800 strangers looks like spam, whatever software sent it, and a phone typing it by hand would get flagged too. One exception is worth knowing: WhatsApp looks hardest at brand-new accounts that register and immediately link to any third-party session, which is why new numbers need a warm-up.
Most of the risk is in what a number sends, and to whom. The rest is in how fast it starts.
What actually gets a WhatsApp number restricted or banned?
These are the triggers in our warm-up playbook, roughly in order of how often they cause trouble:
- Cold outreach. Messaging people who never opted in is the number one direct cause. Strangers tap Report, and reports weigh heavily.
- Bought or scraped lists. The same thing, faster.
- Sudden volume. A new or long-idle number jumping to hundreds of sends a day, or any number doubling its volume overnight.
- Identical text to many people, especially with a link in the first message to someone new. Vary at least the greeting and one detail, and wait for a reply before sending a URL.
- No gaps between sends, and sending at odd hours (3am for the recipient).
- Many accounts on one IP. Dozens of numbers connecting from the same address look like one operation running many accounts.
How does Mossmoon keep the risk low?
We can’t control what you send, but we can make the safe path the default and tell you the moment WhatsApp pushes back. All of this is included on every line.
A dedicated static IP for every line
Each line gets its own static IP that no other line shares, and it normally reconnects on that same IP. WhatsApp sees one steady connection per number, not a crowd of accounts behind one address.
Daily caps on every line
Every line has a soft cap of 750 sends a day and a hard cap of 1,500, from midnight to midnight UTC. Past 750 the send still goes out but the response carries a warning header; at 1,500 sends are refused with 429 until the reset. Every response tells you how much is left, so your app can slow down before either happens. The 1,500 ceiling is for well-warmed lines; a new one should sit far below it (rate limits).
curl https://mossmoon.app/api/v1/wa/lines/wa_8f3c2e1a/send \
-H "Authorization: Bearer mm_live_..." \
-H "Content-Type: application/json" \
-d '{
"to": "+15709302189",
"text": "Hi Sarah, following up on the listing."
}'
→ 202 Accepted
X-Mossmoon-Daily-Limit: 1500
X-Mossmoon-Daily-Remaining: 731
X-Mossmoon-Daily-Reset: 2026-10-17T00:00:00.000Z
X-Mossmoon-Soft-Warning: approaching-daily-cap
{
"message_id": "wamsg_a1b2c3d4e5f6",
"status": "queued",
"line_id": "wa_8f3c2e1a",
"to": "+15709302189",
"created_at": "2026-10-16T19:20:33.456Z"
}const res = await fetch(
"https://mossmoon.app/api/v1/wa/lines/wa_8f3c2e1a/send",
{
method: "POST",
headers: {
Authorization: `Bearer ${process.env.MOSSMOON_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ to: "+15709302189", text: "Hi Sarah, following up on the listing." }),
},
);
// Slow down before WhatsApp (or the cap) makes you.
const remaining = Number(res.headers.get("X-Mossmoon-Daily-Remaining"));
if (res.headers.get("X-Mossmoon-Soft-Warning")) {
await pauseAutomations("wa_8f3c2e1a", { reason: "approaching daily cap", remaining });
}→ 429 Too Many Requests
Retry-After: 16420
X-Mossmoon-Daily-Limit: 1500
X-Mossmoon-Daily-Remaining: 0
X-Mossmoon-Daily-Reset: 2026-10-17T00:00:00.000Z
{
"error": "rate_limited",
"message": "Line wa_8f3c2e1a hit its daily 1500-message cap. Quota resets at 2026-10-17T00:00:00.000Z.",
"reset_at": "2026-10-17T00:00:00.000Z"
}A warm-up playbook
The caps are a ceiling, not a target. Our published playbook ramps a new line from 10 to 15 messages a day up to full volume over about two weeks, with minimum gaps between sends at each stage.
Messages per day, per line
From our warm-up playbook
Reconnects without a rescan
Most disconnects are WhatsApp invalidating the session, not the account being in trouble. We restore the session on the same IP without logging the device out, and line.ready usually arrives within 10 to 30 seconds. If WhatsApp keeps invalidating it (five or more drops in ten minutes) we stop retrying, because hammering a hostile connection makes things worse, and send line.storm_detected with a reconnect_url instead. More on the causes in why WhatsApp keeps disconnecting.
WhatsApp’s own restriction signals, as webhooks
When WhatsApp restricts a number we read it from WhatsApp itself, including when it ends, and send it to you. That’s the next section.
What happens if WhatsApp restricts the number?
Most restrictions are temporary. The common one stops the number from starting chats with new people for a while, and every existing chat keeps working. You get line.restriction_changed with its kind, either reachout_timelock or temp_ban, WhatsApp’s own ends_at, and copy you can show your customer as is. When it lifts, the same event arrives with restricted: false.
POST https://your-app.com/webhooks/whatsapp
X-Mossmoon-Event: line.restriction_changed
X-Mossmoon-Signature: sha256=...
{
"event": "line.restriction_changed",
"line_id": "wa_8f3c2e1a",
"agency_external_user_id": "user_12345",
"ts": "2026-10-16T12:28:04.000Z",
"data": {
"restricted": true,
"kind": "reachout_timelock",
"enforcement_type": "BIZ_QUALITY",
"ends_at": "2026-10-16T15:40:00.000Z",
"customer_message": {
"headline": "WhatsApp limited new conversations",
"body": "WhatsApp is temporarily blocking this number from starting..."
}
}
}
Every line.disconnected carries a reason, and when the drop looks like WhatsApp pushing back it also carries a classification with a severity to switch on: info and warn need nothing, restriction_suspected means ask the customer to check WhatsApp on their phone, and banned means the number is done and it’s time for a new one. See line.restriction_changed and line.disconnected in the docs.
