Integrations

Introduction

Integrations pull health data straight from a provider's cloud — Garmin , Oura , WHOOP — into Sahha, with no SDK on the device . The user connects their provider account once; Sahha syncs their data continuously onto the same profile. It's the third way to get data into Sahha, alongside the SDK and REST API .

Supported providers

The slug is the value you pass as {provider} throughout the API (see Connect a user ).

Data coverage

What you get depends on the provider, the user's device, and the scopes you enable. Sahha normalizes every provider into the same data logs , biomarkers , scores and archetypes — so once data is in, you consume it the same way regardless of source.

The matrix below is indicative . See each provider's page for the authoritative, scope-by-scope list.

● available · — not provided. Exact availability depends on the user's device and the scopes you enable — see each provider's page.

Data freshness & history

Every provider is webhook-driven : the provider notifies Sahha over webhooks as new data is recorded, so data usually lands within minutes of the user's device syncing to the provider's cloud. Sahha does not poll on a fixed schedule.

When a user first connects, Sahha backfills the last 30 days of available history, then syncs continuously from then on.

How it works

Integrations use three concepts. The same vocabulary appears in the dashboard and the API:

Setting up a provider is three steps:

1. Create an app with the provider — register in the provider's developer console to obtain OAuth credentials.
2. Create an integration in Sahha — add those credentials to your project in the Sahha Dashboard .
3. Connect an end user — start the OAuth flow for a user via the Sahha API or SDK. Once they authorize, Sahha begins syncing automatically.

Follow the provider-specific guide above for exact console steps and scopes.

Connect a user

Once an integration is configured, you trigger the connection flow per end user. There are two ways: the API (server-driven or web flows) and the SDK (native mobile).

Before you start

You need:

• A configured integration for the provider (the three steps above).
• A profile token for the end user — this scopes the connection to that specific user. See Authentication for how tokens work and Getting Started to obtain one.
• The end user to have an account with the provider (e.g. a Garmin Connect or Oura account).

Examples use the sandbox environment ( sandbox-api.sahha.ai). Swap to api.sahha.ai for production — see Environments .

Option A — Sahha API

The connection is a standard OAuth redirect round-trip:

1. You call Sahha's authorize endpoint with the user's profile token. Sahha returns an authorizationUrl.
2. You redirect the user's browser to that authorizationUrl (the provider's consent screen).
3. The user approves access on the provider's site.
4. The provider redirects back to Sahha's callback; Sahha stores the connection and starts syncing.
5. Sahha redirects the user to your redirectUrl so your app can show a success state.

The optional redirectUrl must match an entry in the integration's Redirect URL Whitelist; if omitted, Sahha uses the first whitelisted URL.

curl -X GET "https://sandbox-api.sahha.ai/api/v1/integration/oauth/{provider}/authorize?redirectUrl=https://yourapp.com/integrations/callback" \
  -H "Authorization: profile {your-profile-token}"

{
	"authorizationUrl": "https://connect.garmin.com/oauthConfirm?..."
}

Replace {provider} with the provider's slug from the Supported providers table (e.g. garmin). Each provider's page has the full request and language-specific snippets.

Once a user is connected, you read their data the same way as any other Sahha data — via the REST API or Webhooks . There's nothing integration-specific about consuming it.

Handling the redirect

After the OAuth flow, Sahha redirects the user to your redirectUrl with query parameters describing the outcome — handle them however your app needs.

Success

Errors

Error redirects include status=error and an error message. This covers a user denying access on the provider's consent screen, which is returned as provider denied authorization:

Option B — Sahha SDK

Managing connections

A connection moves through a simple lifecycle: connected → (token expires) needs re-auth → disconnected . You can see and manage every connection in the Sahha Dashboard under Integrations → Connections .

Deleting a connection

Deleting a connection revokes a single end-user's link to a provider — Sahha stops ingesting their data immediately. A connection can be deleted in two ways:

• You , from the Sahha Dashboard under Integrations → Connections .
• The user , from their own provider account settings.

Deleting an integration

Deleting an integration removes your configured app for a provider — its OAuth credentials and scopes. Do this from the Sahha Dashboard under Integrations → Integrations .

Troubleshooting