WellnessLiving Staff API

openapi: 3.2.0
info:
  title: WellnessLiving Staff API
  description: Curated, representative subset of WellnessLiving's official production API (RESTful, JSON-over-HTTPS).
  version: 1.1.20260620071011
  contact:
    name: WellnessLiving Support
    email: support@wellnessliving.com
    url: https://www.wellnessliving.com/support
  license:
    name: Proprietary
    url: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/
  termsOfService: https://www.wellnessliving.com/knowledge-sharing/terms-of-use/
servers:
- url: https://us.wellnessliving.com
  description: Production - United States data center
- url: https://au.wellnessliving.com
  description: Production - Australia data center
- url: https://staging.wellnessliving.com
  description: Staging (pre-release QA branch)
- url: https://demo.wellnessliving.com
  description: Demo/trunk (active development branch)
security:
- BearerAuth: []
tags:
- name: Staff
paths:
  /Wl/Staff/StaffList/StaffList.json:
    get:
      operationId: get_Wl_Staff_StaffList_StaffList
      summary: Returns the list of staff members for the given business
      description: 'Returns all active (or optionally inactive) staff members for the business, including

        their name, role, assigned services, contact details, and location assignments. Can be

        filtered to only staff who have a specific privilege, and whether access-level checks

        should be applied when building the result.'
      tags:
      - Staff
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: a_privilege
        in: query
        required: true
        schema:
          type: array
          items:
            type: string
        description: 'A list of privileges to filter staff members by.


          This property acts as a filter.

          Only staff members possessing all the privileges specified in this l'
      - name: is_check_staff_access
        in: query
        required: true
        schema:
          type: boolean
        description: "Determines that only staff members which the current user has access to should be retrieved.\n\n `true` if only staff members which the current user has"
      - name: is_staff_inactive
        in: query
        required: true
        schema:
          type: boolean
        description: 'Whether inactive and removed staff members are available.

          If `true` inactive and removed staff members are available. `false` otherwise.'
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: The key of the business to show information for.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  a_staff:
                    description: The `a_staff` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Wl/Staff/StaffView/StaffView.json:
    get:
      operationId: get_Wl_Staff_StaffView_StaffView
      summary: Retrieves information about staff
      description: 'This method can accept or one staff key `k_staff` or staff list

        `a_staff_list` but not both (exception would be thrown).'
      tags:
      - Staff
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: a_staff_list
        in: query
        required: false
        schema:
          type:
          - array
          - 'null'
          items:
            type: string
        description: A list of staff keys.
      - name: a_uid_staff_list
        in: query
        required: false
        schema:
          type:
          - array
          - 'null'
          items:
            type: string
        description: A list of staff user IDs.
      - name: i_image_height
        in: query
        required: true
        schema:
          type: integer
        description: 'Image height in pixels. Please specify this value if you need image to be returned in specific size.

          In case this value is not specified returned imag'
      - name: i_image_width
        in: query
        required: true
        schema:
          type: integer
        description: 'Image width in pixels. Please specify this value if you need image to be returned in specific size.

          In case this value is not specified returned image'
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: The key of the business to show information for.
      - name: k_staff
        in: query
        required: true
        schema:
          type: string
        description: 'The staff member key.

          A staff member can work for more than one business.

          This key can be found using the [StaffListApi](/Wl/Staff/StaffList/StaffList'
      - name: uid_staff
        in: query
        required: true
        schema:
          type: string
        description: 'The staff member user ID.

          A staff member can work for more than one business.

          This key can be found using the [StaffListApi](/Wl/Staff/StaffList/Staff'
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  a_class_day:
                    description: The `a_class_day` field.
                  a_result_list:
                    description: The `a_result_list` field.
                  a_staff:
                    description: The `a_staff` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Wl/Staff/StaffElement.json:
    post:
      operationId: post_Wl_Staff_StaffElement
      summary: Update or create staff
      description: 'Creates a new staff member or updates an existing one in the business. When creating,

        a new user account is provisioned if no matching email exists. When updating, the target

        staff member must already belong to the business. Role, location, contact details,

        employment dates, and custom profile fields can all be set in a single call.'
      tags:
      - Staff
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: k_staff
        in: query
        required: false
        schema:
          type:
          - string
          - 'null'
        description: 'The key of the staff member resolved and used internally by this API.


