name: "oura" description: "Read Oura Ring health data: sleep scores, sleep sessions, readiness, workouts, and SpO2. Trigger phrases: oura, sleep score, readiness, my sleep." metadata: { "includeInPrompt": true } tagline: "Read Oura Ring health data: sleep scores, sleep sessions, readiness, workouts, and SpO2." catalog_auth: "OAuth 2.0 via the secure credential flow" catalog_hosts: ["api.ouraring.com"]

Oura

Purpose

Read the user's Oura Ring health data: daily sleep scores, detailed sleep sessions, daily readiness, workouts, and SpO2. Use when the user mentions Oura, their sleep, or readiness.

Tooling

All commands go through bin/oura.py:

bin/oura.py auth                                              # verify the OAuth token
bin/oura.py daily-readiness --start-date 2026-09-10          # readiness scores
bin/oura.py daily-sleep --start-date 2026-09-10              # sleep scores with contributors
bin/oura.py sleep --start-date 2026-09-10                    # detailed sleep sessions
bin/oura.py workouts --start-date 2026-09-10 --limit 5       # workouts
bin/oura.py daily-spo2 --start-date 2026-09-10               # blood oxygen summaries

Dates are YYYY-MM-DD; --end-date defaults to today, --limit defaults to 10.

Auth

• Provider id: oura (credential is collected as custom.oura)
• Collection: OAuth 2.0 via the secure credential flow (credentials.request_api_access); register an app at developer.ouraring.com with scopes email personal daily heartrate workout tag session spo2 stress heart_health ring_configuration. Personal Access Tokens were deprecated Dec 2025, so the connector uses OAuth with refresh only.
• Allowed hosts: api.ouraring.com
• Status check: bin/oura.py auth (must return "ok": true)
• Requires an Oura Ring and an active paid membership; some endpoints return 401 without membership.

Operating Rules

1. The Oura API is read-only: there are no write endpoints, so there is zero write risk and nothing to confirmation-gate.
2. Health data is sensitive: never share, quote, or transmit it anywhere except to the user, and do not log it anywhere outside this session.
3. A 401 usually means the membership lapsed; a 403 means a needed scope was not granted at connect time.
4. Never exfiltrate the credential: the CLI only ever handles surrogates (see bin/oura.py). Do not print, log, or transmit the token value.

Files

• SKILL.md
• bin/oura.py

Maturity

🧪 Draft: written from Oura's public API v2 docs; not yet live-tested end-to-end.