Skip to content
HealthSync Docs

Provider Metadata API

Use GET /api/providers from your tenant backend to discover which HealthSync providers are available in the current environment and which canonical datapoints each provider can produce.

Endpoint

Section titled “Endpoint”
GET /api/providers
Authorization: Bearer <tenant-api-key>

In deployed environments, the request must include a tenant client API key in the Authorization header. Local and test runtimes keep the repository’s existing API-key passthrough behavior for development.

Response

Section titled “Response”
{
  "providers": [
    {
      "id": "fitbit",
      "name": "Fitbit",
      "icon": "activity",
      "enabled": true,
      "datapoints": [
        { "type": "activity", "stream": "session" },
        { "type": "sleep", "stream": "session" },
        { "type": "body_measurement", "stream": "snapshot" },
        { "type": "heart_rate_series", "stream": "timeseries" },
        { "type": "daily_summary", "stream": "aggregate" },
        { "type": "user_profile", "stream": "profile" },
        { "type": "nutrition", "stream": "snapshot" },
        { "type": "hydration", "stream": "snapshot" }
      ]
    }
  ]
}

Fields

Section titled “Fields”

| Field | Type | Description | | ----- | ---- | ----------- | | providers | array | Provider metadata entries visible in the current runtime. | | providers[].id | string | Stable provider identifier used by connect flows, for example fitbit, garmin, googleHealth, or polar. | | providers[].name | string | Display name for client UI. | | providers[].icon | string | Icon key used by HealthSync UI surfaces. | | providers[].enabled | boolean | true when the provider is usable in the current runtime. false means the provider is known but not currently available, usually because runtime provider configuration is incomplete. | | providers[].datapoints | array | Canonical HealthSync event types the provider can produce after fetch and normalization. | | providers[].datapoints[].type | string | Canonical event type, such as activity, daily_summary, or heart_rate_series. | | providers[].datapoints[].stream | string | Event stream for the datapoint: session, snapshot, timeseries, aggregate, or profile. |

Enabled Providers

Section titled “Enabled Providers”

enabled is runtime availability, not tenant connection state. It does not mean the tenant has connected a user to that provider.

Deployed tiers omit local mock providers. Real providers remain listed even when disabled so clients can render a stable catalog without learning which secret or environment variable is missing.

Example Request

Section titled “Example Request”
Terminal window
curl https://healthsync.example/api/providers \
  -H "Authorization: Bearer your-tenant-api-key"

Error Responses

Section titled “Error Responses”

| Status | Meaning | | ------ | ------- | | 200 | Provider metadata returned. | | 401 | Missing, malformed, or invalid tenant API key in a deployed environment. |

Security Notes

Section titled “Security Notes”

The response is intentionally sanitized. It does not include OAuth URLs, token URLs, client IDs, secret names, environment variable names, raw provider runtime config, tenant users, or per-user connection state.

Section titled “Related Docs”