GymFlexa API reference

Every endpoint of the GymFlexa REST API, generated from the API itself.

All endpoints are relative to https://api.gymflexa.com. Authenticate every request with an API key issued for your GymFlexa organization.

apiKey — HTTP Basic auth carrying only the API key secret: Authorization: Basic base64(<key secret>).

accessToken — Operator session token issued by the GymFlexa dashboard: Authorization: Token <access token>.

Download the OpenAPI specification for use with your own tooling.

Appointments

GET/api/appointments

List appointments

Lists the appointments of your gym. Requires the appointments:read scope.

appointments:readapiKeyaccessToken

Parameters

Name	In	Type	Description
gymId	query	string
memberId	query	string
startTime	query	string
endTime	query	string
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of appointments
401	Missing or invalid credentials
403	API key is missing the appointments:read scope
429	API key rate limit exceeded
default	Request failed

POST/api/appointments

Create an appointment

Requires the appointments:write scope.

appointments:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created appointment
default	Request failed

GET/api/appointments/{appointmentId}

Get an appointment

Returns a single appointment by id. Appointments belonging to another organization respond 404. Requires the appointments:read scope.

appointments:readapiKeyaccessToken

Parameters

Name	In	Type	Description
appointmentIdrequired	path	string

Responses

Status	Meaning
200	The appointment
404	Not found (or owned by another organization)
default	Request failed

PUT/api/appointments/{appointmentId}

Update an appointment

Requires the appointments:write scope.

appointments:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
appointmentIdrequired	path	string

Responses

Status	Meaning
200	The updated appointment
default	Request failed

Gyms

GET/api/gyms

List gyms

Lists the gyms of your organization. Requires the gyms:read scope.

gyms:readapiKeyaccessToken

Responses

Status	Meaning
200	Array of gyms
401	Missing or invalid credentials
403	API key is missing the gyms:read scope
429	API key rate limit exceeded
default	Request failed

POST/api/gyms

Create a gym

Requires the gyms:write scope.

gyms:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created gym
default	Request failed

GET/api/gyms/{gymId}

Get a gym

Returns a single gym by id. Readable anonymously — the public whitelabel site resolves a gym without a vanity name by this id. Gyms belonging to another organization respond 404 to an authenticated caller. An API key must carry the gyms:read scope.

gyms:readapiKeyaccessToken

Parameters

Name	In	Type	Description
gymIdrequired	path	string

Responses

Status	Meaning
200	The gym
404	Not found (or owned by another organization)
default	Request failed

PUT/api/gyms/{gymId}

Update a gym

Requires the gyms:write scope.

gyms:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
gymIdrequired	path	string

Responses

Status	Meaning
200	The updated gym
default	Request failed

DELETE/api/gyms/{gymId}

Delete a gym

Requires the gyms:write scope.

gyms:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
gymIdrequired	path	string

Responses

Status	Meaning
200	The deleted gym
default	Request failed

Members

GET/api/members

List members

Lists the members of your gym. Requires the members:read scope.

members:readapiKeyaccessToken

Parameters

Name	In	Type	Description
gymId	query	string
email	query	string
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of members
401	Missing or invalid credentials
403	API key is missing the members:read scope
429	API key rate limit exceeded
default	Request failed

POST/api/members

Create a member

Requires the members:write scope.

members:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created member
default	Request failed

GET/api/members/{memberId}

Get a member

Returns a single member by id. Members belonging to another organization respond 404. Requires the members:read scope.

members:readapiKeyaccessToken

Parameters

Name	In	Type	Description
memberIdrequired	path	string

Responses

Status	Meaning
200	The member
404	Not found (or owned by another organization)
default	Request failed

PUT/api/members/{memberId}

Update a member

Requires the members:write scope.

members:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
memberIdrequired	path	string

Responses

Status	Meaning
200	The updated member
default	Request failed

DELETE/api/members/{memberId}

Delete a member

Requires the members:write scope.

members:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
memberIdrequired	path	string

Responses

Status	Meaning
200	The deleted member
default	Request failed

Payments

GET/api/payments

List payments

Lists the payments of your gym. Requires the payments:read scope.

