Skip to main content

Overview

WhatsApp-Rust uses an event-driven architecture where the client emits events for all WhatsApp protocol interactions. Your application subscribes to these events to handle messages, connection changes, and notifications.

Event system architecture

CoreEventBus

Location: wacore/src/types/events.rs
Features:
  • Thread-safe event dispatching via Arc<Event> — each event is wrapped once and shared across all handlers, eliminating deep clones
  • Multiple handlers supported
  • Clone-cheap with Arc

EventHandler Trait

Handlers receive Arc<Event> — a shared reference-counted pointer to the event. Since Arc<Event> implements Deref<Target = Event>, you can pattern-match on it directly. Implementation:

Typed event interest (skip boxing unwanted events)

By default a handler receives every event. If you only care about a few kinds, override interest() so the event bus skips building and dispatching the kinds nobody wants — for high-throughput events (presence, receipts) this avoids the per-event Arc allocation entirely.
  • EventKind is a #[repr(u8)] discriminant — one variant per Event variant (Messages, Connected, Receipt, …). The enum is #[non_exhaustive], so match blocks on EventKind must include a wildcard arm (_ => …); new kinds may be added in minor releases as the library tracks new server events.
  • EventKind::CAPACITY is a public u8 constant (currently 128) that bounds the number of kinds. It exists because each discriminant is packed as a bit in EventInterest’s u128 mask, and a future variant that would overflow it fails compilation rather than silently corrupting the mask at runtime. Treat it as a read-only ceiling — you don’t need to check it at runtime.
  • EventInterest is a 128-bit set of kinds. Build it with EventInterest::of(&[…]), EventInterest::ALL (the default), EventInterest::none(), or chain .with(kind). Query it with .wants(kind).
  • The bus exposes has_handler_for(kind) and only produces an event when at least one registered handler wants its kind.
EventInterest was widened from a u64 to a u128 mask (and EventKind::CAPACITY from 64 to 128) as part of the pre-1.0 event-payload API freeze, since the kind count had reached 58/64. The public surface (EventInterest::of, .with(kind), .wants(kind), EventInterest::ALL) is unchanged — only the internal bit width doubled, giving headroom for future event kinds.
With the Bot builder, the same narrowing is available via on_event_for:
on_event (without kinds) keeps subscribing to everything.

Event Enum

Location: wacore/src/types/events.rs
The Event enum is #[non_exhaustive], so your match statements must include a wildcard arm (_ => {}). New variants may be added in minor releases without a breaking change.
Payload stability: every event payload struct is sealed with #[non_exhaustive] plus a bon builder for construction (Type::builder()…build()), so a payload can gain fields later without breaking consumers. The freeze rolled out in stages — ServerAck first, then the notification/presence/contact/group payloads and the app-state-sync mutation payloads, then the remaining message/newsletter/device/pairing payloads and the three unit-marker events (Connected, QrScannedWithoutMultidevice, StreamReplaced, each an empty sealed struct built as Connected::builder().build()) — and is now complete across the whole Event surface. (ClientOutdated was a fourth unit-marker event until it gained a raw field; see ClientOutdated below.) Read the fields you need (e.g. ack.class) or keep a .. rest when destructuring (required for a #[non_exhaustive] struct pattern from outside the defining crate — e.g. InboundMessage { message, info, .. }), rather than binding every field. A maybe-absent field is always modeled as Option<T> (with a maybe_* builder setter), never an empty-string or zero sentinel. The library itself constructs every payload via its builder — a struct literal from outside wacore/whatsapp-rust no longer compiles (E0639).

Connection Events

Connected

Emitted: After the session is authenticated and has asked the server to leave passive mode. On a fresh pairing (and on any reconnect before the account’s critical app-state collections have synced), the client waits for the critical app-state sync to produce an answer first — see Critical app-state sync (pairing bootstrap) — so the push name and blocklist are normally in place by the time this fires. As of PR #1291, it waits but does not withhold: a critical collection the server refused or couldn’t deliver is reported via AppStateSyncFailed and Connected fires regardless, since a session already delivering messages shouldn’t leave a consumer believing nothing ever connected.
Leaving passive mode is best effort: a failed set_passive(false) call is only logged, not retried, and the connection is announced anyway. Treat Connected as “the client believes stanzas should be flowing,” not a guarantee the server agrees.
Usage:

Disconnected

Emitted: When the connection ends without the client itself intentionally closing or reconnecting it — covers both a routine server-initiated stream recycle and a genuine transport failure (see reason below to tell them apart)
Fields:
  • reason: DisconnectReason — why the transport ended. Check reason.is_clean_shutdown() to tell a routine server-initiated stream recycle (WhatsApp’s normal reconnect path) apart from a genuine transport failure, without parsing logs. See DisconnectReason for the variants.
Behavior: Client automatically attempts reconnection
Breaking change: Disconnected gained the reason field (previously a unit struct). Disconnected is now #[non_exhaustive] too, so a destructuring pattern needs a .. rest: Event::Disconnected(Disconnected { reason, .. }), or just Event::Disconnected(_).

ConnectFailure

Emitted: When connection fails with a specific reason
Breaking change: ConnectFailure.message changed from String (empty-string sentinel when the server omitted the message attribute) to Option<String>, matching the “maybe-absent field is always Option” convention. unwrap_or_default() at a call site becomes .unwrap_or_default() on the Option (same fallback) or, better, match/if let Some(msg) = &failure.message.
Helper methods:
The 403 variant was renamed MainDeviceGoneAccountLocked in v0.6 to match WA Web’s REASON_LOCKED semantics (the account/device is locked server-side; a manual unlink arrives as a different reason). It still maps from wire code 403 and reports is_logged_out() == true with no auto-reconnect. Update any match arms referencing the old name.

TemporaryBan

Emitted: When account is temporarily banned
Fields:
  • code — the ban sub-reason from the code attribute
  • expire — how long the ban lasts, as a chrono::Duration
  • message — the server’s free-text detail, when present
  • url — the support/appeal link the official ban screen opens, when the server sent one
  • raw — the whole <failure> stanza
Breaking change: TemporaryBan gained message, url and raw. It also gained a stricter emission rule: a <failure reason="402"> missing code or expire — or whose expire doesn’t fit a chrono::Duration — no longer dispatches TemporaryBan with an invented zero expiry. Such a stanza now surfaces as ConnectFailure { reason: ConnectFailureReason::TempBanned, raw: Some(node), .. } instead, carrying the same raw stanza. A consumer that matched on Event::TemporaryBan to detect an incomplete ban stanza will now see Event::ConnectFailure.
Usage:

StreamReplaced

Emitted: When another device connects with the same credentials (stream error code 409 or <conflict type="replaced">)
Usage:
Behavior: Auto-reconnect is disabled. The client stops permanently.

