{ "data": { "category": { "area": "domain-data", "capabilities": [ "health.records", "health.fhir", "health.ehr", "health.wearables", "health.consent" ], "description": "APIs that retrieve a patient's clinical records from hospitals and health information networks, connect to EHRs, store records on a FHIR server, or read data from wearables and health apps. Compared on record coverage, FHIR support, consent and patient authorisation, compliance terms and how access is granted.", "json": "https://www.anchorterminal.com/categories/health-data.json", "name": "Health records \u0026 wellness data", "slug": "health-data", "test": "In this run, public evidence against the published checklist. When the task suites run, one synthetic patient queried through each listing's sandbox. We request records or wearable data, write an observation where the API allows it, and read it back. We check FHIR conformance, the consent step, latency and what access took.", "title": "Health record and wellness data APIs for AI agents", "toolCount": 12, "tools": [ "medplum", "terra", "aidbox", "health-gorilla", "redox", "validic", "zus-health", "rook", "medblocks", "metriport", "particle-health", "1uphealth" ], "url": "https://www.anchorterminal.com/categories/health-data" }, "tools": [ { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "area": "domain-data", "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:41:57.409301454Z", "lastOk": true, "lastStatus": 401, "lastMs": 255, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 389, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:41:57.409301454Z" } }, { "slug": "terra", "name": "Terra API", "vendor": "Terra Enabling Developers Inc.", "vendorUrl": "https://tryterra.co", "kind": "http-api", "category": "health-data", "summary": "Terra's Unified API collects activity, sleep, body and nutrition data from 500+ wearables and health apps, normalises it into one schema and sends it by webhook or REST. An MCP server, Terra AI, lets agents read a connected user's data.", "url": "https://www.anchorterminal.com/tools/terra", "markdownUrl": "https://www.anchorterminal.com/tools/terra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/terra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/terra.json", "repo": "https://github.com/tryterra/openapi", "license": "Proprietary service under Terra's terms of service. The OpenAPI specs repository is Apache 2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://access.tryterra.co/api/v2/mcp/\u003cuser_id\u003e", "packages": [ { "registry": "pypi", "name": "terra-python" }, { "registry": "npm", "name": "terra-api" }, { "registry": "npm", "name": "@tryterra/cli" } ], "auth": "mixed", "authNotes": "A self-serve dashboard account gives a dev-id and one x-api-key per environment, sent as headers to the Unified API and to Terra AI. The key has no scopes and can be rotated. The admin API and admin MCP server take personal access tokens with 26 scopes, lifetimes of 7 to 90 days and optional environment limits. The admin MCP server signs in by OAuth, and risky changes need approval in the dashboard. End users connect each wearable through Terra's widget, and Terra holds the provider tokens.", "pricing": "usage", "pricingNotes": "Quick Start from $499 a month includes 100,000 credits, then $0.005 a credit to 1,000,000 and $0.003 above. Sign-up asks for a plan and billing details, with a 30-day money-back guarantee and no free tier found. Testing and staging environments allow 50 users each. Enterprise is custom (checked 2026-10-14).", "priceSummary": "$499 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI specs or the pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": 6, "popularity": { "githubStars": null, "npmWeekly": 13061, "pypiWeekly": 10636, "asOf": "2026-10-14" }, "docsUrl": "https://docs.tryterra.co", "llmsTxt": "https://docs.tryterra.co/llms.txt", "openapi": "https://raw.githubusercontent.com/tryterra/openapi/master/dist/core/v2-bundled.yaml", "capabilities": [ "health.wearables", "health.consent", "health.fhir" ], "tags": [ "hosted", "wearables", "health-data", "mcp", "api-key", "openapi", "llms-txt", "webhooks", "status-page", "python", "typescript", "soc2", "hipaa" ], "lastRelease": "2026-10-13", "graded": true, "anchor": { "graded": true, "score": 65.9, "grade": "B", "agentReady": false, "rank": 327, "ranked": true, "rankOf": 1076, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 75, "payments": 20, "reliability": 67, "schema": 89, "security": 65, "transparency": 56 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Graded on the Unified API and the Terra AI MCP server. A public OpenAPI 3.1 spec, llms.txt, per-user rate limits with Retry-After, and scoped admin tokens with approvals. Access starts at $499 a month with billing details at sign-up, the data API key has no scopes, and API key requests failed for 2 hours 38 minutes on 7 August 2026.", "bestFor": "A fitness, wellness, insurance or research product whose users connect consumer wearables and apps, and an agent that needs to read one user's sleep, activity or body data through MCP.", "strengths": [ "Public OpenAPI 3.1 specs on GitHub under Apache 2.0, republished almost daily (spec version 2026.10.08.1 for the Unified API)", "Rate limits documented per user, with a Retry-After header and an X-Terra-RateLimit-Rule header naming the rule that fired", "Terra AI MCP server has six read tools that take explicit fields or select lists, so an agent fetches only the columns it needs", "Admin tokens carry 26 scopes, expire within 90 days, can be limited to environments, and risky changes need approval in the dashboard", "Credit prices are public, $0.005 a credit from 100,001 to 1,000,000 and $0.003 above, with 200 credits per active user a month" ], "weaknesses": [ "No free tier. Sign-up asks for a plan and billing details, and Quick Start starts at $499 a month with a 30-day money-back guarantee", "The Unified API key is one environment-wide x-api-key with no scopes, and Terra AI takes the same key", "status.tryterra.co shows REST requests failing with authorisation errors for 2 hours 38 minutes on 7 August 2026", "No SLA is published outside Enterprise contracts, and no idempotency keys were found for write endpoints", "The privacy policy, effective 20 April 2023, excludes end-user wearable data, and no public sub-processor list was found" ], "agentNotes": [ "Send dev-id and x-api-key headers on every Unified API and Terra AI call. A missing header returns 401 problem+json", "Keep each request window to 1,825 days or less and under 6,000 requested days per user an hour. On 429 with rule r2, wait Retry-After seconds", "Pass either fields or select to Terra AI tools, never both and never neither, or the call fails with a validation error", "Expect data by webhook after a user connects through the widget session. REST reads are for backfills and on-demand queries", "Use the Read only access level for the admin MCP server unless a change is needed. The MCP level can read API keys" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.9 } ], "editorialScores": { "ergonomics": 78, "maintenance": 75, "payments": 20, "reliability": 67, "schema": 89, "security": 65, "transparency": 42 }, "provenanceScore": 69 }, "connect": { "claudeCode": "claude mcp add --transport http terra-ai https://access.tryterra.co/api/v2/mcp/\u003cuser_id\u003e --header \"dev-id: \u003cYOUR_DEV_ID\u003e\" --header \"x-api-key: \u003cYOUR_API_KEY\u003e\"", "config": { "mcpServers": { "terra-ai": { "headers": { "dev-id": "YOUR_DEV_ID", "x-api-key": "YOUR_API_KEY" }, "url": "https://access.tryterra.co/api/v2/mcp/\u003cuser_id\u003e" } } } }, "letme": { "capability": "https://letme.dev/health.wearables", "tool": "https://letme.dev/terra" }, "area": "domain-data", "unitPrices": [ { "item": "Quick Start plan, 100,000 credits included", "unit": "month", "usd": 499, "note": "From price on tryterra.co/pricing, 2026-10-14" }, { "item": "Credit beyond the monthly allowance (100,001 to 1,000,000)", "unit": "credit", "usd": 0.005, "note": "$0.003 above 1,000,000 credits. An active user costs 200 credits a month" } ], "provenance": { "legalEntity": "Terra Enabling Developers Inc.", "domain": "tryterra.co", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://tryterra.co/terms-of-service", "privacy": "https://tryterra.co/privacy", "statusPage": "https://status.tryterra.co", "changelog": "https://docs.tryterra.co/changelog/2026/readme", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms of service, last updated 1 May 2026, are between the customer and Terra Enabling Developers Inc., a Delaware corporation. The privacy policy names a UK subsidiary, Terra Enabling Developers Ltd.", "The privacy policy (effective 20 April 2023) says it doesn't cover data collected from wearables about end users, and that processing takes place mainly in the United Kingdom.", "tryterra.co/.well-known/security.txt returns 404.", "RDAP for tryterra.co returned no registration date.", "API and MCP endpoints answer at access.tryterra.co, a tryterra.co subdomain." