openapi: 3.1.0
info:
  title: MetricBridge webhook ("Your server")
  version: "1"
  summary: What the MetricBridge iOS app POSTs to your own server.
  description: |
    One endpoint receives every request. Tell them apart by the X-MetricBridge-Type header
    (or the body's `type` key on typed documents). Full guide: https://www.healthexport.dev/docs/webhook
  license: { name: MIT, identifier: MIT }
jsonSchemaDialect: https://json-schema.org/draft/2020-12/schema
webhooks:
  metricbridge:
    post:
      summary: One MetricBridge delivery
      parameters:
        - { name: X-MetricBridge-Type, in: header, required: true,
            schema: { enum: [metrics.daily, metrics.intraday, workouts, sleep.sessions, timezone.changes, events] } }
        - { name: X-MetricBridge-Schema, in: header, required: true, schema: { type: string, const: "1" } }
        - { name: X-MetricBridge-Replay, in: header, required: false, schema: { type: string, pattern: "^rpl_" },
            description: Present on every request of a Resend, the same value for all of them. }
        - { name: webhook-id, in: header, required: true, schema: { type: string, pattern: "^msg_" },
            description: Unique per message. Use it as the idempotency key. }
        - { name: webhook-timestamp, in: header, required: true, schema: { type: string, pattern: "^[0-9]+$" },
            description: Unix seconds. }
        - { name: webhook-signature, in: header, required: false, schema: { type: string, pattern: "^v1," },
            description: "Standard Webhooks v1 HMAC-SHA256 of id.timestamp.body keyed with your ingest token. Sent when a token is set." }
        - { name: automation-name, in: header, required: true, schema: { type: string } }
        - { name: x-health-token, in: header, required: false, schema: { type: string },
            description: The ingest token, when the auth method is Header. Bearer, query and body methods also exist. }
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: metrics-envelope.json
                - $ref: sleep-sessions.json
                - $ref: timezone-changes.json
                - $ref: events.json
            examples:
              metricsDaily: { externalValue: examples/metrics-daily.json }
              metricsIntraday: { externalValue: examples/metrics-intraday.json }
              workouts: { externalValue: examples/workouts.json }
              sleepSessions: { externalValue: examples/sleep-sessions.json }
              timezoneChanges: { externalValue: examples/timezone-changes.json }
              events: { externalValue: examples/events.json }
      responses:
        "200": { description: Any 2xx counts as delivered. Answer quickly and process asynchronously. }
        "401": { description: Bad token or signature. The app reports it in Settings and History. }