# HIITplay Developer Docs

HIITplay provides a free read-only JSON sandbox, a Streamable HTTP MCP server, OAuth 2.1 discovery, and an OpenAPI 3.1 contract.

## Free API Sandbox

The permanent curated five-minute workout is deterministic and available without an account, API key, OAuth, payment, or side effects.

```sh
curl "https://hiitplay.fit/api/workouts/preview?duration_minutes=5"
```

- Interactive documentation: https://hiitplay.fit/sandbox
- OpenAPI document: https://hiitplay.fit/openapi.json

## MCP

- Streamable HTTP endpoint: https://hiitplay.fit/mcp
- Setup and tool guide: https://hiitplay.fit/mcp.md
- Server card: https://hiitplay.fit/.well-known/mcp/server-card.json
- Discovery and `workout.preview` are anonymous.
- `workout.create`, `access.status`, and `billing.manage` require OAuth with `hiitplay.agent`.

## OAuth

- Protected-resource metadata: https://hiitplay.fit/.well-known/oauth-protected-resource
- Authorization-server metadata: https://hiitplay.fit/.well-known/oauth-authorization-server
- Dynamic client registration and PKCE S256 are supported.

## Errors

REST API errors use JSON with `error.code`, `error.message`, and `error.resolution`. MCP uses JSON-RPC errors and structured tool error results.

## Product Boundaries

HIITplay varies generated workouts by duration only. Do not imply adaptation to goals, injuries, equipment, fitness level, or medical needs. Treat Workout Session Links, OAuth credentials, and payment links as private and time-limited.