GET /devices and GET /devices/{id}

GET /devices

Lists the numbers your account rents, newest first. A rental you can actually use — active or past_due — reports its full number; an unpaid reservation or a released rental reports the masked form and nothing else about the session or its branding.

Scope	read
Auth	Authorization: Bearer mk_live_…
Query params	none
Pagination	none

{
  "ok": true,
  "devices": [{
    "id": "gwd_…", "label": "Studio", "number": "+6281234567890",
    "plan": "Reserved monthly", "status": "active", "term": "monthly",
    "currency": "IDR", "priceMinor": 149000, "autoRenew": true,
    "currentPeriodEnd": "2026-10-28T00:00:00.000Z",
    "pushName": "Studio Support", "hasAvatar": true,
    "connection": { "state": "connected", "isConnected": true, "isLoggedIn": true, "missingSince": null }
  }]
}

Every rental status appears here, including suspended and cancelled ones. What a row carries depends on the status, because the number and its session are only yours while you may use them:

status	number	pushName, hasAvatar	connection
active, past_due	Full +E.164, such as +6281234567890	The branding you set	The observed session state
pending_payment, suspended, cancelled, expired	The display mask (+, first two digits, ••• •••, last four)	null, false	Every field null

number alone is null when there is no readable JID or too few digits to render either form. The full number is the one you are paying for and is never the mask while the rental is usable — use it anyway to call your own users back, and keep addressing the device by its id in API calls.

Errors

HTTP	Code
401	api_key_invalid / api_key_revoked / api_key_expired
403	api_key_scope_denied (needs read), forbidden (account inactive)
500	server_error

---

GET /devices/{id}

Reads one device with its rental terms and its webhook settings.

Scope	read and an active or past_due rental for this device
Path	id — the MauKirim device id (gwd_…)

{
  "ok": true,
  "device": { "id": "gwd_…", "label": "Studio", "number": "+6281234567890",
              "pushName": "Studio Support", "hasAvatar": true,
              "connection": { "state": "connected", "isConnected": true, "isLoggedIn": true,
                              "lastSeenAt": "2026-09-28T13:04:00.000Z", "missingSince": null } },
  "rental": { "id": "rnt_…", "status": "active", "term": "monthly", "currency": "IDR",
              "priceMinor": 149000, "includedMessages": 2000, "autoRenew": true,
              "startedAt": "2026-09-28T00:00:00.000Z", "currentPeriodEnd": "2026-10-28T00:00:00.000Z" },
  "webhook": { "id": "rwh_…", "deviceId": "gwd_…", "url": "https://…", "events": ["message"],
               "active": true, "createdAt": "…", "updatedAt": "…" }
}

Only an active/past_due rental reaches this route, so device.number here is always the full +E.164 number, never the list’s mask. webhook is the destination this account set, or null when there is none — including when the stored destination belongs to a previous renter of the same number, which is never returned — and it never includes the signing secret.

Errors

HTTP	Code	Condition
404	rental_not_found	No active/past_due rental for this device and this account. Identical for “not yours” and “does not exist” — the API never confirms that a device id is real.
404	device_not_found	The rental exists but the device row is gone
401/403	auth codes	As above
500	server_error	Unexpected