---
title: "Postman and Bruno collections for wearable APIs"
canonical: "https://aifitnessapi.com/collections"
markdown: "https://aifitnessapi.com/collections.md"
type: "record"
last_reviewed: "2026-11-05"
description: "Import-ready Postman (v2.1) and Bruno collections for Oura, WHOOP, Strava, Polar, Withings, Wahoo, Dexcom, Suunto, Google Health and Terra. No secrets."
publisher: "AIFitnessAPI — funded by KinesteX; first-party pages disclose it"
cite_as: "\"Postman and Bruno collections for wearable APIs\", AIFitnessAPI, https://aifitnessapi.com/collections"
---

# Postman and Bruno collections for wearable APIs

> Download a Postman collection (Collection Format v2.1.0) or a Bruno collection folder for 10 wearable and health APIs: 9 with the vendor's OAuth 2.0 authorization URL, code-for-token exchange and, where documented, refresh request, using {{client_id}}-style variables, and 8 with the vendor's documented webhook examples posted to {{local_url}}, 53 requests in all. They are generated from the same vendor quotes as the OAuth playground and the webhook payload library (read 2026-11-05), and ship no secrets: client_secret and every token are empty variables you fill in your own environment.

- Canonical: https://aifitnessapi.com/collections
- Last reviewed: 2026-11-05
- Publisher: AIFitnessAPI (https://aifitnessapi.com)
- Cite as: "Postman and Bruno collections for wearable APIs", AIFitnessAPI, https://aifitnessapi.com/collections

---

## Download a collection

### Oura

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: Data event
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{code_verifier}}, {{code_challenge}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
- [Postman v2.1 (13 KB)](https://aifitnessapi.com/collections/oura.postman_collection.json) · [Bruno folder, .zip (8 KB)](https://aifitnessapi.com/collections/oura.bruno.zip)

### WHOOP

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: v2 example: sleep.updated; Field-table example: workout.updated
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
- [Postman v2.1 (13 KB)](https://aifitnessapi.com/collections/whoop.postman_collection.json) · [Bruno folder, .zip (8 KB)](https://aifitnessapi.com/collections/whoop.bruno.zip)

### Strava

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: Activity update
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
- [Postman v2.1 (12 KB)](https://aifitnessapi.com/collections/strava.postman_collection.json) · [Bruno folder, .zip (8 KB)](https://aifitnessapi.com/collections/strava.bruno.zip)

### Polar AccessLink

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens
- Webhook samples: PING; Exercise; Sleep; Continuous heart rate; SleepWise circadian bedtime; SleepWise alertness; Activity summary; Physical information
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{local_url}}
- [Postman v2.1 (19 KB)](https://aifitnessapi.com/collections/polar.postman_collection.json) · [Bruno folder, .zip (12 KB)](https://aifitnessapi.com/collections/polar.bruno.zip)

### Withings

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens
- Webhook samples: appli 1: Weight & body composition; appli 4: Blood pressure & heart rate; appli 16: Activity; appli 44: Sleep summary; appli 54: ECG measurement; appli 55: ECG measurement failed; appli 50: Bed in; appli 46: User profile change
- Variables: {{client_id}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{nonce}}, {{signature}}, {{local_url}}
- [Postman v2.1 (22 KB)](https://aifitnessapi.com/collections/withings.postman_collection.json) · [Bruno folder, .zip (13 KB)](https://aifitnessapi.com/collections/withings.bruno.zip)

### Wahoo

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 2b. Exchange the code for tokens (PKCE app); 3. Refresh the access token; 3b. Refresh the access token (PKCE app)
- Webhook samples: Workout summary
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{code_verifier}}, {{code_challenge}}, {{auth_code}}, {{refresh_token}}, {{local_url}}, {{webhook_token}}
- [Postman v2.1 (16 KB)](https://aifitnessapi.com/collections/wahoo.postman_collection.json) · [Bruno folder, .zip (11 KB)](https://aifitnessapi.com/collections/wahoo.bruno.zip)