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/terra.json", "live": { "slug": "terra", "probe": { "target": "https://access.tryterra.co/api/v2/mcp/\u003cuser_id\u003e", "method": "get", "lastAt": "2026-10-14T09:42:10.210334836Z", "lastOk": true, "lastStatus": 401, "lastMs": 45, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 47, "p95ms24h": 126, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.tryterra.co", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:54:00.980823971Z" }, "updatedAt": "2026-10-14T09:42:10.210334836Z" } }, { "slug": "aidbox", "name": "Aidbox", "vendor": "Health Samurai, Inc.", "vendorUrl": "https://www.health-samurai.io/aidbox", "kind": "http-api", "category": "health-data", "summary": "FHIR R4 and R5 server on PostgreSQL from Health Samurai, run from Docker images under a free development licence or a paid production licence. Agents use each instance's FHIR REST API or its alpha MCP server.", "url": "https://www.anchorterminal.com/tools/aidbox", "markdownUrl": "https://www.anchorterminal.com/tools/aidbox.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aidbox.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aidbox.json", "repo": "https://github.com/Aidbox", "license": "Proprietary. Aidbox runs from Health Samurai's Docker images under a free development licence (no PHI) or a paid production licence. Examples and the Python SDK on GitHub are MIT", "transports": [ "http", "streamable-http", "sse" ], "packages": [ { "registry": "oci", "name": "healthsamurai/aidboxone" } ], "auth": "oauth", "authNotes": "Each instance has its own OAuth 2.0 server. Agents use a Client resource with the client credentials grant and POST to /auth/token, and SMART on FHIR backend services with private key JWT are supported. AccessPolicy resources decide what each client, user or operation may do, and access token lifetime is set per Client. Basic auth with the client ID and secret is also documented. The MCP endpoints are closed until an AccessPolicy opens them.", "pricing": "freemium", "pricingNotes": "Aidbox Dev is $0 for development and testing with no PHI, Aidbox Base from $1,900 a month or $19,000 a year, Enterprise by contact (health-samurai.io/price, checked 2026-10-14). A production licence runs 14 days as a trial before Health Samurai extends it. A free hosted sandbox on Google Cloud comes with an aidbox.app account. Whether sign-up asks for a card was not established.", "priceSummary": "$1900 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": 9, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.health-samurai.io/docs/aidbox", "llmsTxt": "https://www.health-samurai.io/docs/aidbox/llms.txt", "capabilities": [ "health.fhir", "health.records", "health.consent" ], "tags": [ "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "docker", "postgresql", "llms-txt", "iso27001" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 64.2, "grade": "B", "agentReady": false, "rank": 385, "ranked": true, "rankOf": 1076, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 80, "payments": 25, "reliability": 59, "schema": 77, "security": 74, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.", "bestFor": "An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store.", "strengths": [ "Monthly releases with dated notes, the latest 2609 on 8 October 2026, and LTS lines supported for two years", "SMART on FHIR backend services, client credentials and AccessPolicy rules per client, user or operation", "AuditEvent recording and an audit event topic that can forward to an external repository", "Free development licence and hosted sandbox, with Base pricing published from $1,900 a month", "Cosign-signed images, SBOMs per release and remediation deadlines from 7 days for critical vulnerabilities" ], "weaknesses": [ "No built-in rate limiting or brute-force protection, by the vendor's hardening page", "The MCP module is alpha, its tools take whole resources as free JSON, and no tool annotations are documented", "No terms of service or licence agreement was found on the website, and the privacy policy dates from 10 June 2021", "Closed source with no public CI and no OpenAPI document", "No public status page, security.txt or sub-processor list was found" ], "agentNotes": [ "Ask the operator for a Client with an AccessPolicy limited to the task. Don't rely on the public MCP policy, which the docs mark unsafe", "Use `If-None-Exist` on creates and conditional update on identifiers so retries don't duplicate records", "Use `_elements` and `_count` to keep responses small, and follow the Bundle's paging links", "Throttle yourself. Aidbox applies no rate limit, so a burst lands on the customer's database", "Don't load real patient data into an instance on a development licence" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.2 } ], "editorialScores": { "ergonomics": 79, "maintenance": 80, "payments": 25, "reliability": 59, "schema": 77, "security": 74, "transparency": 51 }, "provenanceScore": 39 }, "connect": { "install": "curl -JO https://aidbox.app/runme \u0026\u0026 docker compose up" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/aidbox" }, "area": "domain-data", "unitPrices": [ { "item": "Aidbox Base licence", "unit": "month", "usd": 1900, "note": "From price, monthly billing. $19,000 a year on yearly billing" } ], "provenance": { "legalEntity": "Health Samurai, Inc.", "domain": "health-samurai.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://www.health-samurai.io/legal/privacy-policy", "statusPage": "", "changelog": "https://www.health-samurai.io/docs/aidbox/overview/release-notes", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The site footer and privacy policy name Health Samurai, Inc. The privacy policy was last updated on 10 June 2021 and refers to Terms of Use that were not found.", "No terms of service or licence agreement was found at /legal or in the docs.", "www.health-samurai.io/.well-known/security.txt returns a 404 page. The supply chain page sends reports to security@health-samurai.io.", "Aidbox runs on the customer's infrastructure, so endpoints are on the customer's domain. The free sandbox runs on aidbox.app subdomains.", "No public status page was found. The domain registration date was not established." ], "score": 39 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aidbox.json" }, { "slug": "health-gorilla", "name": "Health Gorilla", "vendor": "Health Gorilla, Inc.", "vendorUrl": "https://www.healthgorilla.com", "kind": "http-api", "category": "health-data", "summary": "Health Gorilla is a designated TEFCA QHIN whose FHIR R4 API retrieves patient records from national networks (Patient360), places lab orders and returns results, and sends ADT and clinical alerts, for organisations it onboards.", "url": "https://www.anchorterminal.com/tools/health-gorilla", "markdownUrl": "https://www.anchorterminal.com/tools/health-gorilla.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/health-gorilla.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/health-gorilla.json", "license": "Proprietary service under Health Gorilla's API Terms of Use (updated 22 January 2026), with a signed licence agreement required before production", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 credentials (client ID and secret) are issued by Health Gorilla during implementation, separately for sandbox and production. Server-to-server calls use the JWT bearer grant with an assertion signed HS256 with the client secret. User-facing apps use the authorisation code grant, and an implicit grant can be enabled. Scopes such as `system/Patient.read`, `system/Observation.write` and `patient360` are assigned at registration and cannot be self-assigned.", "pricing": "paid", "pricingNotes": "No public prices. The API Terms of Use say fees 'are determined on a case-by-case basis by our business development team', and the sandbox is requested through the contact page (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer portal, llms.txt or the API terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.healthgorilla.com", "llmsTxt": "https://developer.healthgorilla.