curl --request POST \
--url https://{host}/v1/me/devices \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "devices",
"attributes": {
"platform": "ios",
"pushToken": "8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f",
"appVersion": "2.4.0",
"name": "iPhone 15 Pro",
"locale": "nl"
}
}
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'devices',
attributes: {
platform: 'ios',
pushToken: '8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f',
appVersion: '2.4.0',
name: 'iPhone 15 Pro',
locale: 'nl'
}
}
})
};
fetch('https://{host}/v1/me/devices', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/me/devices",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'devices',
'attributes' => [
'platform' => 'ios',
'pushToken' => '8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f',
'appVersion' => '2.4.0',
'name' => 'iPhone 15 Pro',
'locale' => 'nl'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/me/devices"
payload = { "data": {
"type": "devices",
"attributes": {
"platform": "ios",
"pushToken": "8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f",
"appVersion": "2.4.0",
"name": "iPhone 15 Pro",
"locale": "nl"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "devices",
"id": "3",
"attributes": {
"platform": "ios",
"apnsEnvironment": "production",
"appId": "eu.wristler.app",
"appVersion": "1.4.0",
"name": "iPhone 15 Pro",
"locale": "nl",
"lastSeenAt": "2026-09-23T06:00:00.000000Z",
"createdAt": "2026-05-14T16:22:00.000000Z",
"updatedAt": "2026-09-23T06:00:00.000000Z"
},
"links": {
"self": "https://api.wristler.eu/v1/me/devices/3"
}
}
}{
"data": {
"type": "devices",
"id": "3",
"attributes": {
"platform": "ios",
"apnsEnvironment": "production",
"appId": "eu.wristler.app",
"appVersion": "1.4.0",
"name": "iPhone 15 Pro",
"locale": "nl",
"lastSeenAt": "2026-09-23T06:00:00.000000Z",
"createdAt": "2026-05-14T16:22:00.000000Z",
"updatedAt": "2026-09-23T06:00:00.000000Z"
},
"links": {
"self": "https://api.wristler.eu/v1/me/devices/3"
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Register device
Scope: account:write
{ "data": { "type": "devices", "attributes": {
"platform": "ios", "pushToken": "…", "appId": "eu.wristler.app", "appVersion": "2.3.1",
"name": "Jeffrey iPhone", "locale": "nl" } } }
platform (ios or android) and pushToken (up to 255 characters) are
required. appId (up to 100: letters, digits, ., _, -), appVersion (up to
32), name (up to 255) and locale (up to 8) are optional, and so is apnsEnvironment — production, sandbox or development
(stored and answered as sandbox) — which says which APNs gateway an iOS token
belongs to. Left out, the server finds out on the first push and fills it in; it is
null until then. lastSeenAt is read-only.
Registering is an upsert, not a create. The app has no durable handle on a
registration: it is reinstalled, restored onto a new phone, or simply handed a
fresh token, and in none of those cases does it know the id we gave it last
time. So the push token decides — the same token updates the row it already
owns (200), a new one creates a row (201).
A token that already belongs to another user is taken over rather than refused. The token addresses a handset, and whoever signed in on it last is who should receive its notifications; leaving it where it was would push the previous owner’s alerts to a phone that is no longer theirs.
pushToken is write-only and never comes back in a response: the app already
has it, and anything else reading it could push to somebody else’s device.
curl --request POST \
--url https://{host}/v1/me/devices \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "devices",
"attributes": {
"platform": "ios",
"pushToken": "8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f",
"appVersion": "2.4.0",
"name": "iPhone 15 Pro",
"locale": "nl"
}
}
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'devices',
attributes: {
platform: 'ios',
pushToken: '8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f',
appVersion: '2.4.0',
name: 'iPhone 15 Pro',
locale: 'nl'
}
}
})
};
fetch('https://{host}/v1/me/devices', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/me/devices",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'devices',
'attributes' => [
'platform' => 'ios',
'pushToken' => '8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f',
'appVersion' => '2.4.0',
'name' => 'iPhone 15 Pro',
'locale' => 'nl'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/me/devices"
payload = { "data": {
"type": "devices",
"attributes": {
"platform": "ios",
"pushToken": "8f3a1c9e1d6b4a7f9c2e5d8b1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f",
"appVersion": "2.4.0",
"name": "iPhone 15 Pro",
"locale": "nl"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "devices",
"id": "3",
"attributes": {
"platform": "ios",
"apnsEnvironment": "production",
"appId": "eu.wristler.app",
"appVersion": "1.4.0",
"name": "iPhone 15 Pro",
"locale": "nl",
"lastSeenAt": "2026-09-23T06:00:00.000000Z",
"createdAt": "2026-05-14T16:22:00.000000Z",
"updatedAt": "2026-09-23T06:00:00.000000Z"
},
"links": {
"self": "https://api.wristler.eu/v1/me/devices/3"
}
}
}{
"data": {
"type": "devices",
"id": "3",
"attributes": {
"platform": "ios",
"apnsEnvironment": "production",
"appId": "eu.wristler.app",
"appVersion": "1.4.0",
"name": "iPhone 15 Pro",
"locale": "nl",
"lastSeenAt": "2026-09-23T06:00:00.000000Z",
"createdAt": "2026-05-14T16:22:00.000000Z",
"updatedAt": "2026-09-23T06:00:00.000000Z"
},
"links": {
"self": "https://api.wristler.eu/v1/me/devices/3"
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Authorizations
Headers
Optional. A UUID per logical operation, not per attempt: a retry carrying the same key gets the first attempt's answer back, headers and all, rather than performing the write twice. Honoured for 24 hours.
A refusal is an answer. A 422 is remembered like any other, so sending a
corrected body under the same key answers 422 idempotency_key_reuse rather
than accepting the correction — the point of a key is that one key means one
decision. Use a new key for a new attempt at the request, and keep the old one
only for retrying the same bytes after a timeout.
A 5xx is the exception: nothing was decided, so the key is released and the
same one may be retried.
| Refusal | Status | code |
|---|---|---|
| The same key with a different body | 422 | idempotency_key_reuse |
| The first request with this key is still running | 409 | idempotency_in_progress |
| The key's record vanished between two requests: retry with a new key | 409 | idempotency_conflict |
| A key longer than 191 characters | 400 | idempotency_key_invalid |
A replayed answer carries Idempotent-Replay: true.
191