Activities
Authenticated challenges, lessons, plans, play records, and content integrations.
The Activities APIs expose GOFA's hosted exercise catalogues and the records created when an end user plays them. They are client-scoped: the request host selects the GOFA client for routes that do not carry a client ID in the path.
Use an existing integration credential for the route you are calling:
ClientToken: <client-token>. Exchange an active
client secret as described in Client tokens.Authorization: Bearer <firebase-id-token>. See
User authentication.Keep credentials out of URLs and browser bundles. A ClientToken request must
come from the client domain represented by the token and the client's API
module must be enabled. A Firebase user token is checked against the user and
client claims.
These pages describe the external read, play, completion, and embedding contracts. GOFA CMS authoring, B2B administration, and content mutations are outside this integration surface.