How do I warm up a new WhatsApp number?
Every number needs this: brand-new registrations, established numbers that have never been automated, numbers idle for 30+ days and any number recovering from a ban.
- 1
Let a brand-new number settle first
Don’t link a fresh number on day one. Wait at least 48 hours, ideally 7 to 14 days, and use the phone for normal conversations. A number that was banned before needs the full 14 days; one that sat idle for 30+ days usually needs 7. - 2
Make it look like a real account
Set a real name, photo and About text. Have people message it first so it receives more than it sends, join two or three relevant groups, save contacts on both sides, and aim for a reply rate above 50%. - 3
Link it and start small
Scan the QR from Linked devices. On days 1 and 2, send 10 to 15 messages a day to warm contacts who will reply, at least 15 to 20 seconds apart, in a personal tone. - 4
Ramp up over two weeks
Grow by no more than 15 to 20% a day: 20 to 35 on days 3 to 5, 50 to 100 on days 6 to 10, 200 to 300 on days 11 to 14, then 500 to 750 from day 15. Vary the text per person and keep gaps between sends. - 5
Watch the warning signs and back off
If delivery drops below 90%,message.failedevents rise, messages sit pending for more than five minutes, or a restriction webhook arrives: stop, drop back one phase, wait 48 to 72 hours, and resume more slowly.
When should you use the WhatsApp Business API instead?
If the plan is one-to-many campaigns to large opted-in lists, Meta’s WhatsApp Business API is the right tool, and we’ll say so. It is built for that, and it is the only way to get the green verified badge. Meta bills each delivered message by country and category, and since October 1, 2026, replies inside the 24-hour window are billed too.
- Broadcasts to big opted-in lists
- Business API. Linked-device lines are capped per day by design.
- The green verified badge
- Business API only.
- Replying to customers on the number they already use
- Linked device, no templates or per-message fees.
- Groups, polls, voice notes and calls in a CRM or AI agent
- Linked device. The Business API has no polls and its groups hold 8 people.
What can’t any WhatsApp API promise?
- Zero risk. WhatsApp decides, and its rules change. Anyone promising your number can never be banned is selling something.
- Rescue for a number that is already flagged. A history of reports follows the number, whatever it connects through.
- Safe bulk broadcasts. We cap lines per day and don’t support cold mass marketing. Big sends to opted-in lists belong on the Business API.
- Control over the phone. If the owner doesn’t open WhatsApp on their phone for about 14 days, WhatsApp unlinks every device. We send
line.disconnectedwith the reasonUNPAIRED, but they have to open the app and re-link.
Mossmoon vs goghl.ai on account health
goghl.ai also links WhatsApp by QR, inside GoHighLevel. It has ban-risk insights, a disconnect trigger, pacing tools, proxies by country and a warm-up guide, so none of those are listed here. These are the health features we offer that their public docs don’t list.
$15 a line. First line free for 7 days.
| Feature | RecommendedMossmoon$15 a line. First line free for 7 days.Start free → | goghl.ai |
|---|---|---|
| WhatsApp's own restriction signals, with the time they end | Yesline.restriction_changed with kind, ends_at and copy to show your customer | Not listedTheir ban insights are built from activity patterns, not WhatsApp's restriction state |
| A disconnect reason, and a severity when WhatsApp pushes back | Yesreason on every line.disconnected, plus a classification: info, warn, restriction_suspected or banned | Not listedTheir disconnect trigger carries the number, not a reason |
| Reconnects after WhatsApp drops the session, without a rescan | YesSilent restore on the same IP, line.ready usually within 10 to 30 seconds | Not listed |
| Line health and restriction history over a public REST API | YesGET /lines/:id and GET /lines/:id/restriction-history | Not listedTheir docs describe no public REST API |
| Remaining daily quota on every send | YesX-Mossmoon-Daily-Remaining and a soft warning header | Not listed |
Checked against goghl.ai’s public site and help center on October 16, 2026. “Not listed” means we couldn’t find it in their docs, not that it can’t exist. Only features goghl.ai doesn’t list are shown. Sources: AI Ban Protection Insights, Dealing with bans, Disconnection notifications, WhatsApp Disconnected trigger, Webhooks, goghl.ai.
Frequently asked questions
Usually not, if it is used for real conversations at a sensible pace. What gets numbers restricted is behavior: cold outreach, spam reports, identical messages to many people and sudden volume on new numbers. No provider can promise zero risk, so warm up new numbers and watch for restriction signals.
No. Meta's own route for businesses is the WhatsApp Business API. Linked-device APIs connect as one of the account's linked devices, and WhatsApp's terms restrict automated and bulk messaging, so use one for genuine one-to-one conversations and behave like a person.
There is no number WhatsApp publishes. On Mossmoon a well-warmed line has a soft cap of 750 sends a day and a hard cap of 1,500, reset at midnight UTC. A new line should start at 10 to 15 a day and ramp up over about two weeks.
No. It removes one risk, many accounts sharing one address, and gives WhatsApp one steady connection per number. What you send, and to whom, still matters far more.
On Mossmoon you get a line.restriction_changed webhook with the kind of restriction, WhatsApp's own end time and customer-ready copy, and a second one when it lifts. Disconnects arrive as line.disconnected with a reason, plus a severity when the drop looks like a restriction, so you know whether to wait, ask the customer to check WhatsApp, or move to a new number.
Temporary restrictions end on their own at the time WhatsApp sets. A permanent ban is usually final: WhatsApp offers an in-app review, but plan on a new number and warm it up for the full 14 days before linking it.