FOR DEVELOPERS

Connect Ovu.la to your tools.

The API is versioned, owner-scoped, and available over HTTPS only. Documentation is public and does not require an account.

HTTPS onlyJSONOwner-scoped

01 · START

Getting started

  1. Open Settings → API access in Ovu.la.
  2. Create a key and store it in a secrets manager. The full value is shown only once.
  3. Send a request with the Authorization: Bearer <token> header.
curl https://api.ovu.la/v1/me \
  -H "Authorization: Bearer <token>"

02 · AUTH

Authentication and scopes

Pass your key as Authorization: Bearer <token> or X-API-Key: <token>. Never put keys in URLs, frontend code, logs, or repositories.

profile:readdaily_logs:readdaily_logs:writedaily_logs:deletetemperature:readtemperature:writesymptoms:readsymptoms:writedata:export

Choose the smallest required set in Settings → API access. At least one scope is required. Replacing a key applies the new permissions and invalidates the old key. Existing keys created before scope selection retain the original full scope set; newer scopes such as data:export must be explicitly selected. A request missing the required scope returns 403 forbidden.

Daily-log responses include base fields by default. Add include=temperature or include=symptoms only with the matching read scope; those fields require the matching write scope when updated through a daily-log request. Unsupported or duplicate include fields are rejected.

03 · REFERENCE

Endpoints

Base URL: https://api.ovu.la. Dates use YYYY-MM-DD.

GET/healthPublic health check.
GET/v1/meProfile for the current API key.
GET/v1/me/daily-logsPaginated daily logs.
GET · PATCH · DELETE/v1/me/daily-logs/YYYY-MM-DDRead, update, or delete one daily log. Deletion also requires temperature and symptom write scopes.
GET/v1/me/temperaturePaginated temperature records.
GET · PUT · DELETE/v1/me/temperature/YYYY-MM-DDRead, record, or delete one temperature.
GET/v1/me/symptomsPaginated symptom records.
GET · PUT · PATCH/v1/me/symptoms/YYYY-MM-DDRead or update one symptom record.

04 · CONTRACT

Responses, errors, and pagination

Successful responses use data and meta.request_id. Errors include a machine-readable code, safe message, and request_id; stack traces are never returned.

List responses include next_cursor and has_more. Cursors are signed and opaque — pass them back unchanged. Requests cover up to 366 days and 500 records per page.

05 · SAFETY

Security requirements

  • Use HTTPS and store keys in a secrets manager.
  • Request only the scopes your integration needs.
  • Include a unique Idempotency-Key with every write.
  • Rotate or revoke keys when an integration changes.
  • Keep infrastructure secrets and signing keys server-side; never expose them to clients.