openapi: 3.0.3 info: title: WellnessLiving Appointments Reviews API description: Curated, representative subset of WellnessLiving's official production API (RESTful, JSON-over-HTTPS). WellnessLiving is business-management software for fitness studios, gyms, spas, and salons; this API is the same one its own web and mobile clients (Achieve, Elevate) call, and is published for approved partners via an official OpenAPI document at github.com/wellnessliving/openapi (324 paths across 45+ resource areas as of the 2026-06-20 build). Endpoints below are grounded in that official spec and in the public github.com/wellnessliving/wl-sdk (PHP) and wl-sdk-js SDKs; this file selects roughly four representative endpoints per logical API area rather than reproducing the full catalog. Every WellnessLiving API resource is a `.json`-suffixed endpoint whose path is derived deterministically from the SDK model class's namespace (e.g. the PHP class `WellnessLiving\Wl\Staff\StaffElementModel` serves `/Wl/Staff/StaffElement.json`). Legacy numbered variants of several endpoints exist for backward compatibility (e.g. `Finish47`, `ServiceList52`, `Purchase72`) and are omitted here in favor of their current unsuffixed counterpart. version: 1.1.20260620071011 contact: name: WellnessLiving Support email: support@wellnessliving.com url: https://www.wellnessliving.com/support license: name: Proprietary url: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/ termsOfService: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/ servers: - url: https://us.wellnessliving.com description: Production - United States data center - url: https://au.wellnessliving.com description: Production - Australia data center - url: https://staging.wellnessliving.com description: Staging (pre-release QA branch) - url: https://demo.wellnessliving.com description: Demo/trunk (active development branch) security: - BearerAuth: [] tags: - name: Reviews paths: /Wl/Review/Review.json: post: operationId: post_Wl_Review_Review summary: Submits user's review. description: 'Validates the captcha, saves the review rating and text for the specified location, and returns reward score information if the business awards points for leaving a review.' tags: - Reviews parameters: - $ref: '#/components/parameters/XErrorRules' requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: i_rate: description: The `i_rate` field. See WellnessLiving developer portal for full field semantics. type: string k_location: description: The `k_location` field. See WellnessLiving developer portal for full field semantics. type: string k_visit: description: The `k_visit` field. See WellnessLiving developer portal for full field semantics. type: string s_text: description: The `s_text` field. See WellnessLiving developer portal for full field semantics. type: string required: [] responses: '200': description: Successful response. content: application/json: schema: type: object properties: i_score: description: The `i_score` field. nullable: true i_score_facebook: description: The `i_score_facebook` field. nullable: true i_score_twitter: description: The `i_score_twitter` field. nullable: true is_score: description: The `is_score` field. nullable: true is_score_facebook: description: The `is_score_facebook` field. nullable: true is_score_twitter: description: The `is_score_twitter` field. nullable: true is_share_points: description: The `is_share_points` field. nullable: true is_share_points_none: description: The `is_share_points_none` field. nullable: true k_login_activity: description: The `k_login_activity` field. nullable: true k_review: description: The `k_review` field. nullable: true uid: description: The `uid` field. nullable: true url_share: description: The `url_share` field. nullable: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' /Wl/Review/ReviewList/ReviewList.json: get: operationId: get_Wl_Review_ReviewList_ReviewList summary: Retrieves a list of reviews. description: 'Returns reviews for the specified location, or all reviews for the business if no location is given, with support for filtering by user, ordering, and pagination.' tags: - Reviews parameters: - $ref: '#/components/parameters/XErrorRules' - name: i_page in: query required: false schema: type: integer nullable: true description: 'If not specified, this request will return all review keys. If specified, this request will return detailed reviews (10 per page). This will be `null' - name: id_order in: query required: false schema: type: string description: Enumerated/coded value (see WellnessLiving *Sid constant classes). description: 'The order in which the review should be arranged. One of the [ReviewOrderSid](#/components/schemas/Wl.Review.ReviewList.ReviewOrderSid) constants. If' - name: k_business in: query required: true schema: type: string description: Business key. If not specified, location key needs to be specified. - name: k_location in: query required: true schema: type: string description: The key of the location to show reviews for. If not specified, business key should be specified. - name: uid in: query required: true schema: type: string description: 'The user''s key. WellnessLiving allows staff to check low-rated reviews before posting them. Staff members can see all reviews. Clients can only see ch' responses: '200': description: Successful response. content: application/json: schema: type: object properties: a_review: description: The `a_review` field. nullable: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' /Wl/Review/ReviewReply.json: post: operationId: post_Wl_Review_ReviewReply summary: Saves the reply text and optional status update for the given review. description: 'Validates edit access for the current user, persists the reply text and optional review status change, and records the replying staff or admin user.' tags: - Reviews parameters: - $ref: '#/components/parameters/XErrorRules' requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object properties: id_review_status: description: The `id_review_status` field. See WellnessLiving developer portal for full field semantics. type: string k_business: description: The `k_business` field. See WellnessLiving developer portal for full field semantics. type: string k_review: description: The `k_review` field. See WellnessLiving developer portal for full field semantics. type: string text_reply: description: The `text_reply` field. See WellnessLiving developer portal for full field semantics. type: string required: - k_business - k_review - text_reply responses: '200': description: Successful response. content: application/json: schema: type: object properties: status: type: string '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/ServerError' components: parameters: XErrorRules: name: X-Error-Rules in: header required: false schema: type: string description: Opt in to mapping internal API error statuses to real 4xx HTTP codes. By default the API always answers HTTP 200 even on error, with the failure encoded in the JSON body; setting this header (e.g. to `default`) makes the gateway translate matched error statuses to 400/403/404 responses instead. responses: ServerError: description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ValidationError: description: The request payload failed field-level validation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing, expired, or invalid Bearer token / session. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' BadRequest: description: 'Client-side error: invalid input, failed validation, throttling, or other request error (only returned as an HTTP status when `X-Error-Rules` opts in; otherwise encoded in a 200 body).' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: The requested resource does not exist. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: Authenticated but not permitted to access this business, location, or resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' schemas: ErrorResponse: type: object description: Standard WellnessLiving API error response shape. properties: status: type: string description: Machine-readable status/error code string (e.g. `access-denied`, `not-found`). text_message: type: string description: Human-readable error message. a_field: type: object additionalProperties: true description: Per-field validation errors, when the failure is a 422-style validation error. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: 'The officially published OpenAPI declares a JWT Bearer scheme: sign in via `POST /Core/Passport/Login/Enter/Enter.json`, then mint a token with `GET /Core/Passport/Enter/Jwt/JwtToken.json` and send it as `Authorization: Bearer `. The underlying PHP/JS SDKs additionally support the legacy scheme: a registered Application ID + secret code sign a per-request HMAC (SHA3-based) placed in the `Authorization:` header alongside session cookies established by the `Notepad`/`Enter` model pair. Both schemes require WellnessLiving''s Integrations Team to first approve API access, sign an NDA and API Agreement, and issue application credentials.'