VO₂max.One

Developers

Public API

Everything the app does is available over HTTP. JSON in, JSON out, CORS open, no key needed for reads. Writes that touch an athlete's record require a signed-in session.

Interactive OpenAPI 3.1 reference for the estimator and proof verifier, with try-it-out.Open API docs →
Pinging service…live check
GET/api/public/v1/health

Service status, version and the endpoint index.

curl https://vo2max.one/api/public/v1/health
GET/api/public/v1/zones?age=38&resting_hr=58

All five heart-rate zones as absolute bpm bands, plus predicted maximum and the goal presets.

curl 'https://vo2max.one/api/public/v1/zones?age=38&resting_hr=58'
POST/api/public/v1/estimate

Non-exercise VO₂max estimate (Uth–Sørensen · Tanaka HRmax) with peer average and fitness trend.

curl -X POST https://vo2max.one/api/public/v1/estimate \
  -H 'content-type: application/json' \
  -d '{"age":38,"resting_hr":58,"recent_vo2max":[44,45,46]}'
POST/api/public/v1/prescribe

Full prescription: zone band, six phases, tempo anchors, watermark payload and Content ID asset id.

curl -X POST https://vo2max.one/api/public/v1/prescribe \
  -H 'content-type: application/json' \
  -d '{"vo2max":46,"age":38,"resting_hr":58,"goal_id":"intervals8","device":"apple_watch"}'
GET/api/public/v1/audit?prescription_id=rx_…

Public provenance records and a chain verification result. Omit the query to list the latest public rows.

curl 'https://vo2max.one/api/public/v1/audit?prescription_id=rx_demo0001'

Notes

  • All responses include an AI disclosure field where audio is implicated.
  • Malformed prescription ids return 422 with an explicit message.
  • Audit reads are limited to 50 records per call, oldest first, for chain replay.
  • Every public endpoint is rate limited per caller IP — prescribe 10/min, estimate 30/min, verify 20/min, audit 30/min, zones and spec 60/min, health 120/min. Over budget returns 429 with Retry-After and X-RateLimit-* headers.
  • Bodies must be JSON under 8 KB, are schema-validated, and reject unknown fields. Rate-limit denials and every proof verification are written to the admin audit log.
  • Authenticated operations (save profile, seal session, connect device) run as typed server functions and enforce row-level security as the calling user.