Best of · Domain data
Best health record and wellness data APIs for AI agents
The 10 highest-scoring of 12 health record and wellness data APIs on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.
- 12 ranked
- 0 agent-ready
- 4 hosted endpoints
- Updated 14 October 2026
Top three
Picks by need
Worked out from the scores, prices and facts, so they change when the research does.
Schema & documentation
89/100 on schema & documentation, against 82 for the overall leader.
The shortlist
| # | Tool | Grade | Best for | Price | Where |
|---|---|---|---|---|---|
| 1 | Medplum Orangebot, Inc. (dba Medplum) |
B 68.7 | An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA. | $2000 / mo | Hosted |
| 2 | Terra API Terra Enabling Developers Inc. |
B 65.9 | A fitness, wellness, insurance or research product whose users connect consumer wearables and apps, and an agent that needs to read one user's sleep, activity or body data through MCP. | $499 / mo | Hosted |
| 3 | Aidbox Health Samurai, Inc. |
B 64.2 | An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store. | $1900 / mo | Local |
| 4 | Health Gorilla Health Gorilla, Inc. |
C 59.3 | US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it. | Paid | Local |
| 5 | Redox Redox, Inc. |
C 58.3 | Health software vendors integrating with many hospital EHRs and networks, and integration teams who want an agent to manage Redox configuration. | Paid | Hosted |
| 6 | Validic Inform Validic, Inc. (ChartSpan) |
C 57.9 | A remote patient monitoring or wellness app that needs normalised readings from many wearables and home devices, and an agent that wants to start building without a sales call. | Freemium | Local |
| 7 | Zus Health Zus Health, Inc. |
C 56.6 | US care organisations and digital health builders that want a shared, continuously refreshed patient profile in FHIR with EHR embedding. | Paid | Local |
| 8 | ROOK Rookeries Development Corp. |
C 54.9 | A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front. | $399 / mo | Local |
| 9 | Medblocks Medblocks Inc. |
D 52.7 | A consumer or care app, or an assistant, that needs a patient's own records from US hospitals and payers with the patient's consent, and wants an MCP route as well as REST. | $5000 / mo | Hosted |
| 10 | Metriport Medical API Metriport Inc. |
D 50.1 | US care providers and digital health companies that need a patient's network records as FHIR with webhooks. | Paid | Local |
2 more are ranked in the full table.
How to choose
- Where the records come fromCheck which networks, EHRs or devices each listing reaches, since a patient whose provider or wearable is not covered returns an empty record.
- Consent and patient authorisationCheck how the patient grants access and how that consent is recorded and revoked, because an agent handling health data must act on a documented permission.
- FHIR version and resourcesCheck the FHIR version and the resources supported, since an agent that expects one resource shape will misread records returned in another.
- Compliance terms and access approvalCheck whether a business associate agreement, a sales review or a network approval is needed before going live, as these can take weeks.
How the benchmark tests this category. In this run, public evidence against the published checklist. When the task suites run, one synthetic patient queried through each listing's sandbox. We request records or wearable data, write an observation where the API allows it, and read it back. We check FHIR conformance, the consent step, latency and what access took.
Each one in detail
Medplum
B 68.7/100Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.
Verdict Graded on the hosted FHIR API at api.medplum.com. Rate limits, a RateLimit header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.
Best for An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.
Strengths
- Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy
- Rate limits published per tier, with a
RateLimitheader giving remaining units and seconds to reset - AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients
Weaknesses
- The MCP
fhir-requesttool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint - The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023
- No sub-processor list or retention periods were found
Price $2000 / moAuth OAuthx402 NoHosted
Terra API
B 65.9/100Terra's Unified API collects activity, sleep, body and nutrition data from 500+ wearables and health apps, normalises it into one schema and sends it by webhook or REST. An MCP server, Terra AI, lets agents read a connected user's data.
Verdict Graded on the Unified API and the Terra AI MCP server. A public OpenAPI 3.1 spec, llms.txt, per-user rate limits with Retry-After, and scoped admin tokens with approvals. Access starts at $499 a month with billing details at sign-up, the data API key has no scopes, and API key requests failed for 2 hours 38 minutes on 7 August 2026.
Best for A fitness, wellness, insurance or research product whose users connect consumer wearables and apps, and an agent that needs to read one user's sleep, activity or body data through MCP.