LoggedOut

Emitted: When the session is invalidated by the server (stream error code 401 or 516) or when client.logout() is called
Fields:
  • on_connecttrue if the logout happened during a connection attempt (server-initiated), false if triggered by client.logout() or a stream error while connected
  • reason — The reason for the logout (e.g., ConnectFailureReason::LoggedOut)
  • logout_message — server-supplied header/subtext/locale, when the server sent any (in practice, only on an account lock). The official client only renders header/subtext when locale matches the consumer’s current locale, and the locale travels with the text so a consumer can apply the same rule.
  • raw — the stanza that caused the logout, when one was received. Two different shapes reach this field, so dispatch on raw.tag rather than assuming one: "failure" for a server-side connect refusal (on_connect is then true), and "stream:error" for a <conflict>, a 516 device removal, or a 401 stream error while already connected. None for a locally initiated client.logout() — there’s no stanza to report.
Breaking change: LoggedOut gained logout_message and raw. An account lock (reason: ConnectFailureReason::AccountLocked) carries a server-issued appeal_token plus violation_reason and vt on the <failure> stanza — WA Web itself ignores these (its appeal flow is native-client only) so they aren’t parsed into typed fields, but they now survive on logout.raw for an embedder that wants to build its own appeal UI. Read them off raw.attrs.get("appeal_token"), etc.
Usage:
Behavior: Auto-reconnect is disabled. The application must re-pair the device to establish a new session.

StreamError

Emitted: For unrecognized stream error codes (codes not matching 401, 409, 429, 503, 515, or 516), and — since #1263 — also for 429 (rate-limited), even though 429 is itself a recognized, explicitly-handled code. WhatsApp Web’s own handler has no arm for it either (only 500..600 is special-cased there), so reporting 429 here is an embedder-facing choice rather than a fidelity fix.
Usage:
Specific stream error codes have the following event behavior:
  • 401LoggedOut (session invalidated)
  • 409StreamReplaced (another client connected)
  • 429StreamError (rate limited; also reconnects with extended backoff)
  • 503 → No event emitted (reconnects with normal backoff)
  • 515 → No event emitted (immediate reconnect, e.g., after pairing)
  • 516LoggedOut (device removed)

Pairing Events

PairingQrCode

Emitted: For each QR code in rotation
Example:
Breaking change: PairingQrCode moved from inline fields directly on the Event::PairingQrCode { code, timeout } variant to a dedicated sealed struct — Event::PairingQrCode(PairingQrCode). Update destructuring patterns to match through the newtype, with a .. rest since the inner struct is #[non_exhaustive].

PairingCode

Emitted: When pair code is generated
timeout is the remaining validity window, not always the full ~180 seconds: the clock starts before the stage-1 companion_hello round-trip, so timeout is already reduced by however long that request took.
Example:
Breaking change: PairingCode moved from inline fields on Event::PairingCode { code, timeout } to a dedicated sealed struct — Event::PairingCode(PairingCode).

PairingCodeRefresh

Emitted: When the in-progress phone-number pairing code should be replaced. Covers two triggers (WA Web Alt/DeviceLinkingApi.js + Link/DevicePhoneNumberCodeScreen.react.js): the server asking for it (refreshAltLinkingCode / forceManualRefresh, only while a pair-code flow is outstanding and the server’s ref matches it — a refresh_code notification for a stale or unrelated flow is silently ignored), and a non-refused companion_finish — accepted, or its own 30s wait going unanswered — whose pair-success then went unanswered for a minute (PairCodeUtils::primary_hello_pair_success_timeout()) — a primary that could not open the key bundle just goes quiet at that point, so silence is the only signal there is. A companion_finish the server actively refuses is a different case and does not fire this event — see PairingCodeError below.
Example:
Breaking change: PairingCodeRefresh moved from an inline Event::PairingCodeRefresh { force_manual } field to a dedicated sealed struct — Event::PairingCodeRefresh(PairingCodeRefresh). A matches! check on the field becomes matches!(event, Event::PairingCodeRefresh(r) if r.force_manual).
The silent-pair-success timeout trigger (formerly described as the “unanswered-companion_finish” trigger) is not new by itself. What changed is narrower, but worth registering a handler for: a companion_finish the server actively refuses used to go unanswered like any other stage-2 failure, so it also fell into this same one-minute timeout and eventually fired PairingCodeRefresh. It no longer does — a refusal now exits immediately as PairingCodeError instead (see below) and this event never fires for it. If your handler only registers on_pair_code_refresh (not on_pair_code_error) and relied on it eventually firing for every stage-2 failure, including a refusal, it will now miss that case — the retry will not happen unless you also handle PairingCodeError. A handler that only cares about a server-requested refresh, or that already registers both, needs no changes.

PairingCodeError

Emitted: When a phone-number pair-code flow fails, so no linking will come of it. For a stage-1 failure, Client::pair_with_code dispatches this in addition to returning Err — the event is the only surface that reports it when pairing is driven by BotBuilder::with_pair_code, since that request runs in a detached task and its Err reaches no caller. For a stage-2 companion_finish refusal there is no Err to receive either way: pair_with_code’s call already returned Ok(code) once stage 1 succeeded, long before the notification that drives stage 2 arrives — this event is the only surface for that failure, for a direct caller and a with_pair_code consumer alike.
Example:
Two failures never reach this event, because for them a code may still be on its way and the event would say the opposite: PairCodeError::CodeAlreadyOutstanding (an earlier code is still live — the consumer already has it from the PairingCode that minted it) and PairCodeError::Cancelled (the caller withdrew this request, and a replacement may already own the slot by the time it resolves). Both are consequences of something the caller did, so neither is news to them, and a direct caller still receives the Err either way. See Pair code failure events for PairCodeRejection’s variants and the full breakdown, and BotBuilder::on_pair_code_error to register a handler.
New: this event now also fires for a refused companion_finish (stage 2), reported the moment the server answers rather than after the one-minute pair-success silence timer. No shape change — PairingCodeError’s fields are the same — so a handler already matching on this event needs no code changes, only the awareness that it can now fire earlier and for a second reason. rejection follows companion_finish’s own narrower set of refusals; see PairCodeRejection.

PairingQrCodesExhausted

Emitted: When the server’s <pair-device> refs are used up — there is no QR left to render until the connection is re-established. WA Web’s rotation timer (Handle/PairDevice.js) reports UNPAIRED_IDLE here and stops; it does not close the socket unconditionally, because a phone-number (pair-code) flow may still be riding the same connection.
Example:
See QR ref exhaustion for why this no longer disconnects unconditionally.
disconnected: true reports intent, not a completed action: the client dispatches this event before awaiting disconnect(), so the socket may still be open at the moment a handler observes it. A synchronous EventHandler runs inline ahead of the disconnect; a Bot/on_event closure runs off a channel on its own task and can race it either way. No Event::Disconnected follows, though: disconnect() sets expected_disconnect, and Disconnected is scoped to disconnects the client did not itself intend, so waiting on it here hangs forever. disconnect() also disables auto-reconnect and, as of PR #1258, is final for this Client instance — it fires the same sticky shutdown signal connect() now checks, so a later connect() on the same instance returns ConnectError::Shutdown rather than eventually succeeding. Build a fresh Client against the same persistence_manager and call connect() on that one instead.
This is a new event and a new EventKind variant, added at the end of EventKind (after ServerAck) rather than next to Event::PairingQrCodesExhausted — new kinds always go at the end, since the discriminant is what a consumer persists or transmits and inserting in the middle would renumber every kind after it.