          This property is populated from `uid_staff` in `post()` and

          returned in API res'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                a_location:
                  description: The `a_location` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                dl_end:
                  description: The `dl_end` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                dl_start:
                  description: The `dl_start` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                id_gender:
                  description: The `id_gender` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                id_role:
                  description: The `id_role` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                is_employ:
                  description: The `is_employ` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                is_microsite:
                  description: The `is_microsite` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                is_password_set_disable:
                  description: The `is_password_set_disable` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                is_uid:
                  description: The `is_uid` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                k_business:
                  description: The `k_business` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                k_business_role:
                  description: The `k_business_role` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                k_city:
                  description: The `k_city` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                k_location:
                  description: The `k_location` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                text_address:
                  description: The `text_address` field. See WellnessLiving developer portal for full field semantics.
                  type: string
                text_biography:
                  description: The `text_biography` field. See WellnessLiving developer portal for full field semantics.
                  type: string
              required:
              - is_password_set_disable
              - is_uid
              - k_business
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  k_staff:
                    description: The `k_staff` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
  /Wl/Staff/Privilege/PrivilegeList.json:
    get:
      operationId: get_Wl_Staff_Privilege_PrivilegeList
      summary: Returns the list of privileges for the current user in the given business
      description: 'Returns the complete access profile of the signed-in user for the given business: staff

        privileges by ID, named admin privileges, and a flag indicating super-admin status. Can

        only be called for the currently authenticated user, not on behalf of another user.'
      tags:
      - Staff
      parameters:
      - $ref: '#/components/parameters/XErrorRules'
      - name: k_business
        in: query
        required: true
        schema:
          type: string
        description: Key of business to get privileges for.
      - name: uid
        in: query
        required: true
        schema:
          type: string
        description: User key to get privileges for.
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  a_privilege_passport:
                    description: The `a_privilege_passport` field.
                  a_privilege_staff:
                    description: The `a_privilege_staff` field.
                  is_admin:
                    description: The `is_admin` field.
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  responses:
    NotFound:
      description: The requested resource does not exist.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: 'Client-side error: invalid input, failed validation, throttling, or other request error (only returned as an HTTP status when `X-Error-Rules` opts in; otherwise encoded in a 200 body).'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Authenticated but not permitted to access this business, location, or resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ValidationError:
      description: The request payload failed field-level validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing, expired, or invalid Bearer token / session.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ErrorResponse:
      type: object
      description: Standard WellnessLiving API error response shape.
      properties:
        status:
          type: string
          description: Machine-readable status/error code string (e.g. `access-denied`, `not-found`).
        text_message:
          type: string
          description: Human-readable error message.
        a_field:
          type: object
          additionalProperties: true
          description: Per-field validation errors, when the failure is a 422-style validation error.
  parameters:
    XErrorRules:
      name: X-Error-Rules
      in: header
      required: false
      schema:
        type: string
      description: Opt in to mapping internal API error statuses to real 4xx HTTP codes. By default the API always answers HTTP 200 even on error, with the failure encoded in the JSON body; setting this header (e.g. to `default`) makes the gateway translate matched error statuses to 400/403/404 responses instead.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'The officially published OpenAPI declares a JWT Bearer scheme: sign in via `POST /Core/Passport/Login/Enter/Enter.json`, then mint a token with `GET /Core/Passport/Enter/Jwt/JwtToken.json` and send it as `Authorization: Bearer <token>`. The underlying PHP/JS SDKs additionally support the legacy scheme: a registered Application ID + secret code sign a per-request HMAC (SHA3-based) placed in the `Authorization:` header alongside session cookies established by the `Notepad`/`Enter` model pair. Both schemes require WellnessLiving''s Integrations Team to first approve API access, sign an NDA and API Agreement, and issue application credentials.'