WITHMIA v1.0.5 — Security, Quality and Invoicing

Note (July 2026): the Business and Enterprise plans are now called Team and Max. Prices are unchanged.

v1.0.4 built a sustainable financial model. v1.0.5 reinforces the foundations: API protection, automated code quality, and professional invoicing. This release turns WITHMIA into a platform ready to scale with confidence.

Rate limiting: protection on every route

Every API route is now protected with granular rate limiting. Six different limiters, depending on the type of operation:

Limiter	Protected routes	Limit
api	Profile, tickets, channels, knowledge base, settings	60 req/min
chatwoot-proxy	Real-time conversation and message proxy	120 req/min
evolution	WhatsApp instances (Evolution API)	60 req/min
integrations	Calendar, products, sales, external integrations	60 req/min
billing	Subscriptions, checkout, overage, invoices	20 req/min
admin	Admin panel	30 req/min

Why it matters

Without rate limiting, a single bad actor (or a bug in a client) can saturate the entire API. With this protection in place:

• Abuse prevention — bots and scrapers can’t hammer the endpoints
• Stability under load — the API responds predictably even during traffic spikes
• Financial protection — the billing endpoint is extra-guarded at 20 req/min
• Chatwoot optimized — the chat proxy gets the highest limit (120 req/min) because it’s real-time

Each limiter applies per authenticated user, or per IP for public requests. Responses include the standard X-RateLimit-Limit, X-RateLimit-Remaining and Retry-After headers.

CI/CD: automated deployment with GitHub Actions

WITHMIA now has a full continuous integration and deployment pipeline. Every push to main automatically triggers:

Backend (PHP)

• PostgreSQL 16 + Redis 7 as pipeline services
• Dependency installation with Composer
• The entire test suite run with Pest
• Isolated test environment variables

Frontend (TypeScript/React)

• Dependency installation with npm
• ESLint — style and error checks
• TypeScript — type checking across the whole project
• Build — a full compile to make sure everything resolves

Deploy

• Automatic deployment to Railway, from the main branch only
• Protected with the RAILWAY_TOKEN secret
• Only runs if the tests and the build pass

If a test fails or TypeScript catches a type error, the deploy is blocked automatically. Zero chance of shipping broken code to production.

Automated tests with Pest

WITHMIA’s first automated test suite, covering the most business-critical pieces:

Unit tests

• CurrencyService — currency detection by country, gateway routing (Flow for CLP, dLocal for the rest), correct local pricing
• BillingConfig — plan structure (Free, Pro, Business, Enterprise), overage pricing, Flow and dLocal configuration, annual discount validation
• OverageService — price per pack, cost calculation based on the number of messages exceeded

Feature tests

• API endpoints — health check, authentication guards, working throttling, 404 handling
• Models — creating User, Company and Subscription with factory patterns

Every test runs against a clean PostgreSQL database thanks to RefreshDatabase, keeping the suite independent and reproducible.

A complete referral system

The referral system goes from an empty stub to a full implementation:

How does it work?

1. Your company generates a code — format WM-XXXXXX (6 alphanumeric characters)
2. You share the code with another company
3. The other company applies it when subscribing and gets 10% off for 3 months
4. You accumulate referrals — the system tracks how many times your code has been used

Business rules

• You can’t use your own code (self-referral prevention)
• A code can’t be applied twice by the same company
• The discount is configurable: percentage, number of months, maximum uses
• Codes can have an expiry date
• Only companies on an active plan can generate codes

New endpoints

• GET /api/subscription/referral-code — get or generate your company’s code
• POST /api/subscription/apply-referral — apply a referral code (it already existed as a stub, now it actually works)

Professional PDF invoicing

A new invoice generation system with WITHMIA branding:

Invoice model

• Automatic numbering — format WM-YYYY-XXXXX (e.g. WM-2026-00001)
• VAT calculation — 19% automatically for CLP payments
• Itemized lines — concept, plan, billing cycle
• Relationships — linked to Company and Subscription

Automatic invoice generation

Invoices are created automatically when a payment is confirmed, with no user intervention:

• Flow.cl — on payment confirmation in the webhook (status === 2)
• dLocal — on payment confirmation in the dLocal webhook
• Flow Subscription — on every recurring renewal (flagging whether it’s the first invoice or a renewal)

Every invoice records the payment method, transaction reference, amount, currency and tax breakdown.

PDF download

The InvoiceService generates a polished HTML document with:

• WITHMIA logo and branding with gold accents (#FFD700)
• Issuer and recipient company details
• An items table with subtotal, VAT and total breakdown
• Payment information: method, reference, date
• A responsive design optimized for printing

If dompdf is installed, it produces a real PDF. If not, it serves a print-friendly HTML version with window.print() built in.

New endpoints

• GET /api/subscription/invoices — list of the company’s last 50 invoices
• GET /api/subscription/invoices/{id}/pdf — download an invoice as PDF/HTML

Technical summary

Change	Files	Impact
Rate limiting	AppServiceProvider + routes/api.php	6 limiters, 18+ route groups
CI/CD	.github/workflows/ci.yml + .env.ci	3 jobs (backend, frontend, deploy)
Tests	5 files in tests/	23+ test cases (unit + feature)
Referrals	2 models + migration + controller	Complete system
Invoices	Invoice model + InvoiceService + migration	Auto-created from webhooks

What’s next

With the quality infrastructure in place, the Q2 2026 roadmap focuses on high-impact features:

• PWA / mobile app — the priority for a mobile-first LATAM
• CSAT surveys — a feature every competitor already has
• AI resolution analytics — resolution metrics for the AI
• WhatsApp broadcasting — mass campaigns

WITHMIA v1.0.5 isn’t the flashiest update — but it’s the one that lets you sleep at night. Tested code, protected API, automatic invoices.

Open WITHMIA → Try it free at app.withmia.com →