CorrConnectDocs
Early accessRequest access

Platform

Changelog and versioning

The API is in early access: subject to change. Here is how we change it, and a record of what has.

Versioning

Data routes carry their version in the path: /v1/.... The OAuth routes follow the OAuth specifications and are not versioned. The OpenAPI document's info.version (currently 0.1.0) tracks the published contract.

Within v1 we make changes that existing clients can ignore:

  • new endpoints,
  • new optional fields in responses,
  • new values for source, activity_type, basis fields and error codes,
  • new event types (you only receive the events you subscribed to),
  • new optional request parameters.

Write your client to ignore fields it doesn't know and to cope with new values. That's all it takes to stay compatible.

During early access we may also make changes that are not backwards compatible, when the alternative is shipping something wrong. We'll tell invited developers by email before they happen.

Early access, October 2026

The API invited developers can use today:

  • Public-client OAuth 2.0 with S256 PKCE, one-hour access tokens and rotating refresh tokens with reuse detection.
  • RFC 7009 token revocation at /oauth/revoke-token, alongside whole-grant revocation at /oauth/revoke.
  • GET /v1/profile, GET /v1/activities and GET /v1/activities/{activity_id}.
  • Signed webhooks for activity.created and grant.revoked, with test events and a delivery log.
  • The free tier: 100 requests per 15 minutes and 10,000 per day per app, with RateLimit-* headers.
  • Activities from FIT, GPX and TCX files and JSON summaries.
  • A generated OpenAPI 3.1 document.

Coming soon

These are planned and not available. Don't build against them yet.

  • Device connections that sync from device makers' clouds, one at a time as each is approved.
  • Scopes for sleep, recovery and body measurements.
  • Confidential clients for server-side apps.