Platform and audit resources

Use platform endpoints to verify OAuth client context and to inspect which Public API resources are available to an integration. Audit endpoints are read-only and intentionally redact request headers, raw response bodies, token identifiers, IP addresses, user agents, provider payloads, and secrets.

Scopes

Scope	Allows
`platform:read`	Read the authenticated API client profile, capability list, and scope catalog.
`audit_logs:read`	Read redacted Public API audit log metadata for the authenticated company.

Get API client profile

GET /public/v1/me
Authorization: Bearer <access_token>

Required scope: platform:read Response fields:

Field	Type	Nullable	Description
`data.profile.clientId`	string	no	Public API OAuth client ID.
`data.profile.publicApiClientId`	string	no	Public API client document ID.
`data.profile.companyId`	string	no	Authenticated company ID.
`data.profile.name`	string	no	Client display name.
`data.profile.status`	string	no	`active` or `revoked`.
`data.profile.scopes[]`	array	no	Scopes granted to the access token.
`data.profile.createdAt`	string	yes	Client creation timestamp.
`data.profile.updatedAt`	string	yes	Client update timestamp.

The response never includes client secrets, secret hashes, token hashes, tokenId, last-used IP, or raw auth headers.

Health

GET /public/v1/health
Authorization: Bearer <access_token>

Required scope: platform:read This endpoint is a lightweight authenticated health check for integrations. It uses Public API bearer authentication and the same company-bound token context, but it intentionally returns a compact health payload instead of a full resource DTO. Response fields:

Field	Type	Nullable	Description
`status`	string	no	`ok` when the API process accepted the authenticated request.
`company`	string	yes	Company ID derived from the bearer token.

The request never accepts companyId from the query string or body.

List capabilities

GET /public/v1/capabilities
Authorization: Bearer <access_token>

Required scope: platform:read Response fields:

Field	Type	Nullable	Description
`data.capabilities.scopes[].value`	string	no	Available Public API scope value.
`data.capabilities.endpoints[].method`	string	no	HTTP method.
`data.capabilities.endpoints[].path`	string	no	Public API path template.
`data.capabilities.endpoints[].scope`	string	no	Scope required by the endpoint.

Nutrition and workout endpoints are intentionally not listed in this v1 capability catalog.

List scopes

GET /public/v1/scopes
Authorization: Bearer <access_token>

Required scope: platform:read Response fields:

Field	Type	Nullable	Description
`data.scopes[].value`	string	no	Available Public API scope value.

This endpoint returns only the scope catalog. It does not return endpoint metadata, OAuth client secrets, token IDs, token hashes, or company internals.

List audit logs

GET /public/v1/audit-logs?page=1&limit=100&eventType=resource.denied
Authorization: Bearer <access_token>

Required scope: audit_logs:read Query parameters:

Parameter	Type	Required	Rule
`page`	integer	no	Minimum `1`.
`limit`	integer	no	Default `100`, maximum `100`.
`eventType`	string	no	Filter by audit event type.
`clientId`	string	no	Filter by Public API OAuth client ID.

Response fields:

Field	Type	Nullable	Description
`data.page`	integer	no	Current page.
`data.limit`	integer	no	Page size after cap.
`data.total`	integer	no	Total matching audit logs.
`data.totalPages`	integer	no	Total pages.
`data.hasNextPage`	boolean	no	Next page availability.
`data.hasPrevPage`	boolean	no	Previous page availability.
`data.auditLogs[].auditLogId`	string	no	Audit log ID.
`data.auditLogs[].publicApiClientId`	string	yes	Public API client document ID.
`data.auditLogs[].clientId`	string	no	Public API OAuth client ID.
`data.auditLogs[].eventType`	string	no	Audit event type.
`data.auditLogs[].method`	string	no	HTTP method when available.
`data.auditLogs[].path`	string	no	Request path when available.
`data.auditLogs[].statusCode`	integer	yes	HTTP status code when recorded.
`data.auditLogs[].scopes[]`	array	no	Token scopes recorded for the request.
`data.auditLogs[].reason`	string	no	Redacted reason when present.
`data.auditLogs[].createdAt`	string	yes	Audit timestamp.

Get audit log

GET /public/v1/audit-logs/{auditLogId}
Authorization: Bearer <access_token>

Required scope: audit_logs:read Response fields:

Field	Type	Nullable	Description
`data.auditLog.auditLogId`	string	no	Audit log ID.
`data.auditLog.publicApiClientId`	string	yes	Public API client document ID.
`data.auditLog.clientId`	string	no	Public API OAuth client ID.
`data.auditLog.eventType`	string	no	Audit event type.
`data.auditLog.method`	string	no	HTTP method when available.
`data.auditLog.path`	string	no	Request path when available.
`data.auditLog.statusCode`	integer	yes	HTTP status code when recorded.
`data.auditLog.scopes[]`	string[]	no	Token scopes recorded for the request.
`data.auditLog.reason`	string	no	Redacted reason when present.
`data.auditLog.createdAt`	string	yes	Audit timestamp.

Invalid ID shape returns 400 PUBLIC_API_INVALID_AUDIT_LOG_ID; unknown company-scoped IDs return 404 PUBLIC_API_AUDIT_LOG_NOT_FOUND.

Start here

Public API guides

Access Devices

Scopes

Get API client profile

Health

List capabilities

List scopes

List audit logs

Get audit log

​Scopes

​Get API client profile

​Health

​List capabilities

​List scopes

​List audit logs

​Get audit log

Scopes

Get API client profile

Health

List capabilities

List scopes

List audit logs

Get audit log