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent" ], "tags": [ "hosted", "health-records", "fhir", "qhin", "lab-orders", "oauth", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 59.3, "grade": "C", "agentReady": false, "rank": 583, "ranked": true, "rankOf": 1076, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 63, "payments": 5, "reliability": 58, "schema": 80, "security": 66, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.", "bestFor": "US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it.", "strengths": [ "Designated TEFCA QHIN with Patient360 retrieval across national networks, plus lab orders and ADT alerts", "`HG-Idempotency-Key` on POST, replaying the first response and returning 409 on conflicts", "llms.txt, Markdown pages and an OpenAPI 3.1 fragment on each reference page", "Release notes dated separately for sandbox and production, the latest on 14 October 2026" ], "weaknesses": [ "No public prices. Fees are set case by case and the sandbox is requested by form", "Rate limits are enforced with no published numbers", "JWT bearer assertions are signed HS256 with the shared client secret", "The API terms allow termination or disabling of access at any time, with or without notice" ], "agentNotes": [ "Send a fresh UUID in `HG-Idempotency-Key` on every POST and reuse it only when retrying the same payload", "Poll async operations no sooner than the `Retry-After` value and treat 454 as an expired result", "Follow `link.relation=next` in Bundles rather than building offsets yourself", "Expect mocked Patient360 data in sandbox unless network connectivity is enabled for the tenant", "Log `X-HG-Request-Id` from each response for support cases" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.3 } ], "editorialScores": { "ergonomics": 72, "maintenance": 63, "payments": 5, "reliability": 58, "schema": 80, "security": 66, "transparency": 38 }, "provenanceScore": 83 }, "connect": { "http": "GET https://sandbox.healthgorilla.com/fhir/R4/Patient?_count=50\nAuthorization: Bearer \u003caccess-token\u003e\nAccept: application/fhir+json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/health-gorilla" }, "area": "domain-data", "provenance": { "legalEntity": "Health Gorilla, Inc.", "domain": "healthgorilla.com", "domainRegistered": "2006-04-09", "endpointOnVendorDomain": true, "terms": "https://developer.healthgorilla.com/docs/terms-of-use", "privacy": "https://www.healthgorilla.com/home/privacy-policy", "statusPage": "https://status.healthgorilla.com", "changelog": "https://developer.healthgorilla.com/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The API Terms of Use (updated 22 January 2026) are between the developer and Health Gorilla, Inc., require a signed licence before production, and may be amended with or without notice.", "The privacy policy (last updated 30 August 2024) names Health Gorilla, Inc., covers the website and its platforms, gives no retention periods or sub-processors, and lists a Coral Gables, FL mailing address.", "www.healthgorilla.com/.well-known/security.txt returns the site's 404 page. A page at /home/security-txt shows a security.txt with Contact security@healthgorilla.com and Expires 2025-12-31.", "The website's Terms of Use page links an Enterprise SaaS Agreement (July 2024 version) that we did not read.", "RDAP gives healthgorilla.com a registration date of 2006-04-09." ], "score": 83 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/health-gorilla.json", "live": { "slug": "health-gorilla", "vendorStatus": { "page": "https://status.healthgorilla.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:15.462244766Z" }, "updatedAt": "2026-10-14T09:39:15.462244766Z" } }, { "slug": "redox", "name": "Redox", "vendor": "Redox, Inc.", "vendorUrl": "https://redoxengine.com", "kind": "http-api", "category": "health-data", "summary": "Redox connects software vendors to hospital EHRs and clinical networks, translating HL7v2, C-CDA, X12 and DICOM into FHIR or Redox data models, with a FHIR API, a Platform API and a hosted MCP server for managing integrations.", "url": "https://www.anchorterminal.com/tools/redox", "markdownUrl": "https://www.anchorterminal.com/tools/redox.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/redox.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/redox.json", "license": "Proprietary service under Redox's Cloud Services Agreement, EULA and SLA (version 2016.1)", "transports": [ "http" ], "remoteUrl": "https://api.redoxengine.com/mcp", "packages": [], "auth": "oauth", "authNotes": "Data exchange uses OAuth API keys. The client signs a JWT assertion with a private key whose public half Redox holds (generated in the dashboard, pasted as a JWKS entry, or served from a JWKS URL), then exchanges it for a bearer token. Keys can be rotated, legacy API keys can be migrated, and user-level API keys exist for the Platform API. Each user connects to the MCP server through OAuth in their AI client after an organisation owner opts the organisation in.", "pricing": "paid", "pricingNotes": "Annual plans. Sandbox starts at $15,000 a year (a development environment with a FHIR sandbox and simulated patients, for organisations under 500 employees), Core starts at $35,000 a year, and Advanced is priced by sales. Consumption is billed on anticipated transaction volume, with no unit rates published. Anyone can create a dashboard account without a card, but what it can call before a plan is not stated (checked 2026-10-14).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the MCP server page or the pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": 107, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.redoxengine.com", "capabilities": [ "health.ehr", "health.fhir", "health.records" ], "tags": [ "hosted", "ehr-integration", "fhir", "hl7v2", "mcp", "oauth", "status-page", "sla", "bug-bounty", "hitrust", "soc2", "sales-led" ], "graded": true, "anchor": { "graded": true, "score": 58.3, "grade": "C", "agentReady": false, "rank": 618, "ranked": true, "rankOf": 1076, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 54, "maintenance": 31, "payments": 15, "reliability": 85, "schema": 56, "security": 78, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Redox connects to EHRs and clinical networks behind a FHIR API, with signed-JWT OAuth keys, a 99.95 per cent SLA, a HackerOne bug bounty and a hosted MCP server for managing integrations. The MCP server exposes 107 tools at once with write and delete tools unconfirmed, OpenAPI files sit behind login, and the sandbox plan costs $15,000 a year.", "bestFor": "Health software vendors integrating with many hospital EHRs and networks, and integration teams who want an agent to manage Redox configuration.", "strengths": [ "OAuth API keys signed with the client's own private key, with JWKS URL support and rotation guidance", "Hosted MCP server with per-user OAuth and an organisation-level opt-in", "Published SLA of 99.95 per cent and a 40-minute incident on 8 September 2026 with a postmortem", "HITRUST r2, SOC 2 Type 2 and a public HackerOne bug bounty" ], "weaknesses": [ "The MCP server loads 107 tools in one set, including write and delete tools with no confirmation step", "OpenAPI files and Postman collections are behind the dashboard login, and llms.txt is missing", "No public changelog or dated releases", "The cheapest plan with a sandbox starts at $15,000 a year" ], "agentNotes": [ "Name the environment in every MCP prompt and try configuration changes in staging first, as Redox advises", "Stay under 7,500 requests per IP per five minutes, and back off exponentially on 5XX", "Sign the token request with the private key whose public key is registered on the OAuth API key", "Ask an organisation owner to enable the MCP server before connecting a client", "Treat log payloads returned through MCP as PHI and as untrusted text" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 58.3 } ], "editorialScores": { "ergonomics": 54, "maintenance": 31, "payments": 15, "reliability": 85, "schema": 56, "security": 78, "transparency": 37 }, "provenanceScore": 80 }, "connect": { "http": "https://api.redoxengine.com/mcp" }, "letme": { "capability": "https://letme.dev/health.ehr", "tool": "https://letme.dev/redox" }, "area": "domain-data", "provenance": { "legalEntity": "Redox, Inc.", "domain": "redoxengine.com", "domainRegistered": "2014-07-23", "endpointOnVendorDomain": true, "terms": "https://redoxengine.com/legal/terms-of-use/", "privacy": "https://redoxengine.com/legal/privacy-policy/", "statusPage": "https://status.redoxengine.