Developer resources (API)


This page refers to a deprecated version of the Withings API. We strongly recommend developers to use version 2 of our API that is documented at http://www.withings.com/en/api/wbsapiv2

Contents


  • Introduction
  • Basics
  • Identification
  • Service Catalog

Introduction



Withings Body metrics Services API (WBS API) is a set of webservices allowing developers and third parties limited access to users' data.

Prior to any access by an external application, the user has to explicitly allow their data to be accessed through the WBS API. This can be done either by the user in my.withings.com or by the user from a third party's web site using its proper email/password combination.

It is freely available for non-commercial use by any developer and may be licensed (or freely licensed in some cases) for commercial use by prior arrangement. Please issue requests here

A small PHP library is available to illustrate this documentation. Giving it a look will save you time. It is here.

Stefan Andersen feeled the urge to rewrite this sample code using more classes and exceptions. You can find it here.


If you are an iPhone developer, you may download the sample iPhone application source code. This application is a example of code to illustrate the API and not the wiScale application. It will anyway save a lot of time to those integrating our API in an iPhone application.


Android developers can find sample code and more information about integration with Android applications in this page


Basics



Request format

The WBS API is REST-based. Basically, WBS requests are sent as HTTP POST or GET requests.

A typical WBS API service request follows this template :


http://wbsapi.withings.net/[service_name]?action=[action_name]&[parameters]

Where :
[service_name] is the requested service,
[action_name] is the action you want to perform on the requested service,
[parameters] are parameters, mandatory or optional, passed to the requested service.


Every service needs a mandatory action parameter. For example, the user service has two possible actions (getbyuserid and update). action is a parameter of the GET or POST request (user?action=getbyuserid)

For every thing you want to do, there is a service and an action. The measure?action=getmeas service, which gets anything ranging from the user's weight and body fat to blood pressure and heart pulse, is probably the most useful.


Response format

Responses to such requests are JSON documents. All responses look like the following:


{"status":0, "body":{} }

The body field may eventually be absent or empty, depending on the service/action requested and the success or failure of the requested action.
Any single response will provide a mandatory status field. A status value set to 0 means that the action was successfully processed. Other values mean the request was not processed properly. Please refer to the Error codes sections to get a hint as to what went wrong, and why.


A json library IS available for your programming language at http://www.json.org. Please don't try to parse a JSON document without first visiting this site. Use an already available JSON library: it saves a lot of effort.


As a first example (and this is a good starting point to check that this is working in your actual environement):


http://wbsapi.withings.net/once?action=probe

returns

{"status":0}


Identification


You typically use the WBS API to retrieve data related to a given user, for example weight and body fat or blood pressure measurements. A user is part of an account.

An account is what Withings device users use to log into their dashboard. An account is uniquely defined by an email address. For access to be granted to a given account, its password (chosen by the user at registration time) is needed. A single account might be used by several device users (a parent and their young kids), or each user might have their own account.

However, Withings currently offers two kinds of accounts : standard accounts and professional oriented accounts. The later differentiates from the fact that it only contains an anonymous 'Unknown user' and that additional users can not be added. Since professional oriented accounts only feature the 'unknown' user, the API will only obviously only give access to that user. On the other hand, for standard accounts, only users created through the "Add a new user" button will be accessible through the API.

A user (as listed in the dashboard's leftmost part) of a Withings device is uniquely defined by a userid and the publickey. In most requests, those two parameters are mandatory. Both can be found, for testing, in the 'Share' overlay within the user's dashboard at http://my.withings.com.


They are two ways of obtaining the userid and a publickey of a specific user.
  • The user can send to your application an email from its Withings account, as explained here.
  • You may ask, from your website, the user for their Withings account credentials as explained here.


  • Notification


    The most effective way for third parties to retrieve measurements updates is to setup notifications (some might call it "Push") for the users they are interested in. Notifications are handled on a user-per-user basis : each third party application shall subscribe once for every user being monitored, as explained here. Each time the subscribed users use their device and make it create a new measurement, or manually add, delete or modify any measurement or objective, the WBS API will send notifications to all their monitoring third parties.


    Subscriptions will not be performed if the user has not allowed its profile to be public. A given user can not be subscribed by more than 16 third parties.


    When the WBS API sees that subscriber data has been modified, it sends a notification to the subscribing third party application. The notification contains information that helps to determine what should be downloaded to remain in sync.


    Notifications subscriptions last 3 weeks and it is the subscriber responsability to renew the subscription when necessary, as explained here. Checking for the existence of a subscription and the retrieval of its expiry date can be performed as shown here.

    The subscription can be revoked at anytime, as explained here



    Service Catalog


    Depending on what you want to do, you may use the following services:
    • I want to GET some (or all) measurements of a specific user for which I have the userid and the publickey. I use measure?action=getmeas . You may need to use user?action=update the target user to enable your access to a given type of device measures.
    • I want to GET available information for a specific user for which I have the userid and the publickey. I use user?action=getbyuserid .
    • I want to GET the list of the users (and their userid and publickey) within an account for which I have the email address and the password used during account registration. I use account?action=getuserslist .
    • I've just managed to convince a user to use my application. I use their email address and the password used during account registration to ensure Withings will share its data. I use user?action=update .
    • I would like my application to be notified of measurement related event for the users I supervise whenever as they happen. I use notify?action=subscribe.
    • I want to stop a notification I had put in place. I use notify?action=revoke.
    • I want to GET information about a notification I may have set up. I use notify?action=get.


    measure / getmeas


    Several use cases can be performed with this service, depending on its input parameters.