PairSuccess

Emitted: When pairing completes successfully
Example:

PairError

Emitted: When pairing fails

PairPasskeyRequest

Emitted: During passkey (SHORTCAKE_PASSKEY) linking, when the server asks for a WebAuthn assertion to gate the link
If a PasskeyAuthenticator is registered via Client::set_passkey_authenticator, the client obtains and sends the assertion automatically; this event is for hosts that drive the WebAuthn ceremony manually. Example:

PairPasskeyConfirmation

Emitted: When the passkey link reaches the verification stage
Example:

PairPasskeyError

Emitted: When a passkey link attempt fails

QrScannedWithoutMultidevice

Emitted: When a QR code is scanned by a device that does not support multi-device
Usage:

ClientOutdated

Emitted: When the server rejects the connection because the client version is too old (connect failure code 405)
Fields:
  • raw — the <failure reason="405"> stanza the server sent
Breaking change: ClientOutdated gained raw, carrying the full <failure> stanza instead of discarding it.
Usage:
Behavior: Auto-reconnect is disabled. You must update to a newer version of the library.

Message Events

Messages

Emitted: For all incoming messages (text, media, etc.), one event per durable commit.
Live traffic dispatches a batch of one, so per-message latency is unchanged from the previous single-message event. During the offline drain the client accumulates decrypted messages and dispatches one Event::Messages per durable commit (size/byte/timeout triggers, matching WhatsApp Web’s MessageProcessorCache — see Inbound Durability). MessageBatch behaves as a collection: batch.iter(), batch.len(), batch.is_empty(), batch.first(), and for msg in &batch all work directly. Event::as_messages() returns Option<&MessageBatch>, and Event::messages() returns an iterator over the batch’s InboundMessages (empty for any other event kind) — use it to scan a mixed event stream without matching on Event::Messages first.
hook_committed is true when a registered inbound durability hook already committed this batch before it was dispatched. It defaults to false via the builder, so existing .build() calls compile unchanged. It’s a signal for another consumer of the same event stream — not an instruction to skip anything on its own, since a hook that persists elsewhere would leave that consumer as the only materializer. ChatStore uses it via the opt-in skip_hook_committed_batches to avoid materializing a hook-fed batch twice.
Breaking change: InboundMessage and MessageBatch are now #[non_exhaustive], sealed with a bon builder. A for InboundMessage { message, info } in batch.iter() destructuring pattern needs a .. rest: for InboundMessage { message, info, .. } in batch.iter().
Both the message body and MessageInfo are Arc-wrapped inside InboundMessage. The same Arc slice handed to a registered durability hook is what this event carries — no deep clone, and a consumer never sees a message the hook did not commit (newsletter messages and PDO placeholder recoveries are the two exceptions: they dispatch event-only, bypassing the hook). Before v0.6 the body was Box<wa::Message>; the public guarantee changed from “owned, freely mutable” to “shared, immutable read access” — call Arc::make_mut (or clone the inner wa::Message) only if you genuinely need to mutate.
MessageInfo structure:
sender_alt carries the LID/PN counterpart of sender whenever the stanza exposes one — including status@broadcast messages, which always include participant_lid (or participant_pn for LID-addressed status). The library reads it unconditionally so the LID-PN cache can re-warm from the message itself, matching WA Web’s WAWebMsgParser. MessageCategory:
EditAttribute: Indicates the type of edit or revocation applied to a message. Values correspond to the wire-format edit attribute on message stanzas.
MsgBotInfo: Present when the message originates from a WhatsApp bot (AI-generated responses). Contains streaming edit metadata.
MsgMetaInfo: Additional metadata for message threading, targeting, and abuse reporting.
server_timestamp_us, verified_level, verified_name_serial, peer_recipient_pn, plus all five MsgMetaInfo additions above were added in v0.6 as part of aligning inbound parsing with WA Web. They are populated only when the server includes the corresponding stanza attribute, so existing consumers that ignore them keep working.
Breaking change: verified_name changed from the raw, never-populated wa::VerifiedNameCertificate to Option<Box<VerifiedName>> — the decoded business display name (see VerifiedName for its name/serial/issuer/certificate fields). Business senders attach this cert to the <message> stanza’s <verified_name> child; it’s now decoded the same way the usync and business-notification parsers already did, so a WABA sender’s display name (e.g. “HDFC Bank Ltd”) reaches this field instead of being silently dropped. It’s boxed since most messages carry none. Undecodable cert bytes don’t fail message parsing — the field is just None in that case.verified_name_serial is unrelated to and unchanged by this: it’s parsed from the envelope’s own verified_name attribute (an integer), while verified_name.serial is decoded from the child cert’s Details.serial field (a string). Both name the same certificate serial in a well-formed stanza, but they’re read from two different places on the wire and can be populated independently — a stanza could in principle carry one without the other.
Every Option<T> field on MessageInfo, MessageSource, MsgBotInfo, and MsgMetaInfo is annotated #[serde(skip_serializing_if = "Option::is_none")]. A JSON serialization of these structs (e.g. via serde_json::to_value, for structured logging or observability dumps) omits an absent field entirely instead of emitting it as null. This applies uniformly across all optional fields as of the allocation/serialization cleanup in whatsapp-rust#1059 — earlier releases only omitted the four v0.6-era fields above, and serialized the remaining optional fields as explicit null when absent. Present field values are unchanged; only the JSON output shape for absent fields differs.
DeviceSentMeta: Present on device-synced messages (messages you sent from another device).
Example:

Receipt

Emitted: For delivery/read/played receipts
ReceiptType is #[non_exhaustive]. Server-driven sets like this grow over time (recent additions include EncRekeyRetry, ReadSelf, PlayedSelf, PeerMsg, and HistorySync), so your match arms must always include a wildcard (_ => …). New variants can be added in minor releases without a breaking change.
Example:

UndecryptableMessage

Emitted: When a message cannot be decrypted or is unavailable. This includes:
  • Decryption failures (no session, invalid keys, MAC errors)
  • Group messages that fail with NoSenderKeyState (missing sender key) — dispatched before the retry receipt is sent
  • Messages with an <unavailable> node — view-once already viewed, hosted content, bot fanouts, or other server-side unavailability. For ViewOnce/Hosted/Bot, the phone never shares that content with a companion device, so the client acks the stanza directly instead of requesting it. Only the Unknown case goes through PDO recovery
When is_unavailable is true, the message had no encrypted content in the stanza. For UnavailableType::Unknown, the client sends a PDO request to your primary phone, and if the phone responds successfully, a follow-up Event::Messages is dispatched with the recovered content (event-only — a PDO recovery bypasses the durability hook and the offline-drain batcher, dispatching immediately with BatchOrigin::Live). For ViewOnce, Hosted, and Bot, no PDO request is sent — that content is unrecoverable by design, so no follow-up Event::Messages should be expected.

