Authentication

curl -H "X-Api-Key: YOUR_API_KEY" \
     -H "X-Api-Secret: YOUR_API_SECRET" \
     https://staging-mobile.washeej.com/device-api/v1/instances

• Send credentials in headers only. Credentials in the query string are rejected with 401 query_secret_rejected.
• The caller IP must be on Developer Tools → IP Whitelist, otherwise 401 ip_not_whitelisted.
• OAuth 2.0 (Connect with Washeej) Bearer tokens are not accepted here; they work on API v1 only.

instance_id

Besides the API key, Device API calls name the Device (QR) number they act on with instance_id: the ID of one Device (QR) number used with API key authentication. It is the device ID the number was first linked with, and it never changes afterwards, even when the WhatsApp service re-keys the device; calls also accept the current GOWA device ID.

• Find it in the Washeej dashboard → the Device number's page → Device status panel → Instance ID, or in the Developer platform → Device (QR) numbers: instance IDs. Both show the value every /device-api/v1 endpoint accepts.
• Or call GET /device-api/v1/instances (scope devices:read).
• Message endpoints also accept the GOWA device id (webhook device_id); instance endpoints accept only instance_id.
• API v1 does not use instance_id: it uses the numeric channel id from GET /v1/devices.

Scopes

GET /instances, GET /instances/{instance_id} and /status: devices:read. Create, delete, reconnect: devices:manage. GET /instances/{instance_id}/qr: devices:manage or qr:generate. All /messages/* send endpoints: messages:send; GET /messages/{message_id}/status: messages:read or messages:send. Missing scope → 403 insufficient_scope.

Rate limit

100 requests per minute per account, a separate bucket from the 120 / minute shared by /v1 and /external-api. Exceeding it returns 429 rate_limit_exceeded (no Retry-After header — wait about a minute).