    Two parameters are mandatory in all cases: the userid and the publickey. ALL others are provided for filtering purposes and are optional.


    Please keep in mind that to access measures for a given device type, and prior to using measure/getmeas, it is necessary that the user explicitly shares the measures for the device type you want to access. Such sharing provisionning can be done explicitly by the user himself by checking the Enable XXX data sharing checkbox in the Sharing tab of his personal dashboard, where XXX is the device type you want to retrieve measures from.
    Alternatively, you can force such sharing through this API for a given device type by altering yourself the ispublic property of the user by using the user/update method, so that the sharing is enabled for the device types you need. To learn more about user/update, click here.

    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required userid integer The userid of the target user. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    publickey string The public key associated with the userid. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    optional startdate integer (EPOCH format) Will prevent retrieval of values dated prior to the supplied parameter.
    enddate integer (EPOCH format) Will prevent retrieval of values dated after the supplied parameter.
    devtype integer Will retrieve data for this particular device type. For exemple, using &devtype=1 will retrieve all body scale related measures (including weight, fatmass and fatfree mass), while using &devtype=0 will retrieve all user personal data (ie. the height and weight entered at user creation time). Can be used as a bitmask if necessary.
    meastype integer Will restrict the type of data retrieved (see below the type list). Please note that currently this filter only supports weight (ie type 1) height (ie type 4) types.
    lastupdate integer (EPOCH format) Is useful for performing data synchronization. It can be used by the system using the WBS API to supply the last time (EPOCH format) it acquired data. Only entries which have been added or modified since this time are retrieved.
    category integer Can be set to 2 to retrieve objectives or to 1 to retrieve actual measurements.
    limit integer Can be used to limit the number of measure groups returned in the result. For instance, setting &limit=1 will return the last measure group only. Measure groups are always delivered from the newest to the oldest one.
    offset integer Can be used to skip the 'offset' most recent measure group records of the result set. For instance, setting &offset=10 will return the 11th measure group and onward. Used in conjunction with limit, it can be used to acquire large data sets in several requests.


    user / getbyuserid


    This service will return an array containing information regarding the specified user.

    This can be used to retrive a user's firstname, lastname, gender, or birthdate.

    Issuing such a request on a professional account 'unknown' user will only yield id, firstname, ispublic and publickey elements since other ones are not significant for anonymous users.


    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required userid integer The userid of the target user. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    publickey string The public key associated with the userid. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.


    account / getuserslist


    This service can be used to retreive a user's publickey and userid using the email and password combination of a Withings account.
    This service is useful in case the user's data sharing has to be activated from a third party web site. It allows all operations to be performed from this remote web site without forcing the user to actually open a session at my.withings.com. The use of this service is an option. The other option available for the user to perform the same task is to use the 'Share' overlay of the dashboard and have the user send an email to the third party application as explained here.
    Using this service necessitates that the user trusts your website enough to enter their Withings account password. Please don't store it.
    Issuing such a request on a professional account 'unknown' user will only yield id, firstname, ispublic and publickey elements since other ones are not significant for anonymous users.

    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required email string The email address used at account creation.
    hash string An cryptographic signature derived from the user password. See here for a complete description and sample code.



    user / update


    For a user's data to be accessible through this API, a prior authorization has to be given. This can be done directly from the 'Share' overlay of the user Dashboard, or through the user?action=update service.
    Please note that setting the ispublic flag to zero automatically changes the publickey of the user to a new random value.

    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required userid integer The userid of the target user. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    publickey string The public key associated with the userid. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    ispublic integer A bitmask used to set or unset the types of measures made public by the user :

    value | b7 b6 b5 b4 b3 b2 b1 b0
        1 |                       x : body scale data
        4 |                 x       : blood pressure monitor data

    To unset the sharings, the value 0 must be used.

    For example, a value of 5 for ispublic (1+4) will force both blood pressure and body measurements sharing, a value of 4 will force only blood pressure measurements sharing.


    notify / subscribe


    This service allows third parties to subscribe to notifications. Once the notification service has been subscribed, the WBS API will notify the subscriber whenever the target user's measurements or objectives are added, modified or deleted.

    This allows third party applications to remain in sync with user's data.

    To monitor a user, its userid and publickey are needed. Please note that unless the subscribed users have made their measurements data public, no notifications will be sent (see user/update on how to enable it).


    Three parameters are mandatory in all cases : userid, publickey and callbackurl. The optional parameter appli can be used to restrict the request to the given device type.


