Follow the request workflow
Platform-managed production requests use https://customer-api.wavac.io and
present the active certificate. Customer-managed requests use
https://api.wavac.io. Obtain a Wavac access token through the
authentication mode configured for the integration,
then call discovery and select only identifiers returned for the current
credential. Query aggregate data or downtime using a discovered siteId and
any narrower filters.
| Method | Endpoint | Purpose |
|---|---|---|
GET |
/api/customer/v1/discovery |
List available resources and the visible site, line, machine, and Friendly Tag hierarchy. |
GET |
/api/customer/v1/data |
Read aggregate Friendly Tag values. |
GET |
/api/customer/v1/downtime |
Read downtime events that overlap a time interval. |
GET |
/api/customer/v1/downtime/codes |
List active downtime codes available for a site. |
Follow nextCursor until it is null while keeping the original query unchanged.
Reconcile the complete interval later when late or corrected data must be
included.
Do not treat a query ending at the current time as complete. Recent observations may not be available yet. Use a delayed, fixed end time, finish every page, and re-read overlapping intervals to include later arrivals. See query recent data safely.
Format dates and times
Send from and to as RFC 3339 timestamps with an explicit offset:
YYYY-MM-DDTHH:mm:ss[.fffffff](Z|+HH:mm|-HH:mm)
Valid examples include 2026-09-01T13:36:10Z,
2026-09-01T13:36:10.5696790Z, and 2026-09-01T09:36:10-04:00.
| Concern | Contract |
|---|---|
| Offset | Required. Use Z for UTC or a numeric offset such as -04:00. |
| Fractional seconds | Optional, with one through seven digits. |
| Query encoding | Encode a positive offset's + as %2B; standard URL builders do this automatically. |
| Time range | Half-open: from is included and to is excluded. |
| Aggregate timestamp | UTC start of the bucket. |
| Response timestamp | Normalized to UTC and written with Z. |
| Open downtime | endedAt is null until the event ends. |
Do not send locale-specific dates, timestamps without an offset, named time
zones, or Unix timestamps in from and to.
Read JSON as UTF-8
Responses use JSON encoded as UTF-8 and camel-case property names. Send
Accept: application/json. Do not depend on JSON property order.
Names, labels, categories, and engineering units are Unicode display text. Decode them as UTF-8, preserve the received text, and do not use a display value as an identifier.
{
"siteName": "Fábrica Norte",
"lineName": "Línea de empaque",
"tagName": "温度"
}
JSON null is distinct from an empty string. Optional values such as
engineeringUnits, downtime display metadata, and endedAt can be null.
Plan for contract changes
Wavac ordinarily preserves existing versioned routes, request parameters, and JSON response shapes. This practice reduces unnecessary integration changes, but it is not a guarantee that an endpoint or shape will remain unchanged.
Ignore JSON properties your client does not recognize, do not depend on property order, and validate required properties and types before processing a response. Use discovery and the current endpoint reference instead of treating an example response as a permanent schema.
Contract compatibility is separate from data consistency. Even when the JSON shape is unchanged, late or corrected observations can revise aggregate values for an earlier interval. See pagination and data consistency for reconciliation guidance.
Preserve identifiers and numbers
| Value | Format |
|---|---|
siteId, lineId, machineId |
Copy exactly from discovery. They are case-sensitive and cannot contain spaces. |
tagGuid, eventId |
Canonical UUID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Never construct a tagGuid. |
cursor |
Opaque URL-safe string returned unchanged. |
aggregationIntervalSeconds, pageSize, downCode, sampleCount, sortOrder |
JSON integers. |
durationMs |
Integer elapsed milliseconds. |
value, minimum, maximum |
JSON numbers, not quoted strings. |
isFallbackCode |
JSON true or false, not 1, 0, or quoted text. |
Percent-encode query values with a standard URL builder. Repeated filters use
the same key more than once, for example
tagGuid=<guid-1>&tagGuid=<guid-2>.
Read effective limits
Discovery reports available fields and filters, maximum time range, result
limit, and minimum aggregation interval. An oversized positive pageSize is
capped, and X-Effective-Page-Size reports the value used. An aggregation
interval below the permitted minimum is raised, and
X-Effective-Aggregation-Interval-Seconds reports the effective interval.
Rate-limit headers describe the daily request allowance:
| Header | Meaning |
|---|---|
RateLimit-Limit |
Total requests available in the current UTC allowance window, when a fixed limit applies. |
RateLimit-Remaining |
Requests remaining after the current request. |
RateLimit-Reset |
Unix timestamp in whole seconds when the UTC allowance resets. |
Retry-After |
Seconds to wait after a 429 response. |
Budget authentication and renewal
Postman test-package generation has its own standard allowance of 10 generation
requests per user per UTC day, shared across customers and reset at 00:00 UTC.
Requests accepted for generation count even if generation or download later
fails. Rejected requests do not consume another slot. On 429, wait at least
Retry-After seconds. Package generation does not consume the customer's daily
data allowance. Generate packages in Settings > Customer API in the Dashboard.
Authentication operations have separate limits from the daily data-request allowance. These are the standard limits; confirm any account-specific settings with your administrator. Limits apply across callers using the same integration or credential, not separately to each process or scheduled job.
| Operation | Standard allowance | What to budget |
|---|---|---|
| OAuth token issuance, either authentication mode | 2 successful issuances per integration per 120 seconds | Reuse the 600-second token; allow room to obtain and prove a replacement. |
GET or HEAD /api/customer/v1/auth/session |
12 checks per credential per 60 seconds | Prove a new token or diagnose authentication; do not poll or check before every data request. |
| Enrollment completion and certificate renewal | 4 attempts per integration per 24 hours, shared between these operations | Failed material validation can consume an attempt. Reserve capacity for scheduled renewal and recovery. |
| Rebootstrap | 20 operations per integration per 24 hours | Use only for approved recovery, not routine refresh or to reset other allowances. |
These operations do not consume the daily data allowance. Discovery and authorized data requests do, including empty results and continuation pages. Do not infer that a request is free merely because it lacks daily quota headers.
On 429, wait at least the response's Retry-After before another attempt;
coordinate that wait across callers. On 503, honor Retry-After when present
and use bounded backoff. Never retry a bootstrap or renewal blindly after a
timeout: the operation may already have succeeded. Revocation and rebootstrap
do not provide fresh rate-limit allowances.
Platform-managed certificates last 24 hours. Obtain and prove the replacement before publishing it to your callers. The predecessor's acceptance ends after the ten-minute replacement overlap or its expiry, whichever comes first. Revocation is immediate and has no overlap grace. See certificate renewal and token renewal for the handoff steps.
Continue with reference
Use the discovery, aggregate data, and downtime references for exact operation contracts. Read pagination and data consistency before persisting results.