Notification

Emitted: For raw notification stanzas that are not handled by a more specific event type
This is a passthrough event that gives you access to the raw node for notification types that the library does not parse into dedicated event structs. The OwnedNodeRef provides zero-copy access to the decoded stanza — call .get() to obtain a NodeRef for inspecting the tag, attributes, and children. Example:
Most notifications are already parsed into specific event types (e.g., GroupUpdate, DeviceListUpdate, ContactUpdated). This event only fires for unhandled notification types.
DecryptFailMode is determined by the decrypt-fail attribute on incoming <enc> nodes. If any <enc> node has decrypt-fail="hide", the entire message uses Hide mode.
  • Show — Default. The application should display a “waiting for this message” placeholder. Used for regular user-visible messages.
  • Hide — The application should silently discard the failure. Used for infrastructure messages (reactions, poll votes, pin changes, edit messages, event responses, message history notices, secret encrypted event/poll edits, certain protocol messages, and SKDM stanzas) that don’t need user-visible placeholders.
See Decrypt-fail suppression for the full list of message types that set this attribute on outgoing stanzas. Example:

ServerAck

Emitted: Observe-only, for every server <ack> stanza that carries an id — dispatched independently of the internal send-waiter resolution, so registering a handler never interacts with the send/phash flow.
Server acks cover every outgoing stanza class, not just messages — filter on class rather than correlating ids blind. Dispatch is gated on a registered handler existing for this event kind, so the hot ack path allocates nothing when no consumer subscribes.
ServerAck was the first payload sealed under the stability policy above: it’s #[non_exhaustive] and constructed via a generated bon builder (ServerAck::builder().id(...).maybe_class(...)…build()). This only affects code that constructs a ServerAck (the client itself) or uses exhaustive struct-pattern destructuring (which is already disallowed by the .. guidance above); accessing fields by name with dot notation (ack.id, ack.class), as in the example below, is unaffected.
Example:

Presence Events

ChatPresence

Emitted: For typing indicators and recording states
Example:

Presence

Emitted: For online/offline status and last seen
Example:

User update events

PictureUpdate

Emitted: When a user changes their profile picture
Fields:
  • jid - The JID whose picture changed (user or group)
  • author - The user who made the change. Present for group picture changes (the admin who changed it). None for personal picture updates.
  • removed - Whether the picture was removed (true) or set/updated (false)
  • picture_id - The server-assigned picture ID. None for deletions.

UserAboutUpdate

Emitted: When a user changes their status/about

PushNameUpdate

Emitted: When a contact changes their display name

SelfPushNameUpdated

Emitted: When your own push name is updated

Group Events

GroupUpdate

Emitted: For each action in a group notification (subject changes, participant changes, settings updates, etc.). A single notification may produce multiple GroupUpdate events.
Fields:
  • group_jid - The group this update applies to
  • participant - The admin/user who triggered the change
  • participant_pn - Phone number JID of the participant (for LID-addressed groups)
  • is_lid_addressing_mode - Whether the group uses LID addressing mode
  • action - The specific group notification action (subject change, participant add/remove/promote/demote, description change, etc.)
Example:

GroupNotificationAction

The action field on GroupUpdate is a GroupNotificationAction enum with the following variants: Participant-related variants include a participants field of type Vec<GroupParticipantInfo>:
display_name carries the server-provided label for a participant — for non-contacts this is typically the masked phone number ("+55•••••••••79"). It is populated only when the participant appears as a <participant> child of a group notification; entries that arrive via <requested_user> (membership requests) leave it None. Membership request variants include a request_method field of type MembershipRequestMethod:
  • MembershipApprovalRequest — emitted when a user requests to join a group. The requester is identified by the parent GroupUpdate::participant field.
  • CreatedMembershipRequests — admin-side notification: new join requests appeared. The requests field contains the requesting users (as Vec<GroupParticipantInfo>).
  • RevokedMembershipRequests — emitted when membership requests are rejected by an admin or cancelled by the requester. The participants field contains the affected JIDs.
Both MembershipApprovalRequest and CreatedMembershipRequests include an optional parent_group_jid field for community-linked joins. Example: handling specific group actions:
A single group notification from the server can contain multiple actions. The library dispatches a separate GroupUpdate event for each action, so your handler may receive multiple events from one notification.

Contact notification events

Most events in this section are emitted from <notification type="contacts"> stanzas sent by the server. Two are not: ContactUpdate and ContactRemoved come from app-state sync mutations instead, grouped here with their notification-based siblings because they are all contact-related — each one’s own description below states its actual source.

ContactUpdated

Emitted: When a contact’s profile changes (server notification)
Wire format: <notification type="contacts"><update jid="..."/> When you receive this event, you should invalidate any cached presence or profile picture data for the contact. WhatsApp Web resets its PresenceCollection and refreshes the profile picture thumbnail on this event. Example:

ContactNumberChanged

Emitted: When a contact changes their phone number
Wire format: <notification type="contacts"><modify old="..." new="..." old_lid="..." new_lid="..."/> The library automatically creates LID-PN mappings when LID attributes are present (old_lid→old_jid and new_lid→new_jid). WhatsApp Web generates a system notification message in both the old and new chats. Example:

ContactSyncRequested

Emitted: When the server requests a full contact re-sync
Wire format: <notification type="contacts"><sync after="..."/> Example:

ContactUpdate

Emitted: When a contact’s information changes via app-state sync (e.g., first name, last name set in your address book)
Fields:
  • jid - The contact whose information changed
  • timestamp - When the change occurred
  • action - The contact action from app-state sync, containing fields like full_name and first_name
  • from_full_sync - Whether this came from a full app-state sync (initial load) or an incremental update
Example:
ContactUpdate comes from app-state sync mutations and is distinct from ContactUpdated, which comes from server-side <notification type="contacts"> stanzas.
The server may also send <add/> and <remove/> child actions in contacts notifications for lightweight roster changes. These are acknowledged automatically and do not emit events.

ContactRemoved

Emitted: When a saved contact is deleted via app-state sync on a linked device
Fields:
  • jid - The contact that was removed
  • timestamp - When the removal occurred
  • from_full_sync - Whether this came from a full app-state sync (initial load) or an incremental update
Example:
ContactRemoved is distinct from ContactUpdate, and the event itself carries no action payload. The underlying wire mutation is different: it is a syncd Remove with an all-default ContactAction value, since WhatsApp Web builds that value before choosing the operation. WhatsApp Web ignores the value on the Remove branch and simply drops the contact from the address book — but if you call remove_app_state_action directly for an action like this one, you still need to pass a value. See Chat actions — Save and remove contacts for the outbound API (remove_contact) that emits this event on other devices.

Chat state events

PinUpdate

Emitted: When a chat is pinned/unpinned

MuteUpdate

Emitted: When a chat is muted/unmuted

ArchiveUpdate

Emitted: When a chat is archived/unarchived

StarUpdate

Emitted: When a message is starred or unstarred
Fields:
  • chat_jid - The chat containing the starred message
  • participant_jid - The sender of the message (only for group messages from others; None for self-authored or 1-on-1 messages)
  • message_id - The ID of the starred/unstarred message
  • from_me - Whether the starred message was sent by you
Example:

MarkChatAsReadUpdate

Emitted: When a chat is marked as read or unread across linked devices
Example:

DeleteChatUpdate

Emitted: When a chat is deleted across linked devices
Fields:
  • jid - The JID of the deleted chat
  • delete_media - Whether media files were also deleted
  • action - The underlying protobuf action containing the optional message_range
Example:

ClearChatUpdate

Emitted: When a chat’s messages are cleared (but the chat is kept) on a linked device
Fields:
  • jid - The chat that was cleared
  • delete_starred - Whether starred messages were also removed
  • delete_media - Whether downloaded media was also removed
  • from_full_sync - true while replaying the initial app state full sync
Example:
See clear_chat for the outbound API that emits this on other devices.

