{
  "info": {
    "_postman_id": "aifitnessapi-withings",
    "name": "Withings (aifitnessapi.com)",
    "description": "Withings: OAuth 2.0 and Webhook samples requests built from the vendor documentation aifitnessapi.com quotes. Generated by scripts/build-collections.mjs; no secrets included. https://aifitnessapi.com/collections",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "OAuth 2.0",
      "description": "Withings's authorization-code flow as its documentation describes it, read 2026-11-05. Fill client_id, redirect_uri and scope in an environment of your own and keep client_secret there, never in a shared collection. No refresh request: Withings says to call the same requesttoken service with the refresh token and always keep the new refresh token, but its snippet shows only the code exchange, so this tool prints no refresh command rather than guess its parameters.\n\nThe same facts, with each source sentence, at https://aifitnessapi.com/integrate/withings-api and https://aifitnessapi.com/tools/oauth-playground.",
      "item": [
        {
          "name": "1. Authorization URL (open in a browser)",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "https://account.withings.com/oauth2_user/authorize2?response_type=code&client_id={{client_id}}&redirect_uri={{redirect_uri}}&scope={{scope}}&state={{state}}",
              "protocol": "https",
              "host": [
                "account",
                "withings",
                "com"
              ],
              "path": [
                "oauth2_user",
                "authorize2"
              ],
              "query": [
                {
                  "key": "response_type",
                  "value": "code"
                },
                {
                  "key": "client_id",
                  "value": "{{client_id}}"
                },
                {
                  "key": "redirect_uri",
                  "value": "{{redirect_uri}}"
                },
                {
                  "key": "scope",
                  "value": "{{scope}}"
                },
                {
                  "key": "state",
                  "value": "{{state}}"
                }
              ]
            },
            "description": "https://account.withings.com/oauth2_user/authorize2. Authorization URL. Open this URL in a browser (in Postman: copy it from the request bar); the user signs in and Withings redirects to {{redirect_uri}} with ?code=… Put that value in the auth_code variable.\n\nSource: Withings developer guide, “Authorization URL”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/oauth-authorization-url/\n\nScope: Comma-separated, as in Withings' example URL. Source: Withings developer guide, “Authorization URL”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/oauth-authorization-url/\n\nDocumented scopes (joined with commas):\n- user.info: Account information, linked devices, goals, and device linking; also needed to list and subscribe to user-related notifications\n- user.metrics: Health measurements, heart recordings, stethoscope data and goals; also needed for notification management\n- user.activity: Physical activity and sleep; also needed for notification management\n- user.sleepevents: Notifications for sleep events (bed in, bed out, inflate done)\n\nPKCE: Not mentioned on the Withings authorization or token pages."
          },
          "response": []
        },
        {
          "name": "2. Exchange the code for tokens",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "https://wbsapi.withings.net/v2/oauth2",
              "protocol": "https",
              "host": [
                "wbsapi",
                "withings",
                "net"
              ],
              "path": [
                "v2",
                "oauth2"
              ]
            },
            "description": "https://wbsapi.withings.net/v2/oauth2. Token exchange: POST action=requesttoken to https://wbsapi.withings.net/v2/oauth2, with a nonce and a signature computed from your client secret (Withings' “Request Signature” page).\n\nSource: Withings developer guide, “Access and refresh tokens”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/access-and-refresh-tokens-no-recover/\n\nWithings signs this request: get a nonce from its signature service and compute the signature with your client secret as its “Request Signature” page describes, then put both in the nonce and signature variables. This collection does not compute them.\n\nToken lifetime: Access token 3 hours; refresh token 1 year; the old refresh token lasts 8 hours after a new one is issued, or until the new access token is used. Source: Withings developer guide, “Access and refresh tokens”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/access-and-refresh-tokens-no-recover/\n\nNote: The authorization code is valid for 30 seconds. Source: Withings developer guide, “Authorization URL”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/oauth-authorization-url/\n\nNote: Refresh tokens rotate: replace the stored one every time. Source: Withings developer guide, “Access and refresh tokens”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/access-and-refresh-tokens-no-recover/\n\nNote: mode=demo on the authorization URL logs in a demo user for testing. Source: Withings developer guide, “Authorization URL”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/oauth-authorization-url/\n\nNote: The token request is signed: Withings' snippet adds a signature computed with the client secret. Source: Withings developer guide, “Access and refresh tokens”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/access-and-refresh-tokens-no-recover/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "action",
                  "value": "requesttoken",
                  "type": "text"
                },
                {
                  "key": "client_id",
                  "value": "{{client_id}}",
                  "type": "text"
                },
                {
                  "key": "grant_type",
                  "value": "authorization_code",
                  "type": "text"
                },
                {
                  "key": "code",
                  "value": "{{auth_code}}",
                  "type": "text"
                },
                {
                  "key": "redirect_uri",
                  "value": "{{redirect_uri}}",
                  "type": "text"
                },
                {
                  "key": "nonce",
                  "value": "{{nonce}}",
                  "type": "text"
                },
                {
                  "key": "signature",
                  "value": "{{signature}}",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        }
      ]
    },
    {
      "name": "Webhook samples",