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The website terms of use (version 2014.1, last updated 17 October 2015) name Redox, Inc., 25 West Main Street, Suite 500, Madison, WI 53703, and forbid crawling that impairs a system. Service use falls under a Cloud Services Agreement and the EULA, which we did not read.", "The SLA page is version 2016.1, dated 13 February 2016.", "The privacy policy (last updated 18 January 2023) covers the website and says it doesn't govern data Redox processes for customers.", "redoxengine.com/.well-known/security.txt returns 404. The platform security page points to a HackerOne bug bounty.", "docs.redoxengine.com/llms.txt returns the HTML site rather than an llms.txt file. No public changelog was found.", "RDAP gives redoxengine.com a registration date of 2014-07-23." ], "score": 80 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/redox.json", "live": { "slug": "redox", "probe": { "target": "https://api.redoxengine.com/mcp", "method": "get", "lastAt": "2026-10-14T09:42:04.293207713Z", "lastOk": true, "lastStatus": 401, "lastMs": 251, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 265, "p95ms24h": 428, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.redoxengine.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:39.154707608Z" }, "updatedAt": "2026-10-14T09:42:04.293207713Z" } }, { "slug": "validic", "name": "Validic Inform", "vendor": "Validic, Inc. (ChartSpan)", "vendorUrl": "https://validic.com", "kind": "http-api", "category": "health-data", "summary": "Validic Inform normalises data from wearables, health apps and in-home medical devices into one API, with a REST API for per-user reads and a server-sent events Streaming API for bulk delivery, and a free self-service developer tier.", "url": "https://www.anchorterminal.com/tools/validic", "markdownUrl": "https://www.anchorterminal.com/tools/validic.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/validic.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/validic.json", "repo": "https://github.com/Validic/inform-quickstart", "license": "Proprietary service under Validic's Online Service Agreement for Inform (last updated 13 August 2025). The inform-quickstart sample apps are MIT", "transports": [ "http", "sse" ], "packages": [], "auth": "api-key", "authNotes": "Every Inform request carries the organisation token as `?token=` in the query string, the only option documented. A developer account is created by a sign-up API at https://api.dashboard.validic.com (register, verify a six-digit emailed code, log in, provision), which returns `organization_id` and `organization_token`. End users connect their devices through a Validic marketplace URL returned for each user. No scopes or rotation were found.", "pricing": "freemium", "pricingNotes": "The Developer tier is free with no card or contract and allows 5 connected users, 5 cloud integrations, the Streaming API, a REST API preview and 90-day retention, on synthetic test data, with no SLA. A Business tier is listed as coming soon. Enterprise is negotiated and adds a BAA, custom SLA, all sources and 7-year retention (checked 2026-10-14).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, agent guides or the sign-up page (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.validic.com", "llmsTxt": "https://developer.validic.com/llms.txt", "capabilities": [ "health.wearables", "health.consent" ], "tags": [ "hosted", "wearables", "remote-patient-monitoring", "api-key", "llms-txt", "sse", "free-tier", "status-page", "programmatic-signup" ], "lastRelease": "2026-10-12", "graded": true, "anchor": { "graded": true, "score": 57.9, "grade": "C", "agentReady": false, "rank": 628, "ranked": true, "rankOf": 1076, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 74, "payments": 40, "reliability": 73, "schema": 75, "security": 30, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Graded on the Inform REST and Streaming APIs. An agent can create a free developer account through a sign-up API, with only an emailed code needing a person's inbox, and llms.txt plus agent guides document every step. The organisation token travels in the URL query string, the free tier holds synthetic data only, and production access needs an Enterprise contract.", "bestFor": "A remote patient monitoring or wellness app that needs normalised readings from many wearables and home devices, and an agent that wants to start building without a sales call.", "strengths": [ "Sign-up, email verification and organisation provisioning are all API calls, with an agent guide at dashboard.validic.com/agents.txt", "Free developer tier with no card or contract, covering 5 users and 5 cloud integrations", "Published rate limit of 2,000 REST requests per token per hour", "Dated release notes, the newest for the Inform platform on 12 October 2026", "No status page incidents between 16 July and 14 October 2026" ], "weaknesses": [ "The organisation token is sent as `?token=` in the URL, the only documented option", "Errors return only a status and a phrase, and a date range over the limit gives a bare 400", "The free tier holds synthetic data only, and the REST API there is a preview", "No server-side SDK and no full OpenAPI file, only fragments on each reference page" ], "agentNotes": [ "Show the developer the free-tier terms and wait for acceptance before calling `POST /auth/register`", "Send `Authorization: \u003cid_token\u003e` to sign-up calls, but pass the organisation token as `?token=` on Inform calls", "Use the customer `uid` in URLs, never Validic's internal `id`, which returns a silent 404", "Keep date ranges to 30 days or less and page month by month for backfills", "Unwrap `data` on list responses and treat an empty array as normal on a new account" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.9 } ], "editorialScores": { "ergonomics": 50, "maintenance": 74, "payments": 40, "reliability": 73, "schema": 75, "security": 30, "transparency": 53 }, "provenanceScore": 88 }, "connect": { "http": "curl \"https://api.v2.validic.com/organizations/$ORG_ID/users?token=$ORG_TOKEN\"" }, "letme": { "capability": "https://letme.dev/health.wearables", "tool": "https://letme.dev/validic" }, "area": "domain-data", "provenance": { "legalEntity": "Validic, Inc.", "domain": "validic.com", "domainRegistered": "2005-09-11", "endpointOnVendorDomain": true, "terms": "https://validic.com/online-service-agreement-inform/", "privacy": "https://validic.com/privacy-policy/", "statusPage": "https://status.validic.com", "changelog": "https://help.validic.com/space/VRN", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The Online Service Agreement (last updated 13 August 2025) names Validic, Inc. The privacy policy was last updated 20 January 2026.", "ChartSpan announced the completed acquisition of Validic on 22 June 2026, and the inform-quickstart licence names Chartspan Medical Technologies.", "validic.com/.well-known/security.txt returns 404.", "The developer changelog at developer.validic.com/changelog stopped on 15 April 2025 and points to the release notes on help.validic.com.", "RDAP for validic.com gives a registration date of 11 September 2005." ], "score": 88 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/validic.json", "live": { "slug": "validic", "vendorStatus": { "page": "https://status.validic.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:45.767488138Z" }, "updatedAt": "2026-10-14T09:39:45.767488138Z" } }, { "slug": "zus-health", "name": "Zus Health", "vendor": "Zus Health, Inc.", "vendorUrl": "https://www.zushealth.com", "kind": "http-api", "category": "health-data", "summary": "Zus Health assembles a patient's history from CommonWell, Carequality, Surescripts, Quest and ADT networks into the Zus Aggregated Profile, and exposes it through FHIR R4 REST, GraphQL and webhook APIs for care organisations it onboards.", "url": "https://www.anchorterminal.com/tools/zus-health", "markdownUrl": "https://www.anchorterminal.com/tools/zus-health.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zus-health.