---
title: "[BETA] set privacy setting"
method: POST
path: "/instances/{id}/client/action/set-privacy-setting"
tags: ["client"]
---

# \[BETA\] set privacy setting

`POST /instances/{id}/client/action/set-privacy-setting`

## Request

- Base URL: `https://waapi.app/api/v1`
- URL: `https://waapi.app/api/v1/instances/{id}/client/action/set-privacy-setting`
- Auth: HTTP bearer

Update a single privacy category. Allowed values depend on the category. Note: This endpoint is currently in beta and may change without notice.

## Path parameters

- `id` integer, required

## Request body

- object
  - `category` 'readReceipts' | 'lastSeen' | 'online' | 'profilePicture' | 'about' | 'groupAdd' | 'callAdd' | 'messages', required
  - `value` string, required: Allowed values: all, contacts, contact_blacklist, none, known, match_last_seen
  - `disallowedList` string[]: Required only when value is "contact_blacklist".

## Response `200`

Request reached the instance. `data.status` reports whether the action was carried out; on error `data` carries `message` and `explanation`. Payload: Privacy setting updated successfully.

- object
  - `data` union: The action's outcome. `status: success` carries the payload; `status: error` is an `actionError`.
    - object
      - `status` 'success', required: Whether the instance carried the action out — the authoritative field. In this branch it is always `success`; when the instance refused the action the whole `data` object is an `actionError` with `status: error`, `message` and `explanation`.
      - `instanceId` union
        - integer
        - string
      - `data` object
        - `settings` object: Account privacy settings
          - `readReceipts` 'all' | 'none'
          - `lastSeen` 'all' | 'contacts' | 'contact_blacklist' | 'none'
          - `online` 'all' | 'match_last_seen'
          - `profilePicture` 'all' | 'contacts' | 'contact_blacklist' | 'none'
          - `about` 'all' | 'contacts' | 'contact_blacklist' | 'none'
          - `groupAdd` 'all' | 'contacts' | 'contact_blacklist'
          - `callAdd` 'all' | 'known'
          - `messages` 'all' | 'contacts'
    - ActionError: Shape of `data` when the instance refused the action. HTTP status is still 200 and the outer `status` is still `success`.
      - `status` 'error', required
      - `message` string
      - `explanation` string
      - `instanceId` union
        - integer
        - string
  - `status` 'success' | 'error': Whether the request reached the instance. `success` here does **not** mean the action was carried out — that is reported by `data.status`, which is the authoritative one. A malformed input arrives as `status: success` with `data.status: error`.

## Other responses

- `401`: Unauthorized — invalid or missing bearer token
- `403`: Forbidden — insufficient permissions or account blocked
- `404`: Not found — instance does not exist or does not belong to you

---

[API](https://skmtc.dev/waapi/apis/waapi-api-2.md) · [All operations](https://skmtc.dev/waapi/apis/waapi-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/waapi/apis/waapi-api-2/revisions/490302f75576?raw)