canonical: https://jentic.com/apis/fitbit.com/fitbit

# Fitbit Web API Explorer

The Fitbit Web API exposes consented user health and activity data captured by Fitbit wearables, the Aria scale, and manual logs. The 122 endpoints cover activity, heart rate, sleep, body composition, breathing rate, ECG, cardio fitness (VO2 Max), temperature, irregular rhythm notifications, foods, friends, devices, and intraday time-series data at minute or second resolution. Authorization is OAuth 2.0 with per-scope user consent, suitable for digital health apps, employer wellness programmes, and research studies.

## For AI agents

Read consented activity, sleep, heart rate, body, and intraday time-series data for Fitbit users, and log activity, sleep, weight, or food entries on their behalf.

## Scope

Does not handle medical-grade diagnostics, EHR record exchange, or non-Fitbit wearable data - use for consented Fitbit user activity, sleep, heart, body, and intraday data only.

## Capabilities

- Read daily activity summaries, steps, distance, and active zone minutes from /1/user/-/activities endpoints
- Pull intraday heart-rate and active-zone-minute series at minute or second granularity
- Retrieve sleep logs, sleep goals, and sleep stages over date ranges
- Access body weight, fat percentage, BMI, and Aria scale measurements over time
- Surface clinical-grade signals - ECG readings, VO2 Max scores, temperature, breathing rate, and HRV intraday
- Manage subscriptions to receive webhooks when a user's activity, body, or sleep data changes
- Log activity, food, water, weight, or sleep entries on behalf of a consented user

## Use cases

### Digital Health Research

Pull consented intraday data - heart rate at one-minute resolution, breathing rate, HRV, and ECG readings - for participants in remote studies. The Fitbit Web API is one of the few consumer wearables APIs that exposes this depth of physiological data, suitable for IRB-approved research and digital therapeutics. Most studies have data ingestion live within a week.

Example prompt: GET /1/user/-/activities/heart/date/2026-06-09/1d/1min.json for participant X to pull one-minute heart rate, then sync to the study database

### Wellness and Coaching Apps

Surface daily activity summaries, sleep quality, and active zone minutes inside a coaching or insurance wellness app. The /1/user/-/activities/date/{date}.json endpoint returns one consolidated day-summary object that is easy to render. Subscribe to data changes via the subscriptions endpoints so the app updates without polling.

Example prompt: Pull /1/user/-/activities/date/today.json and present steps, active zone minutes, and resting heart rate in a wellness card

### Cardiac Risk Monitoring

Retrieve ECG readings, irregular rhythm notifications, cardio fitness (VO2 Max) scores, and HRV intraday data to feed a cardiac risk model or alerting workflow. Useful for digital health platforms and employer health programmes that surface flagged readings to a clinician for review. Live in 1-2 weeks including consent flows.

Example prompt: Query the irregular rhythm notifications endpoint, then for any positive notification pull the corresponding ECG reading and forward it to the clinician dashboard

### AI Agent Health Operations

Use Fitbit through Jentic so a wellness agent can answer 'how did I sleep last night?' or log a workout via natural language. Jentic exposes the 122 endpoints as discoverable tools, with the OAuth2 access token in the vault. Get started with Jentic One, the self-hosted execution layer

Example prompt: Through Jentic, search 'get sleep log for last night', load the /1.2/user/-/sleep/date/{date}.json schema, and execute with date=yesterday

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /1/user/-/activities/date/{date}.json | Daily activity summary |
| GET | /1.2/user/-/sleep/date/{date}.json | Sleep log for a date |
| GET | /1/user/-/activities/heart/date/{date}/1d/{detail-level}.json | Intraday heart rate |
| POST | /1/user/-/activities.json | Log an activity |
| POST | /1.2/user/-/sleep.json | Log a sleep entry |
| GET | /1/user/-/devices.json | List connected Fitbit devices |
| POST | /1.1/oauth2/introspect | Introspect an OAuth 2.0 token |