UserStatusMuteUpdate

Emitted: When a contact/group/channel’s status updates are muted or unmuted on a linked device
Fields:
  • jid - The entity whose status updates were (un)muted
  • muted - true when status was muted, false when unmuted
  • from_full_sync - true while replaying the initial app state full sync
Example:
See set_user_status_mute for the outbound API.

DeleteMessageForMeUpdate

Emitted: When a message is deleted locally (not for everyone) across linked devices
Fields:
  • chat_jid - The chat containing the deleted message
  • participant_jid - The sender of the message (only for group messages from others; None for self-authored or 1-on-1 messages)
  • message_id - The ID of the deleted message
  • from_me - Whether the deleted message was sent by you
  • action - The underlying protobuf action containing delete_media and optional message_timestamp
Example:

LabelEditUpdate

Emitted: When a chat label is created, renamed, recolored, or deleted on a linked device
Fields:
  • label_id — Stable label identifier
  • action.name — New display name (None when only the deleted flag changes)
  • action.color — WhatsApp color index for the swatch
  • action.deletedSome(true) when the label was removed
  • from_full_synctrue while replaying the initial app state full sync
Example:

LabelAssociationUpdate

Emitted: When a label is added to or removed from a chat on a linked device
Fields:
  • label_id — Identifier of the label being attached or detached
  • chat_jid — Chat whose label set changed
  • action.labeledSome(true) when the label was added, Some(false) when removed
  • from_full_synctrue while replaying the initial app state full sync
Example:
See Labels for the outbound API that emits these events on other devices.

MessageLabelAssociationUpdate

Emitted: When a label is added to or removed from a single message on a linked device
Fields:
  • label_id — Identifier of the label being attached or detached
  • chat_jid — Chat containing the labeled message
  • message_id — Message whose label set changed
  • timestamp — When the association change occurred
  • action.labeledSome(true) when the label was added, Some(false) when removed
  • from_full_synctrue while replaying the initial app state full sync
Example:
Distinct from LabelAssociationUpdate above — that event is a whole-chat association, this one is scoped to a single message. See Labels — Associate a label with a message for the outbound API.

QuickReplyUpdate

Emitted: When a quick reply is created, edited, or deleted on a linked device
Fields:
  • id — Stable quick reply identifier
  • timestamp — When the change occurred
  • action.shortcut — The /-typed trigger text
  • action.message — The expanded message text
  • action.deletedSome(true) when the quick reply was deleted
  • from_full_synctrue while replaying the initial app state full sync
Example:
Deletion is the same mutation with action.deleted == Some(true), not a syncd Remove — check that flag rather than assume the event always describes a live quick reply. See Quick Replies for the outbound API that emits this event on other devices.

History sync events

HistorySync

Emitted: For chat history synchronization
LazyHistorySync holds the original compressed zlib payload and only decodes the full wa::HistorySync proto on demand. Cheap metadata (sync_type, chunk_order, progress) is available without decoding. Queued events are ~10× smaller than the decompressed form — a typical InitialBootstrap chunk is 5–20 MB inflated, ~1–2 MB compressed.
Key characteristics:
  • Metadata without decodingsync_type(), chunk_order(), progress(), and peer_data_request_session_id() are extracted during the streaming phase and available immediately
  • Parse-once semanticsget() decodes the full proto on first call and caches the result via OnceLock. With Arc<Event> dispatch, all handlers share the same LazyHistorySync instance. The compressed payload is never consumed — get() can be called multiple times and other accessors still work afterward
  • Cheap cloneClone is a refcount bump on the compressed buffer; no decode cache is carried over, so each cloned instance re-inflates independently on demand
  • Decompress on demanddecompress() re-inflates into a fresh buffer on every call (no caching). Use get() for repeated full-proto access, or stream() for memory-bounded incremental access
  • Streamingstream() yields one conversation at a time via HistorySyncStream, keeping peak memory near the largest single conversation rather than the full decompressed size
  • Serialization — Only metadata (sync_type, chunk_order, progress, peer_data_request_session_id) is serialized, not the blob
  • On-demand correlationpeer_data_request_session_id() is set only on syncs the server pushes in response to fetchMessageHistory / requestPlaceholderResend. Server-initiated syncs (initial bootstrap, recent, push-name) return None. Use it to route the blob back to the request that triggered it.
For large InitialBootstrap blobs, prefer stream() for incremental processing or decompress() for one-shot custom decoding. When decompressed_size() is large (e.g. > 256 KB), wrap the call in tokio::task::spawn_blocking (cloning compressed_bytes() into the closure) to avoid blocking the async runtime.
Example — full decode:
Example — streaming (memory-bounded):
Example — decompress for custom parsing:
The blob is only retained in memory if event handlers are registered. If no handlers are listening, the history sync pipeline extracts internal data (pushname, NCT salt, TC tokens) and discards the blob without allocating it for event dispatch.

HistorySyncStream

wacore::history_sync::HistorySyncStream iterates a compressed blob with bounded memory. At any point, only the current inflate window plus the largest single serialized conversation is resident — the full decompressed blob is never materialized.
Error variants relevant to streaming:

OfflineSyncPreview

Emitted: Preview of pending offline sync data when reconnecting
total is authoritative — the <ib><offline_preview> stanza’s own count attribute — and the per-kind counts are not guaranteed to sum to it. calls and statuses count the server’s call and status backlog attributes; a server that predates these fields leaves both at 0. Example:

OfflineSyncCompleted

Emitted: When offline sync completes after reconnection
Example:
Offline sync happens automatically when the client reconnects after being disconnected. The client tracks progress internally and emits these events to notify your application of sync status.If the server does not complete offline sync within 60 seconds, the client forces completion via a timeout fallback — OfflineSyncCompleted is still emitted with the count of items processed so far. This prevents startup from blocking indefinitely.

DirtyState

Emitted: When the server sends an <ib><dirty type="..." timestamp="..."> marker, telling the client one of its cached protocol domains is stale server-side.
Fields:
  • dirty_type - The stale domain, mirroring wacore::iq::dirty::DirtyType: AccountSync, Groups, SyncdAppState, NewsletterMetadata, or Other(String) for a wire value the client doesn’t otherwise recognize.
  • timestamp - Option<u64>, None if the <dirty> stanza omitted the timestamp attribute.
This is a pure observability hook — it does not replace or gate the client’s built-in handling. The client always sends the matching <clean> IQ (throttled behind offline-sync completion for Groups/NewsletterMetadata, per WAWebHandleDirtyBits) and, for SyncdAppState, re-syncs all app-state collections, exactly as it did before this event existed. DirtyState fires first, right before that built-in work starts, so a handler can refresh its own domain-specific derived state (e.g. invalidate a local groups cache) without parsing raw <ib> stanzas via RawNode or racing the client’s own resync.
Example:

