Mouve API
What the Mouve API is, what it can do, and where it stands today — start here.
The Mouve API is the programmatic surface of Mouve — a fitness and nutrition platform with a social feed. It is built for three kinds of integrations:
- Publishing tools that create posts on a user's behalf — social schedulers, cross-posters, content workflows.
- Personal scripts and agents using a personal access token to work with your own account.
- AI assistants connected over MCP, which — with explicit per-scope consent — can additionally read and log workouts, nutrition, and body metrics.
In development — not yet live
This site documents the Mouve API ahead of launch so you can evaluate and plan an integration. The REST endpoints, the token portal, and the OAuth flows described here are not callable yet, and details may change until launch. The MCP server is the part you can use today. Launch will be announced in the changelog.
The shape of the API
| Property | Value |
|---|---|
| Base URL | https://api.mouve.it/public/v1 |
| Auth | Authorization: Bearer <token> — OAuth 2.1 access token or personal access token |
| Permissions | Exact-match scopes — no hierarchy, write does not imply read |
| Wire format | JSON, snake_case keys, ids are UUIDs, timestamps are ISO 8601 (UTC) |
| Errors | RFC 9457 application/problem+json with a frozen code registry |
| Pagination | Opaque cursors, meta.next_cursor |
| Write safety | Idempotency-Key on creates |
| Limits | Published per-tier rate limits, reported in RateLimit-* headers |
v1 endpoints
| Method | Path | Scope |
|---|---|---|
| GET | /public/v1/me | profile.read |
| GET | /public/v1/users/:username | profile.read |
| GET | /public/v1/users/:username/posts | posts.read |
| POST | /public/v1/posts | posts.write |
| GET | /public/v1/posts/:id | posts.read |
| GET | /public/v1/posts/:id/replies | posts.read |
| DELETE | /public/v1/posts/:id | posts.write |
| GET | /public/v1/timeline | posts.read |
Health-related data (workouts, nutrition, body metrics) is deliberately not on the REST surface in v1: it is available only through consent-gated MCP tools, where every grant records explicit consent for exactly the scopes involved.
Principles you can rely on
- Revocation is immediate. When a user disconnects your app or revokes a token, access ends on the next request — not when a cached token expires.
- Scopes are the whole story. A token can do exactly what its scopes say. Endpoints without declared public scopes (account management, credential minting, admin) are unreachable with any API token, by construction.
- The error registry is append-only. Codes never change meaning or status; new codes are additive and announced in the changelog.
- Breaking changes get a major version and at least 180 days of
Deprecation/Sunsetheaders before anything is retired. See versioning in the changelog.
Where to go next
Start with the quickstart, then read
authentication to choose between OAuth and personal
access tokens. The API reference has every endpoint in
detail, and the machine-readable OpenAPI 3.1 document is at
/openapi.json.