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zus-health.json", "license": "Proprietary service under the Zus Builder Terms of Service (last updated 11 March 2025), the Developer Sandbox Terms and the Zus Business Associate Addendum", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 bearer tokens valid for one hour. Backend systems use machine-to-machine App Clients created in the Zus app or through the Auth Service API, limited to 200 token requests an hour per client. Apps can exchange an OIDC ID token from their own identity provider for a Zus token, and integration App Clients with the Builder Data Integration role can fetch tokens for users through the proxy-token endpoint. Accounts are provisioned by Zus, with an initial admin per customer.", "pricing": "paid", "pricingNotes": "No public prices. The Builder Terms set fees in an executed Order Form or pricing list, invoiced monthly. A developer sandbox is requested through a Google Form on the docs site, and its cost is not stated (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation, llms.txt or the Builder Terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.zushealth.com", "llmsTxt": "https://docs.zushealth.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.ehr", "health.consent" ], "tags": [ "hosted", "health-records", "fhir", "graphql", "oauth", "llms-txt", "webhooks", "status-page", "sla", "sales-led" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 56.6, "grade": "C", "agentReady": false, "rank": 669, "ranked": true, "rankOf": 1076, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 64, "payments": 5, "reliability": 66, "schema": 77, "security": 49, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK.", "bestFor": "US care organisations and digital health builders that want a shared, continuously refreshed patient profile in FHIR with EHR embedding.", "strengths": [ "One profile per patient from EHR, pharmacy, ADT and lab networks, shared across Zus customers treating the same patient", "Rate limits with numbers and a published 99.5 per cent SLA with credits", "Conditional writes by identifier and `Zus-If-Match` version checks for safe retries", "Dated changelog that announces changes ahead, such as the proxy-token role change on 14 October 2026" ], "weaknesses": [ "No public prices, and the sandbox is requested through a Google Form", "Four major incidents on the status page between 27 July and 13 August 2026", "No named security certification, security.txt or bug bounty", "The GraphQL API is beta and no official SDK exists" ], "agentNotes": [ "Cache the access token for its hour. More than 200 token requests an hour per App Client returns 429", "Request Patient History at most once per patient per 24 hours, and poll the job status endpoint", "Use conditional create by identifier so a retried write doesn't duplicate a resource", "Send `Zus-If-Match` with the resource's ETag on PUT and PATCH", "Set `_count` up to 500 on searches, since the default page is 10" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 64, "payments": 5, "reliability": 66, "schema": 77, "security": 49, "transparency": 46 }, "provenanceScore": 71 }, "connect": { "http": "GET https://api.sandbox.zusapi.com/fhir/Patient?_count=50\nAuthorization: Bearer \u003caccess-token\u003e" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/zus-health" }, "area": "domain-data", "provenance": { "legalEntity": "Zus Health, Inc.", "domain": "zushealth.com", "domainRegistered": "2012-02-25", "endpointOnVendorDomain": false, "terms": "https://www.zushealth.com/builder-terms-of-service", "privacy": "https://www.zushealth.com/privacy-policy", "statusPage": "https://status.zusapi.com", "changelog": "https://docs.zushealth.com/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The APIs answer on zusapi.com, a separate domain from zushealth.com.", "The Builder Terms (last updated 11 March 2025) put term changes into effect 30 days after posting and BAA changes after 90 days. The Developer Sandbox Terms (22 January 2024) limit the sandbox to test data. The website lists 1 Lincoln Street, Suite 2900, Boston, MA 02111.", "The privacy policy (last updated 24 June 2026) covers the website only and names Google Analytics.", "The Builder Security Policy (11 March 2025) names no certification and makes a summary of an annual third-party audit available on request.", "www.zushealth.com/.well-known/security.txt returns 404.", "RDAP gives zushealth.com a registration date of 2012-02-25." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zus-health.json", "live": { "slug": "zus-health", "vendorStatus": { "page": "https://status.zusapi.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:54:10.020449939Z" }, "updatedAt": "2026-10-14T08:54:10.020449939Z" } }, { "slug": "rook", "name": "ROOK", "vendor": "Rookeries Development Corp.", "vendorUrl": "https://www.tryrook.io", "kind": "http-api", "category": "health-data", "summary": "ROOK Connect, from Rookeries Development Corp., collects health data from wearables and phone health stores, normalises it into sleep, physical and body summaries and events, and sends it by webhook or a REST API.", "url": "https://www.anchorterminal.com/tools/rook", "markdownUrl": "https://www.anchorterminal.com/tools/rook.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/rook.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/rook.json", "repo": "https://github.com/RookeriesDevelopment", "license": "Proprietary service under ROOK's Terms and Conditions for ROOK services", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "react-native-rook-sdk" }, { "registry": "npm", "name": "capacitor-rook-sdk" } ], "auth": "api-key", "authNotes": "A person registers an organisation in the ROOK Portal, which enables a Sandbox project, then generates a client UUID and secret key. The secret is shown once. Calls use HTTP Basic auth with the UUID as username and the secret as password. Production needs new credentials, an active plan and signed agreements. No scopes or key rotation were found. End users authorise each data source through ROOK's authoriser pages, the mobile SDKs or the ROOK App.", "pricing": "paid", "pricingNotes": "Core $399 a month for up to 750 active users, Core+ $999 for 5,000, Business $1,999 for 15,000, Enterprise custom. Add-ons cost $79 to $499 a month. A Sandbox is available before buying a plan. The standard term is 12 months with 30 days' notice to cancel (checked 2026-10-14).", "priceSummary": "$399 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI file or the pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.tryrook.io", "llmsTxt": "https://docs.tryrook.io/llms.txt", "openapi": "https://docs.tryrook.io/redocusaurus/plugin-redoc-0.yaml", "capabilities": [ "health.wearables", "health.consent", "health.fhir" ], "tags": [ "hosted", "wearables", "health-data", "api-key", "openapi", "llms-txt", "sandbox", "webhooks", "status-page", "hipaa" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 54.9, "grade": "C", "agentReady": false, "rank": 718, "ranked": true, "rankOf": 1076, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 73, "payments": 25, "reliability": 75, "schema": 74, "security": 32, "transparency": 55 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.", "bestFor": "A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front.", "strengths": [ "OpenAPI 3.0.3 file with 29 operations and production and sandbox servers, linked from the API reference", "A self-serve portal enables a Sandbox on registration, and the pricing FAQ says it can be tested before buying a plan", "Plan prices are public, from $399 a month for 750 active users, with add-on prices listed", "Data webhooks carry an X-ROOK-HASH HMAC header and are retried on a published schedule", "Dated changelog with five entries between 25 August and 7 October 2026, and SDK LTS releases with a six-month support period" ], "weaknesses": [ "Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented", "Typical limits of 60 requests a minute and 10,000 a day vary by plan, and no 429 or Retry-After behaviour is documented", "No server-side SDK. The official SDKs are mobile libraries for iOS, Android, Flutter, React Native and Capacitor", "The services terms cite an SLA page that isn't linked or published, and no SOC 2 or ISO 27001 report was found", "A WAF blocks requests without a User-Agent header and parameters containing localhost or SQL-like text" ], "agentNotes": [ "Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403", "Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials", "Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute", "Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes", "Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.9 } ], "editorialScores": { "ergonomics": 49, "maintenance": 73, "payments": 25, "reliability": 75, "schema": 74, "security": 32, "transparency": 52 }, "provenanceScore": 58 }, "connect": { "http": "curl https://api.rook-connect.review/api/v1/client/users/status \\\n -u \u003cclient_uuid\u003e:\u003csecret_key\u003e \\\n -H 'User-Agent: MyApp/1.0.0'" }, "letme": { "capability": "https://letme.dev/health.wearables", "tool": "https://letme.dev/rook" }, "area": "domain-data", "unitPrices": [ { "item": "Core plan, up to 750 active users", "unit": "month", "usd": 399, "note": "tryrook.io/pricing, 2026-10-14" }, { "item": "Business plan, up to 15,000 active users, all add-ons", "unit": "month", "usd": 1999, "note": "tryrook.io/pricing, 2026-10-14" } ], "provenance": { "legalEntity": "Rookeries Development Corp.", "domain": "tryrook.