Missing CORS response header for activity APIs

[jl__]

I've had users report errors that started happening this morning (Sep 1). Based on the browser console screenshots they provided, some of the API responses are missing CORS headers (specifically, access-control-allow-origin). This completely breaks functionality on our website because we make API requests from the browser rather than via a backend.

It looks like it was due to a change/rollout in the API, since it started affecting a subset of users earlier and is now affecting everyone.

It's only happening for activity APIs, such as the steps/distance timeseries. Other APIs like sleep and heart timeseries are unaffected.

[RobertDev]

Same problem here. Application is totally broken now. 😞

[JohnFitbit]

Hey @jl__,

Thanks for reporting this issue. We're looking into it!

I'll update this thread if we need additional information from everyone impacted.

[Stevo1234]

Is there an update on the fix or when it will likely be fixed?

[jl__]

I haven't seen this particular issue (missing CORS headers) for myself or my users since Sep 6 so hopefully it's been resolved.

[Stevo1234]

At the time of writing this is what shows up on fitbit / cronometer apps - Cronometer should be showing at least 2776 calories burned.

[RobertDev]

This problem is back (missing CORS headers). I get it now on the profile endpoint, but maybe more places.

Hope this can be fixed soon, because this error breaks many apps.