Notes
Rate Limiting: API endpoints are rate-limited to 100 requests per minute per IP. The /api/kiosk/waittime endpoint allows 300 requests per minute.
Error Responses: All endpoints return
{"success": false, "error": "description"} with appropriate HTTP status codes (400, 401, 403, 404, 429, 500).CORS: API endpoints accept requests from movo-x.com, localhost:3000, and configured kiosk origins.
Webhook Security: The WhatsApp webhook verifies the Meta signature header to ensure request authenticity.