Walk15 Connect V1
Scopes
The three Walk15 Connect scopes, which endpoints they unlock and how consent applies to them.
Scopes decide which activity endpoints a connection can read. Walk15 Connect V1 has exactly three, all read-only.
Scope reference
| Scope | Shown to users as | Permits | Endpoint |
|---|---|---|---|
daily_steps:read | Daily steps | Adjusted Walk15 daily step totals | GET /connect-walk15/v1/grants/{grant_id}/daily-activity |
cycling_daily:read | Daily cycling totals | Daily cycling distance in metres | GET /connect-walk15/v1/grants/{grant_id}/cycling-daily |
cycling_activities:read | Cycling activities | Individual cycling activities with recorded start/end clocks | GET /connect-walk15/v1/grants/{grant_id}/cycling-activities |
Scopes are independent: daily_steps:read does not allow cycling reads, and cycling_daily:read does not allow individual activities. Calling an endpoint without its scope returns 403 insufficient_scope.
Scopes also filter webhooks: step changes are notified only to connections with daily_steps:read, cycling changes only to connections with at least one cycling scope.
Customer allowance versus user approval
Two layers apply:
- Customer allowance — the scopes Walk15 approved for your company during onboarding. You can only request scopes from this set; anything else fails the authorization request with an error page (
invalid_scope). - User approval — the scopes a particular user approved. These are fixed for that connection and returned in the token response's
scopefield.
A request is authorized only when the scope is in both. If Walk15 later removes a scope from your allowance, reads for that scope fail with 403 insufficient_scope immediately (401 if no permitted scope is left), those connections can no longer be refreshed and receive no webhooks except connection.revoked. Disconnect them and ask the users to reconnect with a permitted scope set.
The discovery document's scopes_supported lists all Connect scopes, not your allowance.
All-or-nothing consent
The consent screen lists every requested dataset. The user approves all of them or cancels; there is no per-scope toggle. If you request daily_steps:read cycling_daily:read, the resulting connection has both scopes or does not exist.
Request only what you need
Every extra scope adds a line to the consent screen, makes users less likely to approve, and adds to the data you are responsible for. For example, if your product only shows daily totals, cycling_daily:read is enough.
Changing scopes
A connection's scope set cannot change in place. To change it, disconnect the user (or ask them to disconnect your company in Walk15), then start a new authorization with the new scopes.
Requesting a different scope set before the old connection is disconnected (even one that lapsed or whose tokens were revoked) shows the consent screen with Allow access disabled; the user can only cancel (which returns error=access_denied) or switch to another Walk15 account. See How do we reconnect a user?