## Key resources

- **Activity** — Daily summaries, lifetime stats, intraday active-zone-minutes, and activity logs
- **Heart Rate** — Daily heart rate zones and intraday heart rate at minute/second resolution
- **Sleep** — Sleep logs, stages, goals, and date-range queries
- **Body** — Weight, body fat, BMI, and Aria scale measurements
- **Cardiac** — ECG readings, irregular rhythm notifications, VO2 Max, HRV intraday
- **Devices** — Connected device list with battery and last-sync info
- **Foods** — Food database, locales, and food logging
- **Subscriptions** — Webhook subscriptions for user data changes

## Why Jentic

- **Setup:** Wiring the Fitbit Web API by hand means running the OAuth2 flow for the right per-scope consent, refreshing tokens, and spreading calls across 122 activity, sleep, heart, and body endpoints with your own retries. Through Jentic you install once, import Fitbit from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** Fitbit scopes to the consenting user's own data through the /user/-/ path and per-scope OAuth grants rather than an owned resource id you pin, so limit the agent to the operations it needs, such as reading a sleep log or logging a workout, and leave the rest out of the allowed set. You choose which operations it may call.
- **Credential handling:** Your Fitbit OAuth2 tokens are stored once per user, encrypted, by your own Jentic One instance and refreshed and injected into the Authorization header at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'get a sleep log' or 'log a workout', and Jentic returns the matching Fitbit operation with its input schema so the agent calls the right one of 122 endpoints without browsing the reference docs.

## Related APIs

- **Fireflies.ai GraphQL API** — Adds meeting transcript context to a wellness/productivity agent built on Fitbit
- **Firebase Auth REST API** — Authenticates app users that connect their Fitbit account via OAuth
- **Firmwater LMS API** — Triggers wellness training assignments based on Fitbit activity patterns

## FAQ

### What authentication does the Fitbit Web API use?

Fitbit uses OAuth 2.0 with per-scope user consent (activity, heartrate, sleep, weight, etc.). Through Jentic, the access token and refresh token are held in the encrypted vault and the Authorization header is injected at execution time.

### Can I get intraday heart rate with the Fitbit Web API?

Yes. Endpoints under /1/user/-/activities/heart/date/{date}/1d/{detail-level}.json return intraday heart rate at 1sec, 1min, 5min, or 15min granularity, subject to Fitbit approving your application for intraday access.

### What are the rate limits for the Fitbit Web API?

Fitbit applies a default limit of 150 API calls per hour per user per app. The response includes Fitbit-Rate-Limit-Remaining and Retry-After headers. Higher limits require an application review.

### How do I pull a sleep log through Jentic?

Search Jentic for 'get sleep log for a date', load the /1.2/user/-/sleep/date/{date}.json schema, and execute with the user's date. The response includes total minutes asleep, stages (deep, light, REM, wake), and per-stage durations.

### Can the Fitbit Web API push events instead of polling?

Yes. Use the Subscriptions API (/1/user/-/{collection}/apiSubscriptions/{subscriptionId}.json) to register your endpoint; Fitbit will POST a notification when the user's activities, body, sleep, or food data changes, so you fetch only on update.

### Does the Fitbit Web API expose ECG and irregular rhythm data?

Yes. ECG readings and Irregular Rhythm Notifications are exposed as separate tagged endpoints under the user namespace, suitable for cardiac risk dashboards once the user grants the appropriate scope.

### Can I limit what my agent is allowed to do with the Fitbit Web API?

Yes. Because you run Jentic One yourself, you decide which of the 122 Fitbit operations your agent may call and set the rules that govern them. Fitbit scopes access to the consenting user's own data through the /user/-/ path and per-scope OAuth grants, so you can allow only what the agent needs, such as reading a sleep log from /1.2/user/-/sleep/date/{date}.json or logging a workout via /1/user/-/activities.json, and leave everything else out of the allowed set. The OAuth2 tokens stay under your control and are injected at execution time rather than exposed to the agent.