This phone's pairing (public)
The open pairing, else the last one (its failure explains it), else null. Same gates as POST.
token*stringthe opaque token from the link
16 <= length <= 4096The pairing as this page shows it
application/json- response
success*truetruedata*curl -X GET 'http://localhost:3000/consent-requests/stringstringstri/pairing'{ "success": true, "data": { "phoneMasked": "string", "pairing": { "status": "starting", "method": "qr", "challengeShownTo": "guardian", "challenge": { "kind": "code", "code": "string", "expiresAt": "2019-08-24T14:15:22Z" }, "failure": "expired", "pairedAt": "2019-08-24T14:15:22Z", "endedAt": "2019-08-24T14:15:22Z" } }}Stop protection (public) POST
Ends monitoring for the seat through `stopMonitoring(seat, { kind: "dependent" })`: an open-ended stop only a new consent lifts, the seat's key destroyed (stored messages and alert excerpts become unreadable), unread analysis windows dropped, imports failed, the WhatsApp session logged out. The consent becomes `revoked` by the dependent, and every guardian of the account is told the fact and the time — never a reason (event `seat.stopped { cause: "dependent" }`, notification `consent.stopped`). A new link cannot be sent for CONSENT_RESEND_COOLDOWN_HOURS. Idempotent: stopping again answers the first stop. `token` is either the consent link token or the stop link token (`protectionLink`, returned when consent is given). Either works while its consent is the seat's current one. Limits: reading RATE_CONSENT_READ_PER_LINK / _PER_IP (default 120 and 600 per 10 min), stopping RATE_CONSENT_WRITE_PER_LINK / _PER_IP (default 10 and 30 per hour) — shared with decline.
Pair this phone by code (public) POST
After consent is given on this link: opens (or resumes) a WhatsApp pairing whose 8-character code is shown only here, never to the guardians. The person types it in WhatsApp → Aparelhos conectados → Conectar com número de telefone. Idempotent: while a code is valid the same one comes back; an attempt that ran out is replaced; a pairing the guardian opened with a QR is switched to the code. The code may arrive a moment later — read GET …/pairing or the stream GET …/events. Needs the guardian to have enabled WhatsApp on the seat. No body.