UserId in HeartBeat API

[rjc3332]

Hi,

Is it possible to access other user's heartrate, using the Heart rate api? 

GET https://api.fitbit.com/1/user/[user-id]/activities/heart/date/[date]/[period].json

From the API documentation, there is an option to pass the encoded user Id ? 

[GordonFitbit]

Hi @rjc3332, 

Yes, it is possible to access other user's heart rate using the heart rate APIs.  The authorization to share another user's Fitbit data is enabled through Web APIs OAuth 2.0 implementation.  When another Fitbit user registers to use your application, they should be prompted with the scopes page to share their heart rate data.  Once authorization is complete, you will have an access token for that user that is provided with heart rate api calls.  

Here's the link to the documentation on obtaining consent, https://dev.fitbit.com/build/reference/web-api/oauth2/.

[rjc3332]

Thanks Gordon.

Is it possible to access the data for the user who has registered to use the application, using my access code ?

If no, then what is the significance of the [user-id]in the api request given below, as the access token can access only the current users data.

GET https://api.fitbit.com/1/user/[user-id]/activities/heart/date/[date]/[period].json

[GordonFitbit]

The <user-id> argument allows you to get information from a different user than the user assigned to the token.  For example, you want to see data of your friend, and your friend granted access to share their data with you.

if you pass "-" then it will pull user id from token
if it is not "-" then we will see check if user specified in the token has access to user that is used in URL

[rjc3332]

We tried to get the friends data by passing the friends userID, but we are getting the following error:

{
"errors": [
{
"errorType": "insufficient_permissions",
"message": "API client is not authorized by the resource owner to access the resource requested. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
}
],
"success": false
}

But when we use the access token of the friend to execute the request, we are getting the data without any issues.

[GordonFitbit]

Hi @rjc3332 

Would you please private message me the following information and I'll investigate it?

1. your client ID
2. the user id of the person authorizing the application
3. the friend's user id
4. the API call and all headers executed which fails
5. the rough timestamp when the call is executed.  It needs to be within the last 7 days

Thanks!

Gordon

[GordonFitbit]

Hi @rjc3332 

Through my research, I've discovered that the process I described to you for accessing someone else's data might have been available when the APIs were first created.  Over the years, we've increased the security of our user's data and don't allow you to specify user #1's access token to query user #2's data. 

Today, I see developers specify "-", or the user id that is representative of the access token, in the API calls.  Both are suitable and I'm sure there are various reasons to chose one over the other.  I suppose if you want more visibility into who's data you're querying, adding the user id into the API makes sense.

For now, if you want to query someone's data, you need to get that person to authorize access to share it.  If you need heart rate data for your application, you cannot force someone to expose their data if they don't want to.   Instead, I'd recommend telling your users something like "For the best user experience with my application, please share the following data..."

Gordon