      "description": "Withings's documented example notifications, sent to {{local_url}} (your local handler) unchanged. Signature: No body signature. Append a secret query parameter to the callback URL (Withings' example: ?token=<random-secret>) and check it, plus an allowlist of the IP ranges Withings publishes as DNS TXT records. Source: Withings developer guide, “Notifications overview”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-overview/\n\nHeaders that carry a signature hold the placeholder Withings prints, so a handler that verifies signatures will reject these: to send correctly signed requests, use https://aifitnessapi.com/webhooks/send-sample.mjs. Respond: An application/x-www-form-urlencoded POST; return HTTP 2xx within a few seconds, then fetch the data from the Data API.\n\nPayload library with JSON Schemas: https://aifitnessapi.com/webhooks#withings.",
      "item": [
        {
          "name": "appli 1: Weight & body composition",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "A new weight or body composition measurement was recorded by a Withings scale.\n\nWithings' example for appli 1. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "1",
                  "type": "text"
                },
                {
                  "key": "startdate",
                  "value": "1530576000",
                  "type": "text"
                },
                {
                  "key": "enddate",
                  "value": "1530698753",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 4: Blood pressure & heart rate",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "A new blood pressure measurement (and heart rate, when supported) was recorded.\n\nWithings' example for appli 4. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "4",
                  "type": "text"
                },
                {
                  "key": "startdate",
                  "value": "1530576000",
                  "type": "text"
                },
                {
                  "key": "enddate",
                  "value": "1530576120",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 16: Activity",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "New activity data is available — steps, distance, calories, intensity, or workouts.\n\nWithings' example for appli 16. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "16",
                  "type": "text"
                },
                {
                  "key": "date",
                  "value": "2018-07-02",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 44: Sleep summary",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "New sleep data is available — duration, sleep state, deep/light state duration (no REM), and wakeup counts.\n\nWithings' example for appli 44. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "44",
                  "type": "text"
                },
                {
                  "key": "startdate",
                  "value": "1530576000",
                  "type": "text"
                },
                {
                  "key": "enddate",
                  "value": "1530604800",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 54: ECG measurement",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "A new ECG recording was completed.\n\nWithings' example for appli 54. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "54",
                  "type": "text"
                },
                {
                  "key": "startdate",
                  "value": "1530576000",
                  "type": "text"
                },
                {
                  "key": "enddate",
                  "value": "1530576030",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 55: ECG measurement failed",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "An ECG recording was attempted but failed; notification only.\n\nWithings' example for appli 55. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "55",
                  "type": "text"
                },
                {
                  "key": "date",
                  "value": "1530576000",
                  "type": "text"
                },
                {
                  "key": "deviceid",
                  "value": "abc123",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 50: Bed in",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "The user lay down on the bed (Withings Sleep sensor); notification only.\n\nWithings' example for appli 50. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "50",
                  "type": "text"
                },
                {
                  "key": "date",
                  "value": "1530576000",
                  "type": "text"
                },
                {
                  "key": "deviceid",
                  "value": "abc123",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "appli 46: User profile change",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "{{local_url}}",
              "host": [
                "{{local_url}}"
              ]
            },
            "description": "The user account was deleted, unlinked from your app, or updated; notification only.\n\nWithings' example for appli 46. Source: Withings developer guide, “Notification categories”, https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/data-api/notifications/notification-content/",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "userid",
                  "value": "12345",
                  "type": "text"
                },
                {
                  "key": "appli",
                  "value": "46",
                  "type": "text"
                },
                {
                  "key": "action",
                  "value": "update",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        }
      ]
    }
  ],
  "variable": [
    {
      "key": "client_id",
      "value": "",
      "type": "string",
      "description": "Your app's client ID, from the vendor's developer console."
    },
    {
      "key": "redirect_uri",
      "value": "",
      "type": "string",
      "description": "The redirect URI registered with the vendor."
    },
    {
      "key": "scope",
      "value": "",
      "type": "string",
      "description": "Scopes to request, joined as the vendor documents (see the authorization request)."
    },
    {
      "key": "state",
      "value": "",
      "type": "string",
      "description": "A random value you check on the redirect."
    },
    {
      "key": "auth_code",
      "value": "",
      "type": "string",
      "description": "The ?code= value from the redirect."
    },
    {
      "key": "nonce",
      "value": "",
      "type": "string",
      "description": "Withings: the nonce from its signature service."
    },
    {
      "key": "signature",
      "value": "",
      "type": "string",
      "description": "Withings: the signature computed with your client secret."
    },
    {
      "key": "local_url",
      "value": "http://localhost:3000/webhooks/withings",
      "type": "string",
      "description": "Where your webhook handler listens."
    }
  ]
}