AppStateSyncFailed

Emitted: When a batched app-state sync (fetching syncd collections like critical_block, regular_high) finishes without leaving every requested collection synced.
Fields:
  • fatal - Collections the server refused outright (the syncd IQ came back with an IQ-level error code such as 400/404, not an HTTP status). Terminal for the current connection — repeating the request on it gets the same answer — but not permanent: a fresh connection gets to try again.
  • retryable - Collections that didn’t sync but a later attempt can. The client retries these itself, backing off from 1 second and doubling (a theoretical one-hour cap that its round limit never lets it reach), for up to APP_STATE_RETRY_MAX_ROUNDS (8) rounds — about four minutes — before giving up and reporting one more AppStateSyncFailed for whatever is still unsynced. A handler doesn’t need to trigger a retry itself.
  • skipped - Collections another in-flight sync or patch send already held, so this particular sync did nothing for them. Not an error, and not itself re-queued into the retry schedule above — the equivalent work is happening elsewhere and will report its own outcome.
  • connected - Whether the client was already connected (or went on to dispatch Event::Connected) when this event fired, rather than an indicator of which bucket is non-empty. As of PR #1291, during the initial bootstrap it’s true for every outcome that reaches an answer — synced-with-gaps, fatal, retryable, or skipped, including a batch that failed transport-side before producing any per-collection buckets. It’s false when the client was paused, asked to disconnect, or the server rejected the session (429/503), between the sync finishing and the announcement: Connected is withheld but this event still fires, and the leftover collections still go to the background sync either way. If the connection’s generation was retired instead — a replacement connection already took over — neither event fires for this one at all; the replacement reports for itself once its own sync finishes. Outside the bootstrap, background syncs always run on an already-connected client, so connected is true there regardless of which buckets are populated.
Collections are identified by their wire name (critical_block, critical_unblock_low, regular_high, regular_low, regular) rather than an enum, so this payload stays stable if the set of collections changes.fatal is the bucket a consumer usually has to act on. WhatsApp Web treats a fatal critical_block failure as grounds to notify the primary device and log out; this library does not end a session on its own. Instead, during the initial connection bootstrap, a fatal critical_block outcome makes the client stop waiting on it, dispatch Event::Connected anyway, and then dispatch this event with connected: true — the account is usable but missing whatever that collection carries. A fatal outcome does not retry on its own connection (WhatsApp Web’s COMPANION_SYNCD_SNAPSHOT_FATAL_RECOVERY path is explicitly gated off for critical_block, and this client implements no alternative for it); the collection gets another chance only on the account’s next fresh connection. critical_block includes the setting_pushName mutation, so unless the push name was already known some other way (e.g. Bot::with_push_name, or a name learned earlier via history sync or a prior session), presence stays unavailable until that next connection syncs it. See Critical app-state sync (pairing bootstrap) for the full bootstrap flow.As of PR #1291, a retryable or skipped outcome during the bootstrap is no longer silent either: the client dispatches Connected and this event (connected: true) the same way it does for fatal, then hands the leftovers to the background sync that follows. Both buckets get one more attempt as part of that sync’s own batched request; whatever is still retryable after that enters the bounded backoff described above, and a skipped collection is handled the same way the skipped field description above does outside the bootstrap too. A handler that only reacted to fatal before should now also watch retryable/skipped if it needs to know the account is running in a degraded state, since both can now arrive alongside a Connected that announced a session missing its push name or blocklist.A background sync outside the bootstrap path (the ib dirty-resync handler, group server_sync notifications, periodic app-state resync) reports through this same event when it leaves collections unsynced, always with connected: true since the client was already connected before that sync ran. Only its retryable collections back off and retry automatically; any fatal collection it reports is subject to the same next-connection-only recovery as the bootstrap path.
Example:

Device Events

DeviceListUpdate

Emitted: When a user’s device list changes (a companion device is added, removed, or updated)
Fields: This event is dispatched after the client has already patched its internal device registry cache. You can use it to track when contacts pair or unpair companion devices. The client also uses device list changes internally to manage unknown device detection, Signal session cleanup, and sender key cache invalidation — when a device is added or removed, the sender key device cache is invalidated so SKDM is redistributed on the next group message.

IdentityChange

Emitted: When a contact reinstalls WhatsApp (their identity key changed). The event fires from two paths: an explicit server <identity/> notification, or a locally-detected change discovered while decrypting an incoming message. The implicit field distinguishes them.
Fields:
  • user — The phone number JID of the user whose identity changed
  • lid_user — The user’s LID JID, if provided in the notification
  • implicitfalse for server-pushed <identity/> notifications (full cleanup performed); true for locally-detected changes during decrypt (lighter cleanup, see below)
This event corresponds to WhatsApp Web’s WAWebHandleIdentityChange flow. When the server sends an <identity/> notification inside a type="encrypt" stanza, the client:
  1. Clears the device record for the user (deletes Signal sessions for all non-primary devices). Per-device sender key tracking is not wiped here — matching WhatsApp Web’s WAWebUpdateLocalSignalSession, SKDM redistribution is driven per-group/per-device by retry receipts (markForgetSenderKey), so a global wipe would empty the tracker too aggressively.
  2. Deletes the primary device session and identity key so a fresh session can be established (matching WhatsApp Web’s deleteRemoteInfo)
  3. Deletes the status@broadcast sender key for forward secrecy on the next status send (matching WhatsApp Web’s markStatusSenderKeyRotate)
  4. Invalidates the device registry cache so the next send triggers a fresh device list sync
  5. Dispatches this event so your application can show a “security code changed” notice
  6. Spawns a background ensure_e2e_sessions task to proactively re-establish the session (self-defers when the client is offline)
Additionally, when a message triggers an UntrustedIdentity error during decryption (indicating the sender reinstalled WhatsApp), the client:
  1. Clears the old identity key and retries decryption with the new identity, preserving the old session for in-flight messages
  2. Handles InvalidPreKeyId errors in the retry path by sending a retry receipt so the sender can establish a new session
  3. Re-issues TC tokens for the sender in the background (matching WhatsApp Web’s sendTcTokenWhenDeviceIdentityChange behavior) so the contact retains a valid privacy token
The notification is processed immediately even when received during offline sync, because all cleanup operations are local-only. The background session re-establishment self-defers via wait_for_offline_delivery_end when the client is offline.

Implicit (locally-detected) identity changes

The client also fires IdentityChange with implicit: true when decrypting a peer’s message replaces an existing identity key with a different one — for example, when a contact’s reinstall reaches you through an incoming message before the server <identity/> push arrives. This mirrors WhatsApp Web’s saveIdentityhandleNewIdentity flow. The implicit path is deliberately lighter than the server push:
  • Clears the device record (non-primary sessions + per-device sender key tracking)
  • Invalidates the device registry cache so the next send re-runs usync
  • Re-issues an active TC token if one exists
It does not delete the primary session, rotate the status@broadcast sender key, or proactively re-establish sessions — the in-flight message is already establishing a new session, and the heavier reset is handled when the server <identity/> push reliably follows.
Identity change notifications from companion devices (device ID != 0) and from your own JID are ignored on both paths — only primary device identity changes for other users are processed.
Example:

BusinessStatusUpdate

Emitted: When a business account status changes

Newsletter Events

NewsletterLiveUpdate

Emitted: When reaction counts change or messages are updated on a newsletter you’re subscribed to (via subscribe_live_updates).
Fields:
  • newsletter_jid — The newsletter channel this update is for
  • messages — List of messages with updated reaction counts
  • server_id — Server-assigned message ID
  • reactions — Current reaction counts (emoji code and count)
Example:
You must call client.newsletter().subscribe_live_updates(&jid) to receive these events. The subscription has a limited duration (typically 300 seconds) and must be renewed periodically.

