WellnessLiving Authentication API

openapi: 3.0.3
info:
  title: WellnessLiving Appointments Authentication API
  description: Curated, representative subset of WellnessLiving's official production API (RESTful, JSON-over-HTTPS). WellnessLiving is business-management software for fitness studios, gyms, spas, and salons; this API is the same one its own web and mobile clients (Achieve, Elevate) call, and is published for approved partners via an official OpenAPI document at github.com/wellnessliving/openapi (324 paths across 45+ resource areas as of the 2026-06-20 build). Endpoints below are grounded in that official spec and in the public github.com/wellnessliving/wl-sdk (PHP) and wl-sdk-js SDKs; this file selects roughly four representative endpoints per logical API area rather than reproducing the full catalog. Every WellnessLiving API resource is a `.json`-suffixed endpoint whose path is derived deterministically from the SDK model class's namespace (e.g. the PHP class `WellnessLiving\Wl\Staff\StaffElementModel` serves `/Wl/Staff/StaffElement.json`). Legacy numbered variants of several endpoints exist for backward compatibility (e.g. `Finish47`, `ServiceList52`, `Purchase72`) and are omitted here in favor of their current unsuffixed counterpart.
  version: 1.1.20260620071011
  contact:
    name: WellnessLiving Support
    email: support@wellnessliving.com
    url: https://www.wellnessliving.com/support
  license:
    name: Proprietary
    url: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/
  termsOfService: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/
servers:
- url: https://us.wellnessliving.com
  description: Production - United States data center
- url: https://au.wellnessliving.com
  description: Production - Australia data center
- url: https://staging.wellnessliving.com
  description: Staging (pre-release QA branch)
- url: https://demo.wellnessliving.com
  description: Demo/trunk (active development branch)
security:
- BearerAuth: []
tags:
- name: Authentication
paths:
  /Core/Passport/Login/Enter/Enter.json:
    post:
      operationId: post_Core_Passport_Login_Enter_Enter
      summary: Signs the user in using their login and hashed password.
      description: 'Accepts the user login, a password hash derived using the notepad obtained from [NotepadApi](/Core/Passport/Login/Enter/Notepad.json),

        and an optional remember preference. Validates credentials, enforces CAPTCHA when too many failed

        attempts have occurred, starts a session for the user, and returns a redirect URL if applicable.'
      tags:
      - Authentication
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                json_data:
                  description: The `json_data` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                s_captcha:
                  description: The `s_captcha` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                s_login:
                  description: The `s_login` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                s_notepad:
                  description: The `s_notepad` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                s_password:
                  description: The `s_password` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                s_remember:
                  description: The `s_remember` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                url_return:
                  description: The `url_return` field. See WellnessLiving developer portal for full field semantics.
                  type: string
              required:
              - json_data
              - s_captcha
              - s_login
              - s_notepad
              - s_password
              - s_remember
              - url_return
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  url_redirect:
                    description: The `url_redirect` field.
                    nullable: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Core/Passport/Enter/Jwt/JwtToken.json:
    get:
      operationId: get_Core_Passport_Enter_Jwt_JwtToken
      summary: Returns a jwt token that can be used to log user.
      description: 'Requires the user to be signed in. Generates a signed JWT token tied to the current authorization

        header and user ID that can be passed to other services to authenticate the user without sharing session cookies.'
      tags:
      - Authentication
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  s_token:
                    description: The `s_token` field.
                    nullable: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Core/Passport/Login/SignOut/SignOut.json:
    post:
      operationId: post_Core_Passport_Login_SignOut_SignOut
      summary: Signs user out.
      description: 'Requires the user to be signed in, fires a before-logout event allowing listeners to intercept or

        handle the logout, then clears the current session. Throws an error if the user is authenticated

        via SAML SSO, as API-based logout is not supported in that case.'
      tags:
      - Authentication
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Wl/Login/Login.json:
    get:
      operationId: get_Wl_Login_Login
      summary: Retrieves information about user.
      description: 'Returns name, gender, photo URL, email, and staff details for the specified user within the given business.

        Public staff information is returned even without profile access; full client details require access to the

        user''s profile.'
      tags:
      - Authentication
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: i_photo_height
        in: query
        required: true
        schema:
          type: integer
        description: The height of the requested photo.
      - name: i_photo_width
        in: query
        required: true
        schema:
          type: integer
        description: The width of the requested photo.
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: 'The key of the business. Users can be in multiple businesses.

          This can be left as `null` to retrieve system-wide information.'
      - name: uid
        in: query
        required: false
        schema:
          type: string
          nullable: true
        description: 'The key of the user.


          `null` on case when is walk-in client.'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  can_postcard:
                    description: The `can_postcard` field.
                    nullable: true
                  can_send_message:
                    description: The `can_send_message` field.
                    nullable: true
                  id_gender:
                    description: The `id_gender` field.
                    nullable: true
                  is_photo_empty:
                    description: The `is_photo_empty` field.
                    nullable: true
                  k_staff:
                    description: The `k_staff` field.
                    nullable: true
                  s_first_name:
                    description: The `s_first_name` field.
                    nullable: true
                  s_last_name:
                    description: The `s_last_name` field.
                    nullable: true
                  text_mail_client:
                    description: The `text_mail_client` field.
                    nullable: true
                  text_mail_staff:
                    description: The `text_mail_staff` field.
                    nullable: true
                  text_name_first_staff:
                    description: The `text_name_first_staff` field.
                    nullable: true
                  text_name_full_client:
                    description: The `text_name_full_client` field.
                    nullable: true
                  text_name_full_staff:
                    description: The `text_name_full_staff` field.
                    nullable: true
                  text_name_last_staff:
                    description: The `text_name_last_staff` field.
                    nullable: true
                  uid:
                    description: The `uid` field.
                    nullable: true
                  uid_staff:
                    description: The `uid_staff` field.
                    nullable: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  parameters:
    XErrorRules:
      name: X-Error-Rules
      in: header
      required: false
      schema:
        type: string
      description: Opt in to mapping internal API error statuses to real 4xx HTTP codes. By default the API always answers HTTP 200 even on error, with the failure encoded in the JSON body; setting this header (e.g. to `default`) makes the gateway translate matched error statuses to 400/403/404 responses instead.
  responses:
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ValidationError:
      description: The request payload failed field-level validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing, expired, or invalid Bearer token / session.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: 'Client-side error: invalid input, failed validation, throttling, or other request error (only returned as an HTTP status when `X-Error-Rules` opts in; otherwise encoded in a 200 body).'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Authenticated but not permitted to access this business, location, or resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      description: Standard WellnessLiving API error response shape.
      properties:
        status:
          type: string
          description: Machine-readable status/error code string (e.g. `access-denied`, `not-found`).
        text_message:
          type: string
          description: Human-readable error message.
        a_field:
          type: object
          additionalProperties: true
          description: Per-field validation errors, when the failure is a 422-style validation error.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'The officially published OpenAPI declares a JWT Bearer scheme: sign in via `POST /Core/Passport/Login/Enter/Enter.json`, then mint a token with `GET /Core/Passport/Enter/Jwt/JwtToken.json` and send it as `Authorization: Bearer <token>`. The underlying PHP/JS SDKs additionally support the legacy scheme: a registered Application ID + secret code sign a per-request HMAC (SHA3-based) placed in the `Authorization:` header alongside session cookies established by the `Notepad`/`Enter` model pair. Both schemes require WellnessLiving''s Integrations Team to first approve API access, sign an NDA and API Agreement, and issue application credentials.'