SuperdindaDocs
Consents

Answer WhatsApp's number check (public)

POST
/consent-requests/{token}/pairing/passkey

When challenge.kind is passkey_confirm: does the number WhatsApp shows match? false ends the pairing (failure: passkey_refused) — a mismatch means another device is being linked.

Path Parameters

token*string

the opaque token from the link

Length16 <= length <= 4096

Request Body

application/json
  1. body
matches*boolean

true when the number on the dependent's phone is the one we showed; false ends the pairing, because a mismatch means another device is being linked

Response Body

The pairing as this page shows it

application/json
  1. response
success*true
Value intrue
data*
Example Request
curl -X POST 'http://localhost:3000/consent-requests/stringstringstri/pairing/passkey' \  -H 'Content-Type: application/json' \  -d '{  "matches": true}'
Example Response
{  "success": true,  "data": {    "phoneMasked": "string",    "pairing": {      "status": "starting",      "method": "qr",      "challengeShownTo": "guardian",      "challenge": {        "kind": "code",        "code": "string",        "expiresAt": "2019-08-24T14:15:22Z"      },      "failure": "expired",      "pairedAt": "2019-08-24T14:15:22Z",      "endedAt": "2019-08-24T14:15:22Z"    }  }}

Pair this phone by code (public) POST

After consent is given on this link: opens (or resumes) a WhatsApp pairing whose 8-character code is shown only here, never to the guardians. The person types it in WhatsApp → Aparelhos conectados → Conectar com número de telefone. Idempotent: while a code is valid the same one comes back; an attempt that ran out is replaced; a pairing the guardian opened with a QR is switched to the code. The code may arrive a moment later — read GET …/pairing or the stream GET …/events. Needs the guardian to have enabled WhatsApp on the seat. No body.

This phone's pairing events (public SSE) GET

Server-Sent Events, authenticated by the link itself. Each `event: event` frame's `data` is `{ type, occurredAt, pairing }` where `pairing` is the whole PublicPairing after the change — replace the page's state with it. Types: `pairing.started`, `pairing.challenge` (a new code), `pairing.status`, `pairing.paired`, `pairing.ended`. `id` is the stream position for Last-Event-ID. A `ping` every 5s. Same gates as POST …/pairing.