### Dexcom

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}
- [Postman v2.1 (9 KB)](https://aifitnessapi.com/collections/dexcom.postman_collection.json) · [Bruno folder, .zip (5 KB)](https://aifitnessapi.com/collections/dexcom.bruno.zip)

### Suunto

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}
- [Postman v2.1 (6 KB)](https://aifitnessapi.com/collections/suunto.postman_collection.json) · [Bruno folder, .zip (4 KB)](https://aifitnessapi.com/collections/suunto.bruno.zip)

### Google Health API

- OAuth 2.0: 1. Authorization URL (open in a browser); 2. Exchange the code for tokens; 3. Refresh the access token
- Webhook samples: Upsert (time-series data); Delete (time-series data); Delete (identifiable data); Full-day activity; Endpoint verification
- Variables: {{client_id}}, {{client_secret}}, {{redirect_uri}}, {{scope}}, {{state}}, {{auth_code}}, {{refresh_token}}, {{local_url}}
- [Postman v2.1 (21 KB)](https://aifitnessapi.com/collections/google-health.postman_collection.json) · [Bruno folder, .zip (16 KB)](https://aifitnessapi.com/collections/google-health.bruno.zip)

### Terra

- Webhook samples: S3 payload (ping mode)
- Variables: {{local_url}}
- [Postman v2.1 (3 KB)](https://aifitnessapi.com/collections/terra.postman_collection.json) · [Bruno folder, .zip (3 KB)](https://aifitnessapi.com/collections/terra.bruno.zip)

## Import into Postman

1. Download the vendor's .postman_collection.json.
2. In Postman, open your workspace, click Use resources or import, select the Import tab, and drop the file in or paste its URL.
3. Create an environment with client_id, redirect_uri and scope, and client_secret as a secret value. The collection's own variables are empty placeholders.

## Open in Bruno

1. Download the vendor's .bruno.zip and unzip it: it holds one folder with bruno.json, a .bru file per request and environments/Local.bru.
2. In Bruno, click the + button and select Import Collection, then choose Bruno Collection and select that folder (Bruno also imports the Postman file directly).
3. Select the Local environment and fill in its values; client_secret is declared there as a secret variable (vars:secret) and ships empty.

Steps from [Postman Collection Format v2.1.0 schema](https://schema.getpostman.com/json/collection/v2.1.0/collection.json), [Postman Docs, “Import data into Postman”](https://learning.postman.com/docs/getting-started/importing-and-exporting/importing-data/), [Bruno Docs, “Import collections”](https://docs.usebruno.com/get-started/import-export-data/import-collections), [Bruno Docs, “Bru Markup Language”](https://docs.usebruno.com/bru-lang/overview), read 2026-11-06.

## How the collections are made

- Generated by scripts/build-collections.mjs from src/data/oauthVendors.ts and src/data/webhookPayloads.ts only. Each token request carries exactly the fields the OAuth playground's curl command carries for that vendor, and a test compares the two.
- Where a vendor documents no refresh call (Polar, Withings, Suunto) there is no refresh request, and the folder says why. Withings' token exchange needs a nonce and a signature computed with your secret; the collection leaves both as variables rather than compute them.
- Webhook requests send the vendor's printed example unchanged, signature headers included as the vendor's placeholders, so a handler that verifies signatures will reject them. For signed requests, use the mock sender at /webhooks/send-sample.mjs.
- Every Postman file was checked against Postman's v2.1.0 JSON Schema when generated (read 2026-11-06), and every .bru file against Bruno's own parser (@usebruno/lang 0.41.0); the committed tests check the structure on every build.

The facts behind each request, with the vendor sentence they rest on, are on the [OAuth playground](https://aifitnessapi.com/tools/oauth-playground) and in the [webhook payload library](https://aifitnessapi.com/webhooks). Free to share under CC BY 4.0: credit AIFitnessAPI and link https://aifitnessapi.com/collections.