openapi: 3.0.3
info:
  title: Fitbit Activity Foods Oauth2 API
  description: 'Read and write user activity, exercise, and Active Zone Minutes (AZM) data on

    Fitbit. The Activity API exposes daily activity summaries (steps, distance,

    calories, floors, elevation, activity minutes), per-activity logs, lifetime

    totals, activity goals, the user''s exercise type catalog, and Active Zone

    Minutes time series. Time-series endpoints accept a base-date and either an

    end-date or a period (1d, 7d, 30d, 1w, 1m, 3m, 6m, 1y).

    '
  version: '1'
  contact:
    name: Fitbit Developer
    url: https://dev.fitbit.com/build/reference/web-api/activity/
servers:
- url: https://api.fitbit.com
  description: Fitbit Web API
security:
- OAuth2:
  - activity
tags:
- name: Oauth2
paths:
  /oauth2/authorize:
    get:
      summary: Authorize
      description: Initiates the OAuth 2.0 authorization flow by presenting the consent screen to the user.
      operationId: authorize
      servers:
      - url: https://www.fitbit.com
      parameters:
      - name: response_type
        in: query
        required: true
        schema:
          type: string
          enum:
          - code
          - token
      - name: client_id
        in: query
        required: true
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: true
        schema:
          type: string
      - name: scope
        in: query
        required: true
        schema:
          type: string
          description: Space-separated list of scopes.
      - name: code_challenge
        in: query
        schema:
          type: string
      - name: code_challenge_method
        in: query
        schema:
          type: string
          enum:
          - S256
      - name: state
        in: query
        schema:
          type: string
      - name: prompt
        in: query
        schema:
          type: string
          enum:
          - consent
          - login
          - none
          - login consent
      - name: expires_in
        in: query
        schema:
          type: integer
      responses:
        '302':
          description: Redirect to the redirect_uri with an authorization code.
      tags:
      - Oauth2
  /oauth2/token:
    post:
      summary: Get Access Token
      description: Exchanges the authorization code for the initial access token and refresh token.
      operationId: getAccessToken
      servers:
      - url: https://api.fitbit.com
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                  - authorization_code
                  - refresh_token
                  - client_credentials
                code:
                  type: string
                client_id:
                  type: string
                redirect_uri:
                  type: string
                code_verifier:
                  type: string
                refresh_token:
                  type: string
      responses:
        '200':
          description: Access and refresh tokens issued.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
      tags:
      - Oauth2
  /1.1/oauth2/introspect:
    post:
      summary: Introspect Token
      description: Returns the active state and metadata for an OAuth 2.0 access token.
      operationId: introspectToken
      servers:
      - url: https://api.fitbit.com
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                token:
                  type: string
      responses:
        '200':
          description: Token introspection result.
      tags:
      - Oauth2
  /oauth2/revoke:
    post:
      summary: Revoke Token
      description: Disables a user's authorization and all associated tokens.
      operationId: revokeToken
      servers:
      - url: https://api.fitbit.com
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                token:
                  type: string
      responses:
        '200':
          description: Token revoked.
      tags:
      - Oauth2
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        expires_in:
          type: integer
        refresh_token:
          type: string
        scope:
          type: string
        token_type:
          type: string
          enum:
          - Bearer
        user_id:
          type: string
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://www.fitbit.com/oauth2/authorize
          tokenUrl: https://api.fitbit.com/oauth2/token
          scopes:
            activity: Activity and exercise data
            heartrate: Heart rate data
            location: GPS and other location data
            nutrition: Food and nutrition data
            profile: User profile
            settings: Account settings
            sleep: Sleep data
            social: Friends and leaderboard data
            weight: Weight, BMI, and body fat data
            oxygen_saturation: SpO2 data
            respiratory_rate: Breathing rate data
            temperature: Skin and core body temperature data
            electrocardiogram: ECG readings
            irregular_rhythm_notifications: IRN data
            cardio_fitness: Cardio fitness (VO2 Max) data