payments:readapiKeyaccessToken

Parameters

Name	In	Type	Description
gymId	query	string
memberId	query	string
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of payments
401	Missing or invalid credentials
403	API key is missing the payments:read scope
429	API key rate limit exceeded
default	Request failed

POST/api/payments

Create a payment

Requires the payments:write scope.

payments:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created payment
default	Request failed

GET/api/payments/{paymentId}

Get a payment

Returns a single payment by id. Payments belonging to another organization respond 404. Requires the payments:read scope.

payments:readapiKeyaccessToken

Parameters

Name	In	Type	Description
paymentIdrequired	path	string

Responses

Status	Meaning
200	The payment
404	Not found (or owned by another organization)
default	Request failed

PUT/api/payments/{paymentId}

Update a payment

Requires the payments:write scope.

payments:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
paymentIdrequired	path	string

Responses

Status	Meaning
200	The updated payment
default	Request failed

DELETE/api/payments/{paymentId}

Delete a payment

Requires the payments:write scope.

payments:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
paymentIdrequired	path	string

Responses

Status	Meaning
200	The deleted payment
default	Request failed

Services

GET/api/services

List services

Lists the services offered by your gym. Requires the services:read scope.

services:readapiKeyaccessToken

Parameters

Name	In	Type	Description
gymId	query	string
fields	query	string	Comma-separated projection of fields to return

Responses

Status	Meaning
200	Array of services
401	Missing or invalid credentials
403	API key is missing the services:read scope
429	API key rate limit exceeded
default	Request failed

POST/api/services

Create a service

Requires the services:write scope.

services:writeapiKeyaccessToken

Responses

Status	Meaning
200	The created service
default	Request failed

GET/api/services/{serviceId}

Get a service

Returns a single service by id. Services belonging to another organization respond 404. Requires the services:read scope.

services:readapiKeyaccessToken

Parameters

Name	In	Type	Description
serviceIdrequired	path	string

Responses

Status	Meaning
200	The service
404	Not found (or owned by another organization)
default	Request failed

PUT/api/services/{serviceId}

Update a service

Requires the services:write scope.

services:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
serviceIdrequired	path	string

Responses

Status	Meaning
200	The updated service
default	Request failed

DELETE/api/services/{serviceId}

Delete a service

Requires the services:write scope.

services:writeapiKeyaccessToken

Parameters

Name	In	Type	Description
serviceIdrequired	path	string

Responses

Status	Meaning
200	The deleted service
default	Request failed

Webhook subscriptions

GET/api/webhooksubscriptions

List webhook subscriptions

Webhook subscriptions deliver member, appointment and payment lifecycle events to your server as signed POST requests (X-Gymflexa-Signature: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body">). An endpoint failing 20 times in a row is disabled automatically. Subscriptions are managed with an operator access token; the secret is only returned once, on create.

accessToken

Responses

Status	Meaning
200	Array of webhook subscriptions (without secrets)
default	Request failed

POST/api/webhooksubscriptions

Create a webhook subscription

The response includes the signing secret exactly once — store it; it cannot be retrieved again.

accessToken

Request body

Field	Type	Description
gymIdrequired	string
urlrequired	string
events	array (member.created \| member.updated \| member.deleted \| appointment.created \| appointment.updated \| appointment.deleted \| payment.created)	Empty array subscribes to all events

Responses

Status	Meaning
200	The created subscription, including its secret
default	Request failed

PUT/api/webhooksubscriptions/{webhookSubscriptionId}

Update a webhook subscription

url, events and active are editable; the secret and gym are immutable. Re-enabling an auto-disabled endpoint is done by setting active back to true.

accessToken

Parameters

Name	In	Type	Description
webhookSubscriptionIdrequired	path	string

Responses

Status	Meaning
200	The updated subscription (without secret)
default	Request failed

DELETE/api/webhooksubscriptions/{webhookSubscriptionId}

Delete a webhook subscription

accessToken

Parameters

Name	In	Type	Description
webhookSubscriptionIdrequired	path	string

Responses

Status	Meaning
200	Deleted
default	Request failed

GymFlexa API reference

Appointments

Gyms

Members

Payments

Services

Webhook subscriptions

Language

Resources

Contact us