API archive entry · source-reported
Fitbit Plus API
# Overview The Fitbit Plus API is a RESTful API. The requests and responses are formated according to the JSON API specification. In addition to this documentation, we also provide an OpenAPI "yaml" file describing the API: Fitbit Plus API Specification. # Authentication Authentication for the Fitbit Plus API is based on the OAuth 2.0 Authorization Framework. Fitbit Plus currently supports grant types of **client_credentials** and **refresh_token**. See POST /oauth/token for details on the request and response formats. --> ## Building Integrations We will provide customers with unique client credentials for each application/integration they build, allowing us to enforce appropriate access controls and monitor API usage. The client credentials will be scoped to the organization, and allow full access to all patients and related data within that organization. These credentials are appropriate for creating an integration that does one of the following: - background reporting/analysis - synchronizing data with another system (such as an EMR) The API credentials and oauth flows we currently support are **not** well suited for creating a user-facing application that allows a user (patien
Plan the first integration safely
The access fields below come from the connected directory. Their likely implementation impact is explained without assuming provider-specific behavior.
Authentication
OAuth is reported. Confirm flows, scopes, consent, token lifetime, and refresh rules.
Transport
HTTPS is not confirmed. Do not send credentials or production data until secure transport is verified.
Browser access
CORS is unknown. Treat direct browser access as unconfirmed and test before choosing a client-only architecture.
First-request sequence
- Identify the current base URL, version, and endpoint for the use case.
- Confirm how credentials are issued and where they may be stored.
- Test success, invalid input, throttling, unavailable data, and timeouts.
- Record response fields, pagination, caching, and error shapes.
- Add monitoring, retries with backoff, and an appropriate fallback.
Questions to resolve before production
Pricing and quotas
Confirm current plans, free-tier limits, overages, and request ceilings.
Endpoint coverage
Check that the operations and response fields match the intended workload.
Reliability
Look for uptime history, a status page, support routes, and service commitments.
Data and privacy
Review retention, licensing, regional processing, and compliance requirements.
Versioning
Confirm the active version, change policy, deprecation window, and migration guidance.
Developer experience
Validate SDKs, examples, error formats, pagination, and test environments.
Source reference
This page separates source-reported facts from questions that need live provider verification.