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://www.tryrook.io/terms-rook-connect/", "privacy": "https://www.tryrook.io/privacy-policy/", "statusPage": "https://rook.statuspage.io", "changelog": "https://rook.canny.io/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The Terms and Conditions for ROOK services (last updated August 2026) and the website terms (4 June 2026) name Rookeries Development Corp., 224 NE 59th St, Miami, FL 33137.", "The website terms forbid robots, spiders and page scraping to acquire, copy or monitor any part of the site. robots.txt on www.tryrook.io and docs.tryrook.io allows all paths, and we read public pages only.", "The API answers at api.rook-connect.com and api.rook-connect.review, which are not on tryrook.io.", "rookmotion.com, the domain in the founder's list, did not load (expired certificate). The current site is www.tryrook.io.", "www.tryrook.io/.well-known/security.txt returns 404." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/rook.json", "live": { "slug": "rook", "vendorStatus": { "page": "https://rook.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:39.74478552Z" }, "updatedAt": "2026-10-14T09:39:39.74478552Z" } }, { "slug": "medblocks", "name": "Medblocks", "vendor": "Medblocks Inc.", "vendorUrl": "https://medblocks.com", "kind": "http-api", "category": "health-data", "summary": "Medblocks Platform lets an app or agent connect a patient's hospital, clinic and insurer records through SMART on FHIR and read them back as FHIR R4, through a REST API, a TypeScript SDK or a remote MCP server.", "url": "https://www.anchorterminal.com/tools/medblocks", "markdownUrl": "https://www.anchorterminal.com/tools/medblocks.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medblocks.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medblocks.json", "repo": "https://github.com/medblocks/skills", "license": "Proprietary service under Medblocks' terms. The medblocks TypeScript SDK on npm carries a proprietary licence that forbids redistribution and reverse engineering. The agent skills repository has no licence file", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.medblocks.com/mcp", "packages": [ { "registry": "npm", "name": "medblocks" } ], "auth": "mixed", "authNotes": "The REST API takes a workspace API key as a Bearer token (`mb_sk_sbx_` for Sandbox, `mb_sk_live_` for Production). Owners and admins mint, rotate and revoke keys in the dashboard, and the full key is shown once. The MCP server at https://app.medblocks.com/mcp also accepts OAuth from Medblocks' own authorisation server, which publishes dynamic client registration, PKCE and ten scopes (patients:read, patients:write, fhir:read and others), with a consent screen of three tick boxes. Patients authorise each hospital themselves through SMART on FHIR. A BAA is needed before production use.", "pricing": "freemium", "pricingNotes": "Free plan at $0 for up to 1,000 active patients, with patient access, synthetic sandboxes and full API access. Enterprise is $60,000 a year with no patient cap and adds backend services, clinical workflows, OCR and data structuring. A patient counts as active from the first successful FHIR pull. Upgrades go through support@medblocks.com, and requests outside the plan return 402 `billing_error` (checked 2026-10-14).", "priceSummary": "$5000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms-full.txt or the billing page. A 402 status is used only for `billing_error` when a plan does not cover a feature (checked 2026-10-14).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": null, "npmWeekly": 36, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://medblocks.com/docs", "llmsTxt": "https://medblocks.com/docs/llms.txt", "capabilities": [ "health.records", "health.consent", "health.ehr", "health.fhir", "agent.tools" ], "tags": [ "hosted", "mcp", "oauth", "fhir", "smart-on-fhir", "typescript", "llms-txt", "free-tier", "hipaa" ], "lastRelease": "2026-09-14", "graded": true, "anchor": { "graded": true, "score": 52.7, "grade": "D", "agentReady": false, "rank": 773, "ranked": true, "rankOf": 1076, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 69, "payments": 25, "reliability": 28, "schema": 62, "security": 67, "transparency": 51 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Patient-authorised record retrieval with a ten-tool remote MCP server, OAuth with per-capability consent, an audit entry for every call and a free plan for 1,000 active patients. No status page, no published rate limits and no idempotency keys were found, and the OpenAPI file behind the reference is not published.", "bestFor": "A consumer or care app, or an assistant, that needs a patient's own records from US hospitals and payers with the patient's consent, and wants an MCP route as well as REST.", "strengths": [ "Remote MCP server with ten tools, OAuth with dynamic client registration and a consent screen that can leave destructive actions off", "Free plan for up to 1,000 active patients and a Synthetic Hospital sandbox with seeded FHIR R4 patients", "One error envelope with 36 stable codes, a `param` field, a request ID and `Retry-After` on 429", "Every MCP tool call writes an audit entry, and the dashboard shows authorisation and pull history per patient", "llms.txt, llms-full.txt and a Markdown copy of every docs page, plus agent skills for Claude Code, Codex and Cursor" ], "weaknesses": [ "No status page, SLA or published rate limits for the Platform API", "No idempotency keys were found, and the API conventions and versioning pages are unwritten placeholders", "The OpenAPI file the reference is generated from is not published", "Only one SDK, in TypeScript, with npm's latest tag still at 1.0.0 while the changelog documents 1.2.0", "The public terms cover the website and Blue Button app, and no sub-processor list or customer terms for the API were found" ], "agentNotes": [ "Connect with `claude mcp add --transport http medblocks https://app.medblocks.com/mcp` and sign in, or send a workspace API key as a Bearer token from a backend", "Ask the person before calling `disconnect_health_system` or `delete_person`. Both are permanent", "Wait for the connection webhook or check connection status before reading records. Pulls run in the background after the patient approves", "Branch on `error.code`, not the message, and wait the `Retry-After` seconds on a 429", "Use a Sandbox workspace and the Synthetic Hospital (password `demopass`) for tests. Sandbox keys cannot reach production sources" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.7 } ], "editorialScores": { "ergonomics": 72, "maintenance": 69, "payments": 25, "reliability": 28, "schema": 62, "security": 67, "transparency": 32 }, "provenanceScore": 70 }, "connect": { "install": "npm install medblocks", "http": "curl https://app.medblocks.com/patients -H \"Authorization: Bearer $MEDBLOCKS_API_KEY\" -H \"Content-Type: application/json\"", "claudeCode": "claude mcp add --transport http medblocks https://app.medblocks.com/mcp" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/medblocks" }, "area": "domain-data", "unitPrices": [ { "item": "Enterprise plan, uncapped patients", "unit": "month", "usd": 5000, "note": "$60,000 a year per the billing page, shown here as a monthly equivalent" } ], "provenance": { "legalEntity": "Medblocks Inc.", "domain": "medblocks.com", "domainRegistered": "2005-11-04", "endpointOnVendorDomain": true, "terms": "https://medblocks.com/terms", "privacy": "https://medblocks.com/privacy-policy", "statusPage": "", "changelog": "https://medblocks.com/docs/reference/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms, last updated 5 October 