    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required userid integer The userid of the user to subscribe notification for. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    required publickey string The public key associated with the userid. This can be obtained through an account/getuserslist or through the user's "Share" overlay in the dashboard.
    required callbackurl URL-encoded string The URL the API notification service will call. .
    WBS API notification are merely HTTP POST requests to this URL (such as http://www.yourdomain.net/yourCustomApplication.php ?userid=123456&startdate=1260350649&enddate=1260350650). Those requests contain startdate and enddate parameters (both are integers in EPOCH format) and the userid it refers to. It is up to the targeted system to issue a measure/getmeas request using both figures to retrieve updated data.
    This URL shall be provided as a URL-encoded string. Please refer to w3schools URL encoding reference to learn more about URL encoding, use free online URL encoders or check the example provided. The URL length shall not be greater than 128 characters.
    optional appli integer Default value : 1 (Bodyscale). This field specifies the device type for which the notification is to be activated. See measure/getmeas for supported device types.
    required comment UTF-8 encoded string The comment string is used as a description displayed to the user when presenting him your notification setup.


    notify / revoke


    This service allows third party applications to revoke a previously subscribed notification.

    This will disable the push feature between the WBS API and the specified applications for the specified user.


    Three parameters are mandatory in all cases : userid, publickey and callbackurl. The optional parameter appli can be used to restrict the request to the given device type.


    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required userid integer The userid of the target user.
    required publickey string The public key associated with the userid.
    required callbackurl URL-encoded string The URL-encoded URL used when subscribing to the notification service for the specified user.
    optional appli integer Default value : 1 (Bodyscale). This field specifies the device type for which the notification is to be deactivated. See measure/getmeas for supported device types.


    notify / get


    This service allows third party applications to check whether the notification service was previously subscribed on a specific user and to retrieve the subscription expiry date.


    Three parameters are mandatory in all cases : userid, publickey and callbackurl. The optional parameter appli can be used to restrict the request to the given device type.


    Parameters
    Response
    Example

    Parameters

    Required Name Type Description
    required userid integer The userid of the target user.
    required publickey string The public key associated with the userid.
    required callbackurl URL-encoded string The URL-encoded URL used when subscribing to the notification service for the specified user.
    optional appli integer Default value : 1 (Bodyscale). This field specifies the device type for which the notification is to be retrieved. See measure/getmeas for supported device types.



    How to compute the hash


    Every solution for transporting a password over an non-secure network (the internet) has advantages and drawbacks. We had to achieve a trade-off between several options, keeping in mind that extremely large portability had to be insured. Here is what we came to:
    • Step 1: Call the once?action=get service. A once magic string will be returned.
    • Step 2: Make a string which is the concatenation of the lowercased email address, the MD5 hash of the password and the once separated with ":". Please note that all email addresses are supposed to be lowercase during the whole authentication and hashing process. In other words, you must lowercase any email address before using it, since the MD5 hashes of doe@domain.com and Doe@domain.com are different and hence will lead to authentication errors when trying to access the API.
    • Step 3: Using, once again, your usual MD5 library, compute the MD5 of the string obtained in step 2.
    • Step 4: Use a hexadecimal representation of the result of the MD5 hash as the hash parameter of the WBSAPI service.


    Example

    • Step 1:
      http://wbsapi.withings.net/once?action=get
      returns
      {"status":0,"body":{"once":"4a8947d9-25e849fd"}}

    • Step 2:
      If the account address is demo@withings.com and the password bozo, then the resulting string is
      demo@withings.com:e1c8d6347c0c24e5cbc60e508f3fc1b5:4a8947d9-25e849fd
      because the MD5 hash of bozo equals e1c8d6347c0c24e5cbc60e508f3fc1b5.
    • Step 3:
      The resulting MD5 hash of the above example is
      99eb3bc8555ca782fa4a0fda53bc8a1a
    • Step 4:
      So one may use, for example:
      http://wbsapi.withings.net/account?action=getuserslist&email=demo@withings.com&hash=99eb3bc8555ca782fa4a0fda53bc8a1a


    Getting userid and publickey by email.


    A simple way of connecting a user to your application is to ask the user to send your application an email by using the 'Share' overlay on their dashboard.
    Every email sent from the dashboard contains two specific tags in the email headers, namely X-userid and X-publickey. Please use them. Don't try to parse the body of the email since it may (and will) change from time to time and because it is localized in various languages and character sets.

    From www-data@withings.net Mon Aug 17 14:46:00 2009
    From: Withings <www-data@withings.net>
    To: =?iso-8859-1?Q?'C=E9dric_Hutchings'?= <cedric.hutchings@withings.com>
    Subject: I want to share my Withings data with you.
    Date: Mon, 17 Aug 2009 14:46:13 +0200
    Message-ID: <CDFD5A3DED8641CAA132AAF94E44AE42@Seurat>
    MIME-Version: 1.0
    X-userid: 88
    X-publickey: b71d95d5fb963458
    Content-Type: multipart/mixed;
    boundary="----=_NextPart_000_0124_01CA1FFA.DBB90020"
    Thread-Index: Acob64EPSheFDlUQT+yd2BeGbHOpBAAJUOjQAMn44FA=
    Status: RO
    Content-Length: 58160

    If the system receiving those emails runs Unix, procmail and formail are probably good tools to handle those headers.