openapi: 3.0.3 info: title: WellnessLiving Appointments Authentication API description: Curated, representative subset of WellnessLiving's official production API (RESTful, JSON-over-HTTPS). WellnessLiving is business-management software for fitness studios, gyms, spas, and salons; this API is the same one its own web and mobile clients (Achieve, Elevate) call, and is published for approved partners via an official OpenAPI document at github.com/wellnessliving/openapi (324 paths across 45+ resource areas as of the 2026-06-20 build). Endpoints below are grounded in that official spec and in the public github.com/wellnessliving/wl-sdk (PHP) and wl-sdk-js SDKs; this file selects roughly four representative endpoints per logical API area rather than reproducing the full catalog. Every WellnessLiving API resource is a `.json`-suffixed endpoint whose path is derived deterministically from the SDK model class's namespace (e.g. the PHP class `WellnessLiving\Wl\Staff\StaffElementModel` serves `/Wl/Staff/StaffElement.json`). Legacy numbered variants of several endpoints exist for backward compatibility (e.g. `Finish47`, `ServiceList52`, `Purchase72`) and are omitted here in favor of their current unsuffixed counterpart. version: 1.1.20260620071011 contact: name: WellnessLiving Support email: support@wellnessliving.com url: https://www.wellnessliving.com/support license: name: Proprietary url: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/ termsOfService: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/ servers: - url: https://us.wellnessliving.com description: Production - United States data center - url: https://au.wellnessliving.com description: Production - Australia data center - url: https://staging.wellnessliving.com description: Staging (pre-release QA branch) - url: https://demo.wellnessliving.com description: Demo/trunk (active development branch) security: - BearerAuth: [] tags: - name: Authentication paths: /Core/Passport/Login/Enter/Enter.json: post: operationId: post_Core_Passport_Login_Enter_Enter summary: Signs the user in using their login and hashed password. description: 'Accepts the user login, a password hash derived using the notepad obtained from [NotepadApi](/Core/Passport/Login/Enter/Notepad.json), and an optional remember preference. Validates credentials, enforces CAPTCHA when too many failed attempts have occurred, starts a session for the user, and returns a redirect URL if applicable.' tags: - Authentication parameters: - $ref: '#/components/parameters/XErrorRules' requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: json_data: description: The `json_data` field. See WellnessLiving developer portal for full field semantics. type: string s_captcha: description: The `s_captcha` field. See WellnessLiving developer portal for full field semantics. type: string s_login: description: The `s_login` field. See WellnessLiving developer portal for full field semantics. type: string s_notepad: description: The `s_notepad` field. See WellnessLiving developer portal for full field semantics. type: string s_password: description: The `s_password` field. See WellnessLiving developer portal for full field semantics. type: string s_remember: description: The `s_remember` field. See WellnessLiving developer portal for full field semantics. type: string url_return: description: The `url_return` field. See WellnessLiving developer portal for full field semantics. type: string required: - json_data - s_captcha - s_login - s_notepad - s_password - s_remember - url_return responses: '200': description: Successful response. content: application/json: schema: type: object properties: url_redirect: description: The `url_redirect` field. nullable: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' /Core/Passport/Enter/Jwt/JwtToken.json: get: operationId: get_Core_Passport_Enter_Jwt_JwtToken summary: Returns a jwt token that can be used to log user. description: 'Requires the user to be signed in. Generates a signed JWT token tied to the current authorization header and user ID that can be passed to other services to authenticate the user without sharing session cookies.' tags: - Authentication parameters: - $ref: '#/components/parameters/XErrorRules' responses: '200': description: Successful response. content: application/json: schema: type: object properties: s_token: description: The `s_token` field. nullable: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' /Core/Passport/Login/SignOut/SignOut.json: post: operationId: post_Core_Passport_Login_SignOut_SignOut summary: Signs user out. description: 'Requires the user to be signed in, fires a before-logout event allowing listeners to intercept or handle the logout, then clears the current session. Throws an error if the user is authenticated via SAML SSO, as API-based logout is not supported in that case.' tags: - Authentication parameters: - $ref: '#/components/parameters/XErrorRules' responses: '200': description: Successful response. content: application/json: schema: type: object properties: status: type: string '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' /Wl/Login/Login.json: get: operationId: get_Wl_Login_Login summary: Retrieves information about user. description: 'Returns name, gender, photo URL, email, and staff details for the specified user within the given business. Public staff information is returned even without profile access; full client details require access to the user''s profile.' tags: - Authentication parameters: - $ref: '#/components/parameters/XErrorRules' - name: i_photo_height in: query required: true schema: type: integer description: The height of the requested photo. - name: i_photo_width in: query required: true schema: type: integer description: The width of the requested photo. - name: k_business in: query required: true schema: type: string description: 'The key of the business. Users can be in multiple businesses. This can be left as `null` to retrieve system-wide information.' - name: uid in: query required: false schema: type: string nullable: true description: 'The key of the user. `null` on case when is walk-in client.' responses: '200': description: Successful response. content: application/json: schema: type: object properties: can_postcard: description: The `can_postcard` field. nullable: true can_send_message: description: The `can_send_message` field. nullable: true id_gender: description: The `id_gender` field. nullable: true is_photo_empty: description: The `is_photo_empty` field. nullable: true k_staff: description: The `k_staff` field. nullable: true s_first_name: description: The `s_first_name` field. nullable: true s_last_name: description: The `s_last_name` field. nullable: true text_mail_client: description: The `text_mail_client` field. nullable: true text_mail_staff: description: The `text_mail_staff` field. nullable: true text_name_first_staff: description: The `text_name_first_staff` field. nullable: true text_name_full_client: description: The `text_name_full_client` field. nullable: true text_name_full_staff: description: The `text_name_full_staff` field. nullable: true text_name_last_staff: description: The `text_name_last_staff` field. nullable: true uid: description: The `uid` field. nullable: true uid_staff: description: The `uid_staff` field. nullable: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' components: parameters: XErrorRules: name: X-Error-Rules in: header required: false schema: type: string description: Opt in to mapping internal API error statuses to real 4xx HTTP codes. By default the API always answers HTTP 200 even on error, with the failure encoded in the JSON body; setting this header (e.g. to `default`) makes the gateway translate matched error statuses to 400/403/404 responses instead. responses: ServerError: description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ValidationError: description: The request payload failed field-level validation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing, expired, or invalid Bearer token / session. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' BadRequest: description: 'Client-side error: invalid input, failed validation, throttling, or other request error (only returned as an HTTP status when `X-Error-Rules` opts in; otherwise encoded in a 200 body).' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: The requested resource does not exist. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: Authenticated but not permitted to access this business, location, or resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' schemas: ErrorResponse: type: object description: Standard WellnessLiving API error response shape. properties: status: type: string description: Machine-readable status/error code string (e.g. `access-denied`, `not-found`). text_message: type: string description: Human-readable error message. a_field: type: object additionalProperties: true description: Per-field validation errors, when the failure is a 422-style validation error. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: 'The officially published OpenAPI declares a JWT Bearer scheme: sign in via `POST /Core/Passport/Login/Enter/Enter.json`, then mint a token with `GET /Core/Passport/Enter/Jwt/JwtToken.json` and send it as `Authorization: Bearer `. The underlying PHP/JS SDKs additionally support the legacy scheme: a registered Application ID + secret code sign a per-request HMAC (SHA3-based) placed in the `Authorization:` header alongside session cookies established by the `Notepad`/`Enter` model pair. Both schemes require WellnessLiving''s Integrations Team to first approve API access, sign an NDA and API Agreement, and issue application credentials.'