2026, name Medblocks Inc., a Delaware corporation, at 100 Front Street, Suite 400 #122, Worcester, MA 01608, and cover the website and the CMS Blue Button application. No separate customer terms for the Platform API were found.", "The terms forbid using robots, scripts or scrapers to access the site. We read public pages and recorded that clause.", "The privacy policy, last updated 5 October 2026, covers the Medblocks applications including Medblocks Platform and the MCP server, and says no data is used to train AI models.", "medblocks.com/.well-known/security.txt returns 404. status.medblocks.com did not answer and no status page was linked from the docs.", "RDAP for medblocks.com gives a registration date of 2005-11-04." ], "score": 70 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medblocks.json", "live": { "slug": "medblocks", "probe": { "target": "https://app.medblocks.com/mcp", "method": "get", "lastAt": "2026-10-14T09:41:57.376112052Z", "lastOk": true, "lastStatus": 401, "lastMs": 317, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 317, "p95ms24h": 463, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-14T09:41:57.376112052Z" } }, { "slug": "metriport", "name": "Metriport Medical API", "vendor": "Metriport Inc.", "vendorUrl": "https://www.metriport.com", "kind": "http-api", "category": "health-data", "summary": "Metriport's Medical API retrieves a patient's records from US health information exchanges, pharmacies and labs, converts them to deduplicated FHIR, and returns them through a REST API with webhooks. Production use requires a covered entity with an NPI.", "url": "https://www.anchorterminal.com/tools/metriport", "markdownUrl": "https://www.anchorterminal.com/tools/metriport.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/metriport.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/metriport.json", "repo": "https://github.com/metriport/metriport", "license": "Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@metriport/api-sdk" } ], "auth": "api-key", "authNotes": "Every request sends a key in the `x-api-key` header to https://api.metriport.com, or https://api.sandbox.metriport.com in sandbox mode. Keys are generated in the developer dashboard after Metriport approves the account, up to two at once for rotation, each revocable at once and each with full access including destructive operations. No scopes or read-only key were found. Production access needs a covered entity with an NPI and a treatment purpose of use, agreed on an intro call.", "pricing": "paid", "pricingNotes": "No public prices. metriport.com has no pricing page, the terms say some services carry a fee paid by card, wire or Stripe, and production access starts with an intro call booked from the dashboard. A sandbox with example patients opens once Metriport approves the access request, and its cost is not stated (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation, llms.txt, the repository README or the terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 793, "npmWeekly": 28168, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.metriport.com/medical-api/getting-started/quickstart", "llmsTxt": "https://docs.metriport.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent", "health.ehr" ], "tags": [ "hosted", "health-records", "fhir", "open-source", "agpl", "typescript", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "lastRelease": "2026-09-28", "graded": true, "anchor": { "graded": true, "score": 50.1, "grade": "D", "agentReady": false, "rank": 833, "ranked": true, "rankOf": 1076, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 74, "payments": 5, "reliability": 45, "schema": 65, "security": 41, "transparency": 56 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.", "bestFor": "US care providers and digital health companies that need a patient's network records as FHIR with webhooks.", "strengths": [ "One asynchronous network query covers HIEs, pharmacies and labs, with a webhook as each source is merged", "Consolidated FHIR output is deduplicated and coded, with PDF or HTML record summaries", "Rate limits published per operation, and `count` up to 500 per page", "AGPLv3 source on GitHub and an MIT TypeScript SDK released on 28 September 2026" ], "weaknesses": [ "Every API key has full access, including destructive operations, with no scopes", "No public prices, and the sandbox needs Metriport's approval first", "The Fern definition covers only part of the API and no public changelog was found", "The status page renders only with JavaScript, so its history could not be read" ], "agentNotes": [ "Check the `errors` array after Start Network Query. It returns 2XX even when some sources fail", "Wait for `network-query.*` webhooks or poll Get Network Query Status before reading consolidated data, which is cached from the last query", "Send the resource's `eTag` in `If-Match` on updates to avoid overwriting newer data", "Keep patient creates under 15 a minute and network queries under 20 a minute per source", "In sandbox, create patients whose first name matches a pre-defined persona to get example records" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.1 } ], "editorialScores": { "ergonomics": 70, "maintenance": 74, "payments": 5, "reliability": 45, "schema": 65, "security": 41, "transparency": 43 }, "provenanceScore": 69 }, "connect": { "install": "npm install --save @metriport/api-sdk", "http": "POST https://api.sandbox.metriport.com/medical/v1/patient?facilityId=\u003cfacility-id\u003e\nx-api-key: \u003capi-key\u003e\nContent-Type: application/json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/metriport" }, "area": "domain-data", "provenance": { "legalEntity": "Metriport Inc.", "domain": "metriport.com", "domainRegistered": "2021-02-09", "endpointOnVendorDomain": true, "terms": "https://www.metriport.com/terms", "privacy": "https://www.metriport.com/privacy-policy", "statusPage": "https://status.metriport.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms of use (last updated January 2024) give a registered office at 2261 Market Street #4818, San Francisco, CA 94114, forbid access 'through automated or non-human means' and the use of 'data mining, robots, or similar data gathering and extraction tools', and say the site is not built for HIPAA-regulated use. We read them as a fact and fetched only what robots.txt allows.", "The privacy policy (last updated 21 February 2023) covers website visitors and customer contacts, says data is stored in the US, and does not mention API data or PHI.", "www.metriport.com/.well-known/security.txt returns 404. SECURITY.md in the repository sends reports to GitHub's vulnerability reporting or support@metriport.com.", "No public changelog was found in the documentation or on the website.", "RDAP gives metriport.com a registration date of 2021-02-09." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/metriport.json", "live": { "slug": "metriport", "vendorStatus": { "page": "https://status.metriport.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.949542071Z" }, "updatedAt": "2026-10-14T08:53:23.949542071Z" } }, { "slug": "particle-health", "name": "Particle Health", "vendor": "Particle Health, Inc.", "vendorUrl": "https://particlehealth.com", "kind": "http-api", "category": "health-data", "summary": "Particle Health retrieves patient records from Carequality, CommonWell, eHealth Exchange, state HIEs and Surescripts, and returns them as FHIR R4B, flat datasets or C-CDA through a REST API, with Signal webhooks for care events.", "url": "https://www.anchorterminal.com/tools/particle-health", "markdownUrl": "https://www.anchorterminal.com/tools/particle-health.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/particle-health.