Postman and Bruno collections for wearable APIs
Download a Postman collection (Collection Format v2.1.0) or a Bruno collection folder for 10 wearable and health APIs: 9 with the vendor's OAuth 2.0 authorization URL, code-for-token exchange and, where documented, refresh request, using {{client_id}}-style variables, and 8 with the vendor's documented webhook examples posted to {{local_url}}, 53 requests in all. They are generated from the same vendor quotes as the OAuth playground and the webhook payload library (read 2026-11-05), and ship no secrets: client_secret and every token are empty variables you fill in your own environment.
Download a collection
Oura
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: Data event
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{code_verifier}}, {{code_challenge}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
WHOOP
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: v2 example: sleep.updated; Field-table example: workout.updated
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
Strava
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: Activity update
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
Polar AccessLink
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens
- Webhook samples: PING; Exercise; Sleep; Continuous heart rate; SleepWise circadian bedtime; SleepWise alertness; Activity summary; Physical information
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{local_url}}
Withings
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens
- Webhook samples: appli 1: Weight & body composition; appli 4: Blood pressure & heart rate; appli 16: Activity; appli 44: Sleep summary; appli 54: ECG measurement; appli 55: ECG measurement failed; appli 50: Bed in; appli 46: User profile change
- Variables: {{client_id}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{nonce}}, {{signature}}, {{local_url}}
Wahoo
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 2b. Exchange the code for tokens (PKCE app); 3. Refresh the access token; 3b. Refresh the access token (PKCE app)
- Webhook samples: Workout summary
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{code_verifier}}, {{code_challenge}}, {{auth_code}}, {{refresh_token}}, {{local_url}}, {{webhook_token}}
Dexcom
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}
Suunto
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}
Google Health API
- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: Upsert (time-series data); Delete (time-series data); Delete (identifiable data); Full-day activity; Endpoint verification
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
Terra
- Webhook samples: S3 payload (ping mode)
- Variables: {{local_url}}
Import into Postman
- Download the vendor's .postman_collection.json.
- In Postman, open your workspace, click Use resources or import, select the Import tab, and drop the file in or paste its URL.
- Create an environment with client_id, redirect_uri and scope, and client_secret as a secret value. The collection's own variables are empty placeholders.
Open in Bruno
- Download the vendor's .bruno.zip and unzip it: it holds one folder with bruno.json, a .bru file per request and environments/Local.bru.
- In Bruno, click the + button and select Import Collection, then choose Bruno Collection and select that folder (Bruno also imports the Postman file directly).
- Select the Local environment and fill in its values; client_secret is declared there as a secret variable (vars:secret) and ships empty.
Steps from Postman Collection Format v2.1.0 schema, Postman Docs, “Import data into Postman”, Bruno Docs, “Import collections”, Bruno Docs, “Bru Markup Language”, read 2026-11-06.
How the collections are made
- Generated by scripts/build-collections.mjs from src/data/oauthVendors.ts and src/data/webhookPayloads.ts only. Each token request carries exactly the fields the OAuth playground's curl command carries for that vendor, and a test compares the two.
- Where a vendor documents no refresh call (Polar, Withings, Suunto) there is no refresh request, and the folder says why. Withings' token exchange needs a nonce and a signature computed with your secret; the collection leaves both as variables rather than compute them.
- Webhook requests send the vendor's printed example unchanged, signature headers included as the vendor's placeholders, so a handler that verifies signatures will reject them. For signed requests, use the mock sender at /webhooks/send-sample.mjs.
- Every Postman file was checked against Postman's v2.1.0 JSON Schema when generated (read 2026-11-06), and every .bru file against Bruno's own parser (@usebruno/lang 0.41.0); the committed tests check the structure on every build.
The facts behind each request, with the vendor sentence they rest on, are on the OAuth playground and in the webhook payload library. Free to share under CC BY 4.0: credit AIFitnessAPI and link https://aifitnessapi.com/collections.