Legacy Cloud API

Authentication

The External Cloud API supports API key authentication only: every request needs API credentials and a whitelisted caller IP. OAuth 2.0 Bearer tokens are not accepted here — use API v1 for OAuth 2.0 (Connect with Washeej).

Headers

Header	Description
`client-id`	Public client identifier from Developer Tools. Alias: `X-Api-Key`.
`client-secret`	Secret key — never ship it in browser code. Alias: `X-Api-Secret`.

IP whitelist required Requests from IPs not listed under Developer Tools → IP Whitelist are rejected with 401 (remark Unauthorized). If your IP is not whitelisted, the 401 response message shows the IP Washeej sees; add that IP under Developer Tools → IP Whitelist.

curl -H "client-id: YOUR_CLIENT_ID" \
     -H "client-secret: YOUR_CLIENT_SECRET" \
     https://staging-mobile.washeej.com/external-api/inbox/conversation-list

Response shape

Legacy responses use remark, status, message, and data. API v1 uses the ok / data / meta envelope — see v1 Response Format.

Legacy endpoints may return errors with HTTP 200 (e.g. validation_error, subscription_required, not_available, user_error); always check status and remark, not only the HTTP code.

Rate limit: 120 requests / minute / account, shared with /v1. Exceeding it returns 429 rate_limit_exceeded with Retry-After: 60.