Call Events

IncomingCall

Emitted: When the server delivers a <call> stanza — voice or video, 1-on-1 or group. Mirrors WhatsApp Web’s inbound call signaling.
group_jid: Some(...) on CallAction::Offer (below) is what distinguishes a group call offer from a 1:1 one; group on IncomingCall carries its roster snapshot. See Group calls and Call links in the VoIP guide for accepting one and attaching media.
GroupCallUpdate is the same authoritative roster/relay type CallHandle::group_state() exposes once you’ve joined (via GroupCallState::snapshot() — see Reading group state):
The action field is a tagged enum that mirrors the inner stanza child (<offer>, <offer_notice>, <preaccept>, <accept>, <reject>, <terminate>):
Behavior:
  • The router automatically acks every <call> stanza. For Offer it additionally sends an <receipt><offer/></receipt> so the caller’s UI advances past “ringing”.
  • OfferNotice is the server’s fan-out to other group members when a group call starts. No offer-receipt is sent — only the generic ack.
  • Use action.call_id() and action.call_creator() to access the common identifiers without matching every variant.
Detecting group calls:
group_jid on CallAction::Offer is the primary signal for distinguishing a group call from a 1-on-1 call (matches WhatsApp Web’s WAWebVoipGatingUtils). OfferNotice is the secondary signal for members who were not directly offered the call — for example, when you are a passive group member receiving the announcement that a call started.

Notification Events

DisappearingModeChanged

Emitted: When a contact changes their default disappearing messages setting. Sent by the server as a <notification type="disappearing_mode"> stanza.
Fields:
  • from - The contact whose disappearing messages setting changed
  • duration - New duration in seconds (0 = disabled, 86400 = 24 hours, 604800 = 7 days, etc.)
  • setting_timestamp - DateTime<Utc> indicating when the setting was changed (serialized as Unix timestamp in seconds)
You should only apply this update if setting_timestamp is newer than your previously stored value for this contact. This prevents out-of-order updates from overwriting newer settings.
Example:

Privacy events

DisableLinkPreviewsUpdate

Emitted: When the account-wide “disable link previews” setting changes via app-state sync on a linked device (setting_disableLinkPreviews)
Fields:
  • previews_disabled - true when link previews are now disabled. This event only fires when the wire carried the flag. WhatsApp Web treats a mutation with an absent flag as malformed, so no event fires for that case, rather than one carrying a default false.
  • timestamp - When the change occurred
  • action - The underlying app-state action
  • from_full_sync - Whether this came from a full app-state sync (initial load) or an incremental update
Example:
DisappearingModeChanged above is a server-push notification about another contact’s setting. DisableLinkPreviewsUpdate is different: it is app-state sync about your own account’s setting, changed from one of your own linked devices. See Privacy — App-state settings for the outbound API (set_link_previews_disabled) that emits this event on other devices.

Raw stanza events

RawNode

Emitted: The raw stanza received from the server. To receive this event, call client.set_raw_node_forwarding(true) to enable dispatch and include EventKind::RawNode in your handler’s interest(). When forwarding is disabled or no handler wants RawNode, the bus skips this dispatch entirely (zero overhead on the hot path).
This is a library extension with no WhatsApp Web equivalent. It gives you access to every raw decoded stanza before any routing or parsing occurs. The OwnedNodeRef uses yoke-based zero-copy decoding, so string and byte payloads are borrowed directly from the network buffer without allocation. Example:
RawNode is skipped during serialization (#[serde(skip)]). Enable it only when debugging or building protocol-level tooling, as it dispatches for every incoming stanza.

Decrypted payload events

DecryptedPayload

Emitted: One decrypted <enc> payload, after unpadding and before it is decoded into a wa::Message. To receive this event, hold a lease from client.acquire_decrypted_payload_forwarding() and include EventKind::DecryptedPayload in your handler’s interest(). While no lease is held, nothing is emitted and nothing is cloned.
Fields:
  • info — Which message this came from.
  • enc_index — Which <enc> of the stanza produced these bytes, counting from zero in the order the client enumerates them: the stanza’s direct <enc> children first, then the ones under <participants><to> addressed to this device (the fan-out shape, where one stanza carries a copy per device and only yours is yours to decrypt). This is a position in that concatenation, not a child index or a position within enc_type’s bucket — an <enc> that produces no payload still consumes its slot, so a consumer correlating a forwarded payload back to its node has to walk the stanza the same way.
  • enc_type — The type attribute the <enc> carried: msg, pkmsg, skmsg, …
  • payload — The plaintext, unpadded, exactly as decoding receives it. A Bytes, so forwarding it is a refcount bump, not a copy.
This is a library extension with no WhatsApp Web equivalent. It exists because a plaintext that decrypts but fails to decode is otherwise lost: handle_decrypted_plaintext turns bytes into wa::Message, and when that decode fails — a field a build predates, a message type it doesn’t model — the bytes disappear. Nothing can ask for them again, because opening them already consumed state that won’t recur: the Signal ratchet advances, so the same ciphertext will never decrypt a second time. DecryptedPayload fires whether or not the decode that follows succeeds, which is the point: the failing case is the one with nothing else to look at. It also enables recording traffic for faithful replay (re-encoding a decoded Message does not reproduce the original bytes) and decoding with a newer protobuf than the running build carries. It’s also emitted on the bot-message-secret path (msg_secret.rs), ahead of the same decode, where the secret a message_secret payload was opened with is single-use rather than ratchet-advanced — the same “cannot be asked for again” property, for a different reason. Example:
payload is skipped during serialization (#[serde(skip)]) — like RawNode, Serialize on an event is for diagnostics, and no text format carries raw bytes without an encoding choice this type has no business making.
See acquire_decrypted_payload_forwarding for the lease API.

Sent frame events

SentFrame

Emitted: One marshaled stanza, exactly as it was handed to the noise frame encryption, after the transport accepts the write. To receive this event, hold a lease from client.acquire_sent_frame_forwarding() and include EventKind::SentFrame in your handler’s interest(). While no lease is held, nothing is emitted and nothing is cloned.
Fields:
  • plaintext — The marshaled stanza, keeping the leading format byte the binary protocol writes, so decoding it is wacore_binary::marshal::unmarshal_packed_ref(&plaintext). This is the plaintext handed to noise encryption, not a transport frame — the length prefix and the AEAD tag are added after it, and only SessionStats (see WebSocket & Noise Protocol Handling) accounts for those. A Bytes, so forwarding it is a refcount bump, not a copy.
This is the outbound counterpart of RawNode and a library extension with no WhatsApp Web equivalent. Before it existed, the send side had no observer at all: wait_for_sent_node is a filtered one-shot waiter for a single expected stanza, and it only ever sees stanzas that pass through the marshal-and-send path, so the paths that hand pre-marshaled bytes straight to the socket — acks, delivery receipts, direct-encoded IQs — were invisible even to that. SentFrame is emitted from the noise sender task, the single point every send path crosses (including the paths above and the coalesced-burst writes the ack and receipt workers use), so it covers all of them from one place. It exists for recording a session for replay, asserting the wire form in an integration test, and reading back a stanza the server rejected without rebuilding with logging on. Handshake frames are pre-noise and are not covered, and neither are VoIP relay sockets, which — like SessionStats — receive no observers at all. Example:
plaintext is skipped during serialization (#[serde(skip)]) — like RawNode and DecryptedPayload, Serialize on an event is for diagnostics, and no text format carries raw bytes without an encoding choice this type has no business making.
See acquire_sent_frame_forwarding for the lease API, and WebSocket & Noise Protocol Handling for how SendObservers wires it into the noise sender.

