SuperdindaDocs
Channels

Answer the code shown on the phone

POST
/seats/{uid}/pairing/passkey

WhatsApp sometimes puts a number on the dependent's phone and links the device only once someone says it matches. Nothing else moves the pairing past that point. matches: false ends the pairing as passkey_refused — the numbers differ only when another device is being linked. Owner only.

Authorization

Bearer
headerAuthorizationBearer <JWT>

Path Parameters

uid*string

seat uid

Formatuuid

Request Body

application/json
  1. body
matches*boolean

true when the number on the dependent's phone is the one we showed; false ends the pairing, because a mismatch means another device is being linked

Response Body

The pairing: the code cleared when it matched, ended when it did not

application/json
  1. response
success*true
Value intrue
data*
Example Request
curl -X POST 'http://localhost:3000/seats/497f6eca-6276-4993-bfeb-53cbbbba6f08/pairing/passkey' \  -H 'Content-Type: application/json' \  -d '{  "matches": true}'
Example Response
{  "success": true,  "data": {    "uid": "string",    "channel": "whatsapp",    "status": "starting",    "method": "qr",    "challenge": {      "kind": "qr",      "image": "string",      "mime": "string",      "expiresAt": "2019-08-24T14:15:22Z"    },    "challengeShownTo": "guardian",    "identity": {      "phone": "string",      "pushName": "string",      "avatarUrl": "string"    },    "reconnectAttempts": 0,    "nextRetryAt": "2019-08-24T14:15:22Z",    "failureReason": "string",    "pairedAt": "2019-08-24T14:15:22Z",    "lastSeenAt": "2019-08-24T14:15:22Z",    "endedAt": "2019-08-24T14:15:22Z",    "createdAt": "2019-08-24T14:15:22Z"  }}

The dependent's profile picture GET

The bytes of the dependent's own WhatsApp profile picture, copied into our storage when the pairing connected. Served here because the provider's own link is on WhatsApp's CDN: it expires and is not the browser's to follow. 404 whenever there is none — many people hide their picture, and the screen falls back to initials. Never a contact's picture: those people never consented.

Consent request (public) GET

What the dependent sees: who is asking, what will be accessed, the statement to read. Records that the link was opened. Limits: RATE_CONSENT_READ_PER_LINK / _PER_IP (default 120 and 600 per 10 min), shared with Minha proteção.