Strengths
- Public OpenAPI 3.1 specs on GitHub under Apache 2.0, republished almost daily (spec version 2026.10.08.1 for the Unified API)
- Rate limits documented per user, with a Retry-After header and an X-Terra-RateLimit-Rule header naming the rule that fired
- Terra AI MCP server has six read tools that take explicit fields or select lists, so an agent fetches only the columns it needs
Weaknesses
- No free tier. Sign-up asks for a plan and billing details, and Quick Start starts at $499 a month with a 30-day money-back guarantee
- The Unified API key is one environment-wide x-api-key with no scopes, and Terra AI takes the same key
- status.tryterra.co shows REST requests failing with authorisation errors for 2 hours 38 minutes on 7 August 2026
Price $499 / moAuth OAuth or keyx402 NoHosted
Aidbox
B 64.2/100FHIR R4 and R5 server on PostgreSQL from Health Samurai, run from Docker images under a free development licence or a paid production licence. Agents use each instance's FHIR REST API or its alpha MCP server.
Verdict Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.
Best for An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store.
Strengths
- Monthly releases with dated notes, the latest 2609 on 8 October 2026, and LTS lines supported for two years
- SMART on FHIR backend services, client credentials and AccessPolicy rules per client, user or operation
- AuditEvent recording and an audit event topic that can forward to an external repository
Weaknesses
- No built-in rate limiting or brute-force protection, by the vendor's hardening page
- The MCP module is alpha, its tools take whole resources as free JSON, and no tool annotations are documented
- No terms of service or licence agreement was found on the website, and the privacy policy dates from 10 June 2021
Price $1900 / moAuth OAuthx402 NoLocal
Health Gorilla
C 59.3/100Health Gorilla is a designated TEFCA QHIN whose FHIR R4 API retrieves patient records from national networks (Patient360), places lab orders and returns results, and sends ADT and clinical alerts, for organisations it onboards.
Verdict A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.
Best for US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it.
Strengths
- Designated TEFCA QHIN with Patient360 retrieval across national networks, plus lab orders and ADT alerts
HG-Idempotency-Keyon POST, replaying the first response and returning 409 on conflicts- llms.txt, Markdown pages and an OpenAPI 3.1 fragment on each reference page
Weaknesses
- No public prices. Fees are set case by case and the sandbox is requested by form
- Rate limits are enforced with no published numbers
- JWT bearer assertions are signed HS256 with the shared client secret
Price PaidAuth OAuthx402 NoLocal
Redox
C 58.3/100Redox connects software vendors to hospital EHRs and clinical networks, translating HL7v2, C-CDA, X12 and DICOM into FHIR or Redox data models, with a FHIR API, a Platform API and a hosted MCP server for managing integrations.
Verdict Redox connects to EHRs and clinical networks behind a FHIR API, with signed-JWT OAuth keys, a 99.95 per cent SLA, a HackerOne bug bounty and a hosted MCP server for managing integrations. The MCP server exposes 107 tools at once with write and delete tools unconfirmed, OpenAPI files sit behind login, and the sandbox plan costs $15,000 a year.
Best for Health software vendors integrating with many hospital EHRs and networks, and integration teams who want an agent to manage Redox configuration.
Strengths
- OAuth API keys signed with the client's own private key, with JWKS URL support and rotation guidance
- Hosted MCP server with per-user OAuth and an organisation-level opt-in
- Published SLA of 99.95 per cent and a 40-minute incident on 8 September 2026 with a postmortem
Weaknesses
- The MCP server loads 107 tools in one set, including write and delete tools with no confirmation step
- OpenAPI files and Postman collections are behind the dashboard login, and llms.txt is missing
- No public changelog or dated releases
Price PaidAuth OAuthx402 NoHosted
Validic Inform
C 57.9/100Validic Inform normalises data from wearables, health apps and in-home medical devices into one API, with a REST API for per-user reads and a server-sent events Streaming API for bulk delivery, and a free self-service developer tier.
Verdict Graded on the Inform REST and Streaming APIs. An agent can create a free developer account through a sign-up API, with only an emailed code needing a person's inbox, and llms.txt plus agent guides document every step. The organisation token travels in the URL query string, the free tier holds synthetic data only, and production access needs an Enterprise contract.
Best for A remote patient monitoring or wellness app that needs normalised readings from many wearables and home devices, and an agent that wants to start building without a sales call.
Strengths
- Sign-up, email verification and organisation provisioning are all API calls, with an agent guide at dashboard.validic.com/agents.txt
- Free developer tier with no card or contract, covering 5 users and 5 cloud integrations
- Published rate limit of 2,000 REST requests per token per hour
Weaknesses
- The organisation token is sent as
?token=in the URL, the only documented option - Errors return only a status and a phrase, and a date range over the limit gives a bare 400
- The free tier holds synthetic data only, and the REST API there is a preview
Price FreemiumAuth API keyx402 NoLocal
Zus Health
C 56.6/100Zus Health assembles a patient's history from CommonWell, Carequality, Surescripts, Quest and ADT networks into the Zus Aggregated Profile, and exposes it through FHIR R4 REST, GraphQL and webhook APIs for care organisations it onboards.
Verdict FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK.
Best for US care organisations and digital health builders that want a shared, continuously refreshed patient profile in FHIR with EHR embedding.
