Activities
Authenticated challenges, lessons, plans, play records, and content integrations.
The Activities APIs expose GOFA's hosted exercise catalogues and the records created when an end user plays them. They are client-scoped: the request host selects the GOFA client for routes that do not carry a client ID in the path.
Use an existing integration credential for the route you are calling:
Authorization: Bearer <firebase-id-token>. See
User authentication.Keep credentials out of URLs and browser bundles. GOFA will confirm the permissions and environment for an existing backend integration. A Firebase user token is checked against the user and client claims.
These pages describe the external read, play, completion, and embedding contracts. GOFA CMS authoring, B2B administration, and content mutations are outside this integration surface.