August 2015 Web API Changes

[JeremiahFitbit]

1. Heart rate time series will now only include data points when Fitbit believes the device was being worn. This change affects all heart rate data ever captured by a Fitbit device. You might consider re-requesting heart rate data retrieved prior to July 25, 2015.

2. Your application should consider all numerical ids in the Fitbit API to be unsigned 64 bit integers. Many ids will cross the maximum 32 bit integer in the next couple of weeks.

3. OAuth 2.0 requests will be restricted to JSON and TCX formats. XML will no longer be supported with OAuth 2.0 requests starting August 17, 2015.

4. The custom logging endpoints (deprecated in October 2014) will be removed on August 27, 2015.

• API-Get-Heart-Rate (e.g. GET /1/user/-/heart/date/2010-02-21.json, replaced with heart rate time series)
• API-Log-Heart-Rate (e.g. POST /1/user/-/heart.json)
• API-Delete-Heart-Rate-Log (e.g. DELETE /1/user/-/heart/123.json)
• API-Get-Blood-Pressure (e.g. GET /1/user/-/bp/date/2010-02-21.json)
• API-Log-Blood-Pressure (e.g. POST /1/user/-/bp.json)
• API-Delete-Blood-Pressure-Log (e.g. DELETE /1/user/-/bp/123.json)
• API-Get-Glucose (e.g. GET /1/user/-/glucose/date/2010-02-21.json)
• API-Log-Glucose (e.g. POST /1/user/-/glucose.json)
• API-Get-Body-Measurements (e.g. GET /1/user/-/body/date/2010-02-21.json)
• API-Log-Body-Measurements (e.g. POST /1/user/-/body.json)
• All measurements except fat and weight will be removed from API-Get-Body-Measurements (e.g. GET /1/user/-/body/date/2010-02-21.json) and API-Log-Body-Measurements (e.g. POST /1/user/-/body.json)

[JeremiahFitbit]

---

@EvanBasalik wrote:

So, this functionally means that the XML variants of even the old APIs will no longer work? That's a pretty big breaking change.

---

No, it means that if you upgrade your application to use the OAuth 2.0 beta, you will also need to upgrade to JSON. XML will still be available when making requests using OAuth 1.0a authentication.

[JeremiahFitbit]

---

@terrylau wrote:

Will Fitbit API still support OAuth 1.0?

---

Fitbit will fully support OAuth 1.0a until OAuth 2.0 leaves the beta stage. At that time, OAuth 1.0a will be marked as deprecated and a timeline for its removal will be announced.

[JeremiahFitbit]

---

@Bonxy wrote:
Jeremiah, does everyone who makes the switch to api2 require users to re auth with the app?

---

No. We've built a way for applications to exchange a user's OAuth 1.0a access token and access token secret for an OAuth 2.0 access token and refresh token. See the Migrating from OAuth 1.0a section of the docs.

Users will only need to re-authenticate with your application if your application would like access to the new heart rate and location resources.

[JeremiahFitbit]

---

@aditya14641 wrote:

"Your application should consider all numerical ids in the Fitbit API to be unsigned 64 bit integers. Many ids will cross the maximum 32 bit integer in the next couple of weeks."

Can you please state an example of this in current api ?

---

Sure. Let's say I'm logging an activity. My request:

POST /1/user/-/activities.json?activityId=90009&startTime=12%3A20&durationMillis=600000&date=2015-08-12&distance=1.5 HTTP/1.1

Authorization: OAuth oauth_consumer_key="redacted",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1439401101",oauth_nonce="1976725700",oauth_version="1.0",oauth_token="redacted",oauth_signature="q%2FIvVun%2FGdlybMlm%2Bm8r8CZBEO0%3D"
Host: api.fitbit.com
Content-Length: 0
X-Target-URI: https://api.fitbit.com
Connection: Keep-Alive

The response:

HTTP/1.1 201 Created

Content-Language: en
Cache-control: no-cache, must-revalidate
Fitbit-Rate-Limit-Limit: 150
Content-Length: 342
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Connection: keep-alive
Server: nginx
X-Frame-Options: SAMEORIGIN
Date: Wed, 12 Aug 2015 17:38:21 GMT
Vary: Accept-Encoding
Fitbit-Rate-Limit-Remaining: 149
Fitbit-Rate-Limit-Reset: 1299
Content-Type: application/json;charset=UTF-8

{
  "activityLog": {
    "activityId": 90009,
    "activityParentId": 90009,
    "activityParentName": "Run",
    "calories": 155,
    "description": "5 mph (12 min/mile)",
    "distance": 1.5,
    "duration": 600000,
    "hasStartTime": true,
    "isFavorite": false,
    "lastModified": "2015-08-12T17:38:21.690Z",
    "logId": 300791479,
    "name": "Run",
    "startDate": "2015-08-12",
    "startTime": "12:20",
    "steps": 1575
  }
}

Anywhere your application handles integer ids from the Fitbit API, such as the logId in the above example, your app should allocate space for an unsigned 64 bit integer. Many ids will soon be larger than the maximum unsigned 32 bit integer (4,294,967,295).

[Gojuman]

Some the the custom features such as glucose, body measurements, and blood pressure are really important. Why are you removing such a great and vital functionality to the software app?

[Charan]

How do fitbit confims whether device is worn by the user or not ?? For a new user since 8thAugust2015, Iam unable to fetch the heart data? What is the triggering point? Can we fetch the heart data? If possible then how ? any answer other than the normal api call for Heart rate

[jasondias]

Hi Jerramiah, 

When will point 1, regarding heart rate time data become effective ?

Thanks,

Jason

[Cameron1]

Exactly! I'm wondering the same thing.

I saw these were deprecated in October. I thought to myself, I'm sure they'll have something thing in place to replace it by next year...and here we are 20 days from October. Good grief.

[JeremiahFitbit]

@Cameron1: What are you expecting? We are not replacing the custom logging features. The heart rate endpoints have been replaced.

[JeremiahFitbit]

@jasondias: The custom logging endpoints are now officially removed, though still accessible. They will begin returning 404 errors in the near future. The heart rate endpoints were replaced and made available when OAuth 2.0 beta was announced.

[jasondias]

@JeremiahFitbit what I meant was, when will the api begin only returning data endpoints when the device was being worn? Previously, the api returned null. 

[Cameron1]

So I guess I'm confused by this post because it says custom trackers were dropped. I will still be able to use custom trackers?

http://help.fitbit.com/articles/en_US/Help_article/What-else-can-I-track-on-my-Fitbit-dashboard

[JeremiahFitbit]

@Cameron1: No, custom trackers were removed from the Web app. The old heart rate logging, blood pressure, blood glucose were also removed from the Web app and their associated API endpoints are being removed.