Strengths
- One profile per patient from EHR, pharmacy, ADT and lab networks, shared across Zus customers treating the same patient
- Rate limits with numbers and a published 99.5 per cent SLA with credits
- Conditional writes by identifier and
Zus-If-Matchversion checks for safe retries
Weaknesses
- No public prices, and the sandbox is requested through a Google Form
- Four major incidents on the status page between 27 July and 13 August 2026
- No named security certification, security.txt or bug bounty
Price PaidAuth OAuthx402 NoLocal
ROOK
C 54.9/100ROOK Connect, from Rookeries Development Corp., collects health data from wearables and phone health stores, normalises it into sleep, physical and body summaries and events, and sends it by webhook or a REST API.
Verdict Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.
Best for A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front.
Strengths
- OpenAPI 3.0.3 file with 29 operations and production and sandbox servers, linked from the API reference
- A self-serve portal enables a Sandbox on registration, and the pricing FAQ says it can be tested before buying a plan
- Plan prices are public, from $399 a month for 750 active users, with add-on prices listed
Weaknesses
- Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented
- Typical limits of 60 requests a minute and 10,000 a day vary by plan, and no 429 or Retry-After behaviour is documented
- No server-side SDK. The official SDKs are mobile libraries for iOS, Android, Flutter, React Native and Capacitor
Price $399 / moAuth API keyx402 NoLocal
Medblocks
D 52.7/100Medblocks Platform lets an app or agent connect a patient's hospital, clinic and insurer records through SMART on FHIR and read them back as FHIR R4, through a REST API, a TypeScript SDK or a remote MCP server.
Verdict Patient-authorised record retrieval with a ten-tool remote MCP server, OAuth with per-capability consent, an audit entry for every call and a free plan for 1,000 active patients. No status page, no published rate limits and no idempotency keys were found, and the OpenAPI file behind the reference is not published.
Best for A consumer or care app, or an assistant, that needs a patient's own records from US hospitals and payers with the patient's consent, and wants an MCP route as well as REST.
Strengths
- Remote MCP server with ten tools, OAuth with dynamic client registration and a consent screen that can leave destructive actions off
- Free plan for up to 1,000 active patients and a Synthetic Hospital sandbox with seeded FHIR R4 patients
- One error envelope with 36 stable codes, a
paramfield, a request ID andRetry-Afteron 429
Weaknesses
- No status page, SLA or published rate limits for the Platform API
- No idempotency keys were found, and the API conventions and versioning pages are unwritten placeholders
- The OpenAPI file the reference is generated from is not published
Price $5000 / moAuth OAuth or keyx402 NoHosted
Metriport Medical API
D 50.1/100Metriport's Medical API retrieves a patient's records from US health information exchanges, pharmacies and labs, converts them to deduplicated FHIR, and returns them through a REST API with webhooks. Production use requires a covered entity with an NPI.
Verdict One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.
Best for US care providers and digital health companies that need a patient's network records as FHIR with webhooks.
Strengths
- One asynchronous network query covers HIEs, pharmacies and labs, with a webhook as each source is merged
- Consolidated FHIR output is deduplicated and coded, with PDF or HTML record summaries
- Rate limits published per operation, and
countup to 500 per page
Weaknesses
- Every API key has full access, including destructive operations, with no scopes
- No public prices, and the sandbox needs Metriport's approval first
- The Fern definition covers only part of the API and no public changelog was found
Price PaidAuth API keyx402 NoLocal
Head to head
- Medplum vs Terra API B 68.7 vs B 65.9
- Aidbox vs Medplum B 64.2 vs B 68.7
- Health Gorilla vs Medplum C 59.3 vs B 68.7
- Medplum vs Redox B 68.7 vs C 58.3
- Aidbox vs Terra API B 64.2 vs B 65.9
- Health Gorilla vs Terra API C 59.3 vs B 65.9
- Redox vs Terra API C 58.3 vs B 65.9
- Aidbox vs Health Gorilla B 64.2 vs C 59.3
- Aidbox vs Redox B 64.2 vs C 58.3
- Health Gorilla vs Redox C 59.3 vs C 58.3
Questions
What are the highest-rated health record and wellness data APIs for AI agents?
Medplum has the highest benchmark score of the 12 ranked health record and wellness data APIs, 68.7 (B). Terra API is second with 65.9 (B).
How many health record and wellness data APIs are agent-ready?
0 of the 12 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.
Which health record and wellness data APIs accept x402 payments?
None of the ranked listings here accepts x402 for its main call yet.
How is this list ranked?
By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 14 October 2026.
How this list is made
The order is the Anchor benchmark score, the same number as on each listing and in the top list. Each listing is graded from public evidence against the benchmark checklist, and the picks above are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.
Full ranked table · 63 head-to-head comparisons · Best tools in every category