The dependent's profile picture
The bytes of the dependent's own WhatsApp profile picture, copied into our storage when the pairing connected. Served here because the provider's own link is on WhatsApp's CDN: it expires and is not the browser's to follow. 404 whenever there is none — many people hide their picture, and the screen falls back to initials. Never a contact's picture: those people never consented.
BearerAuthorizationBearer <JWT>uid*stringseat uid
uuidThe picture
response?stringimage/*raw image bytes
curl -X GET 'http://localhost:3000/seats/497f6eca-6276-4993-bfeb-53cbbbba6f08/pairing/avatar'"string"Fetch a fresh QR/code POST
On demand; the workers also refresh it on a timer and push it through SSE. With `?method=qr`, takes over a pairing the dependent was doing by code on their own phone (the fallback "Vocês estão juntos agora?"): same session, a QR on this screen, the code stops working. Owner only.
Answer the code shown on the phone POST
WhatsApp sometimes puts a number on the dependent's phone and links the device only once someone says it matches. Nothing else moves the pairing past that point. `matches: false` ends the pairing as `passkey_refused` — the numbers differ only when another device is being linked. Owner only.