Enc decrypt failure events

EncDecryptFailed

Emitted: One <enc> that did not produce a usable message, and why — the failing half of what DecryptedPayload reports for the succeeding half, at the same granularity (per <enc>, not per message) and under the same numbering (enc_index comes from the same enumeration as DecryptedPayload::enc_index, so the two events index one stanza and not two). To receive this event, hold a lease from client.acquire_enc_decrypt_failed_forwarding() and include EventKind::EncDecryptFailed in your handler’s interest(). While no lease is held, nothing is emitted and nothing is built.
Fields:
  • info — Which message this <enc> belongs to.
  • enc_index — Which <enc> of the stanza this was, counting from zero in the order the client enumerates them — the stanza’s direct <enc> children first, then the ones under <participants><to> addressed to this device. Not a child index.
  • enc_type — The type attribute the <enc> carried: msg, pkmsg, skmsg, … None only when the node carried no type attribute at all — the one thing MalformedNode can mean here that a present type does not.
  • reason — Where the client stopped. See EncDecryptFailureReason below.
This is a library extension with no WhatsApp Web equivalent — WhatsApp’s own client does not surface this. Reasons to want it: attributing a failure inside a fan-out (a stanza can carry one <enc> per device), driving a retry or resync policy off the specific reason, and measuring session health per peer rather than per message.

EncDecryptFailureReason

Why one <enc> produced no plaintext. This is the client’s own classification of where it stopped, not something the server sends and not a statement about the sender’s copy. It is #[non_exhaustive] — a match needs a _ arm, since new branches append new variants as the receive path is refined.
EncDecryptFailureReason::decryption_was_attempted(self) -> bool reports whether the client entered its decryption path at all — false for MalformedNode, UnsupportedEncType, and NotAttempted; true for every other variant, spanning everything from an envelope that wouldn’t parse to a MAC that wouldn’t verify.

What it does not say

  • Not a display signal. Whether to show the user a placeholder is UndecryptableMessage, which is per message, deduplicated by (chat, id), and carries the server’s decrypt-fail hint. EncDecryptFailed is per <enc>, is not deduplicated, and answers a different question.
  • Not a loss report. Most reasons are recoverable — the client may already have asked the sender to resend — and this event says nothing about whether a retry went out or succeeded later.
  • Repeats. A redelivered stanza that fails again emits it again, once per <enc> per delivery. Correlate on (info.source.chat, info.source.sender, info.id, enc_index) if you want at-most-once per <enc>info.id alone is not globally unique, only within a (chat, sender) pair (see Idempotency Requirement).
  • A duplicate is not a failure. An <enc> the server redelivered that this device already processed emits neither this event nor DecryptedPayload — its plaintext was reported the first time round. A stanza whose only duplicate <enc> sits beside one that genuinely fails still reports that other <enc> as NotAttempted, on every delivery, since no delivery ever produced its plaintext.
  • Order is enc_index, not arrival. The client decrypts a stanza’s <enc> nodes in per-kind passes (session, then group, then bot), so neither these events nor DecryptedPayloads arrive in stanza order, and a failure for a later <enc> can precede a success for an earlier one.
Example:
See acquire_enc_decrypt_failed_forwarding for the lease API.

Event handler patterns

Bot builder pattern

Delivery order and backpressure

Closures registered via on_event, on_event_for, on_message, and the other typed registrars are bridged onto the CoreEventBus by an internal adapter with a configurable delivery strategy, set via BotBuilder::with_event_delivery:
  • EventDelivery::Concurrent (default) — each event is fanned out to every interested callback on its own spawned task. A slow callback never stalls the bus or its siblings, but ordering across events is not guaranteed, and a persistently slow consumer can accumulate unbounded in-flight tasks.
  • EventDelivery::Ordered { capacity } — events are handed to a single drainer task through a bounded mailbox and delivered to callbacks strictly in arrival order (within an event, interested callbacks run in registration order). This mirrors the ordered messages.upsert contract of WA Web (preserveOrder: true), whatsmeow, and Baileys. When the mailbox is full the event is dropped — counted in StatsSnapshot::events_dropped — instead of backpressuring the receive pipeline or growing without bound. A panicking callback is caught and logged; the drainer keeps running and later events still get delivered.
Struct-based handlers registered with with_event_handler (or client.register_handler) always run handle_event inline on the dispatch path — EventDelivery only governs the closure-based registrars.
Ordered trades throughput and drop-under-load for a stronger ordering guarantee. If dropped events are unacceptable, pair it with an inbound durability hook for at-least-once redelivery — the hook’s buffering is independent of the delivery mailbox.

Multiple Handlers

ChannelEventHandler

ChannelEventHandler is a built-in event handler that forwards events to an async_channel for async consumption. It uses async-channel (runtime-agnostic) instead of Tokio channels, so it works with any async executor — including WASM targets. Events are buffered in an unbounded channel, so events fired before the receiver starts listening are not lost.
This is particularly useful for:
  • Testing — assert on specific event sequences without closures
  • Custom event loops — process events in your own async task with full control over ordering
  • Runtime-agnostic code — no dependency on Tokio’s mpsc channels
ChannelEventHandler::new() returns (Arc<ChannelEventHandler>, async_channel::Receiver<Arc<Event>>). The handler is already wrapped in Arc for direct use with client.register_handler(). The receiver yields Arc<Event>, so use &*event or event.as_ref() to pattern-match.

Custom async event handlers

For custom channel-based patterns, you can implement EventHandler directly:
Since events are dispatched as Arc<Event>, you can forward them to channels without any cloning overhead.

Performance Optimization

LazyHistorySync

Purpose: Avoid parsing large protobuf blobs unless needed. The compressed payload is stored as reference-counted Bytes, and full protobuf decoding only happens if your code calls get(). See the HistorySync event reference for the complete API.
Cloning: Clone is a refcount bump on the compressed buffer. No decode cache is carried over — each clone re-inflates independently on demand. Usage:

Arc<Event> dispatch

With Arc<Event> dispatch, each event is wrapped in a single Arc by the CoreEventBus and shared across all handlers. This eliminates deep clones of large event payloads like LazyHistorySync blobs and Messages(MessageBatch). Both the wa::Message body and the MessageInfo inside each InboundMessage are Arc-wrapped, enabling zero-cost sharing across the message dispatch, durability hook, retry receipt, and PDO recovery paths without cloning the full struct — the batch handed to a registered durability hook is the very same Arc<[InboundMessage]> this event carries. Combined with LazyHistorySync’s OnceLock, all handlers sharing the same Arc<Event> get parse-once semantics for free — the first handler to call lazy_sync.get() triggers the decode, and subsequent handlers reuse the cached result.

Best Practices

Event Filtering

Error Handling

Spawning Tasks

Architecture

Understand the event bus system

Authentication

Learn about pairing events

Sending messages

Sending and receiving messages

Client API

Complete client API reference