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/particle-health.json", "license": "Proprietary service under customer agreements. The public terms of use (effective 15 October 2020) cover the website only", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 client credentials. A Particle representative issues the first client ID and secret, after which the Management APIs can create service accounts and credentials, and creating new credentials expires the old ones. Each token request must name one project as its scope, and tokens last 60 minutes. Service accounts carry IAM roles such as `roles/project.owner`.", "pricing": "paid", "pricingNotes": "No public prices. The developers page links 'play for free' to portal.particlehealth.com/signup, which did not resolve on 14 October 2026, and the docs ask developers to contact a representative for credentials. The sandbox allows 500 queries per organisation a day (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt or the website (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.particlehealth.com", "llmsTxt": "https://docs.particlehealth.com/llms.txt", "capabilities": [ "health.records", "health.fhir" ], "tags": [ "hosted", "health-records", "fhir", "ccda", "oauth", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "graded": true, "anchor": { "graded": true, "score": 48.6, "grade": "D", "agentReady": false, "rank": 867, "ranked": true, "rankOf": 1076, "categoryRank": 11, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 53, "maintenance": 27, "payments": 5, "reliability": 58, "schema": 69, "security": 57, "transparency": 48 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Particle queries Carequality, CommonWell, eHealth Exchange and state HIEs for a patient and returns FHIR R4B, flat data or C-CDA, with project-scoped 60-minute tokens and OpenAPI fragments per endpoint. Credentials come through a representative, the free sign-up link was dead on 14 October 2026, and rate limits, SLA and changelog are unpublished.", "bestFor": "US providers, payers and digital health companies that need a patient's network records as FHIR or flat data, and care-event alerts.", "strengths": [ "Connected to all three national networks plus Healthix, Manifest MedEx and Surescripts", "Tokens scoped to one project and expiring after 60 minutes, with credential rotation that retires old secrets", "FHIR R4B, flat datasets and C-CDA from the same query", "Sandbox of synthetic patients across every production workflow, 500 queries a day" ], "weaknesses": [ "Credentials come from a Particle representative, and the 'play for free' sign-up domain did not resolve", "Rate limits vary with load and have no published numbers", "No changelog, SLA or developer terms in public", "No audit log for operators was found" ], "agentNotes": [ "Pass `projects/\u003cproject_id\u003e` as the scope when requesting a token, and request a new one every 60 minutes", "Poll Get Query Status, or wait for the query-complete webhook, before reading FHIR or flat data", "Back off on 429, since limits change with system load", "Pass continuation tokens back verbatim when paging", "Use the published synthetic patients in sandbox, and stay under 500 queries a day" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 48.6 } ], "editorialScores": { "ergonomics": 53, "maintenance": 27, "payments": 5, "reliability": 58, "schema": 69, "security": 57, "transparency": 27 }, "provenanceScore": 69 }, "connect": { "http": "POST https://sandbox.particlehealth.com/api/v2/patients\nAuthorization: Bearer \u003caccess-token\u003e\nContent-Type: application/json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/particle-health" }, "area": "domain-data", "provenance": { "legalEntity": "Particle Health, Inc.", "domain": "particlehealth.com", "domainRegistered": "2017-11-22", "endpointOnVendorDomain": true, "terms": "https://particlehealth.com/terms-of-use", "privacy": "https://particlehealth.com/privacy-policy", "statusPage": "https://status.particlehealth.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms of use (effective 15 October 2020) cover the website, forbid users to 'harvest or scrape any content or data from the Site', and may change without notice. We read them as a fact and fetched only what robots.txt allows.", "The privacy policy (effective 29 July 2026) covers information collected through the site only and says Particle may keep de-identified data in aggregate.", "The security page lists HITRUST and SOC 2 for the API platform and links a vulnerability submission form. particlehealth.com/.well-known/security.txt returns 404.", "docs.particlehealth.com/changelog returns 404. No public changelog was found.", "RDAP gives particlehealth.com a registration date of 2017-11-22." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/particle-health.json", "live": { "slug": "particle-health", "vendorStatus": { "page": "https://status.particlehealth.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:35.139260792Z" }, "updatedAt": "2026-10-14T09:39:35.139260792Z" } }, { "slug": "1uphealth", "name": "1upHealth", "vendor": "1upHealth, Inc.", "vendorUrl": "https://1up.health", "kind": "http-api", "category": "health-data", "summary": "1upHealth runs FHIR APIs for US health plans, including the CMS Patient Access, Provider Access and Payer-to-Payer APIs, which let member-authorised third-party apps read claims, coverage and clinical data.", "url": "https://www.anchorterminal.com/tools/1uphealth", "markdownUrl": "https://www.anchorterminal.com/tools/1uphealth.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/1uphealth.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/1uphealth.json", "license": "Proprietary service under 1upHealth's Terms of Service (effective 1 August 2024)", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "Developers register in the 1up Dev Portal, verify an email and create sandbox client credentials. Patient Access uses the authorisation code grant, with the member signing in to the health plan's auth app, and access tokens last 15 minutes. Provider Access and Payer-to-Payer use client credentials with scopes such as `bulk-data|user/*.rs`. Client secrets can be regenerated in the Dev Portal. Production access follows 1upHealth's vetting of the app.", "pricing": "paid", "pricingNotes": "No public prices. The terms set fees in Order Forms, with one price increase a year on 90 days' notice. The Dev Portal sandbox clients need only a verified email, and no card was mentioned (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt or the terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.1up.health", "llmsTxt": "https://docs.1up.health/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent" ], "tags": [ "hosted", "health-records", "claims", "fhir", "bulk-data", "oauth", "llms-txt", "status-page", "sla", "free-tier", "hitrust", "soc2" ], "graded": true, "anchor": { "graded": true, "score": 46.8, "grade": "D", "agentReady": false, "rank": 903, "ranked": true, "rankOf": 1076, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 32, "maintenance": 37, "payments": 20, "reliability": 52, "schema": 50, "security": 63, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Self-serve Dev Portal sandbox clients and a demo health plan let an app test the CMS Patient Access, Provider Access and Payer-to-Payer FHIR APIs, backed by HITRUST and SOC 2 Type 2. No rate limits, error formats or dated releases are documented, and the Patient Access OAuth step needs the member in a browser.", "bestFor": "Consumer and care apps that read a member's health plan claims and clinical data under the CMS rules, and payers meeting those rules.", "strengths": [ "Sandbox client credentials from the Dev Portal with only an email verification", "Patient Access client IDs work across every payer production environment 1upHealth runs, once vetted", "Privacy policy with stated retention periods and US-only processing", "HITRUST, SOC 2 Type 2 and CSA STAR on a public trust centre" ], "weaknesses": [ "No rate limits, 429 handling or error formats documented", "Release notes are undated", "The status page lists no components", "Patient Connect, the patient-mediated exchange across health systems, was sunset on 30 September 2026" ], "agentNotes": [ "Hand the Patient Access sign-in to the member, who must authorise in the health plan's auth app", "Exchange the authorisation code within five minutes, and refresh before the 15-minute token expires", "Email payer-patient-access@1up.health with the client ID to get the app synced to the demo environment", "Expect only claims and coverage resources from some payers, and read /r4/metadata first" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.8 } ], "editorialScores": { "ergonomics": 32, "maintenance": 37, "payments": 20, "reliability": 52, "schema": 50, "security": 63, "transparency": 61 }, "provenanceScore": 82 }, "connect": { "http": "GET https://api.1uphealthdemo.com/r4/ExplanationOfBenefit\nAuthorization: Bearer \u003caccess-token\u003e" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/1uphealth" }, "area": "domain-data", "provenance": { "legalEntity": "1upHealth, Inc.", "domain": "1up.health", "domainRegistered": "2017-07-20", "endpointOnVendorDomain": true, "terms": "https://1up.health/terms-of-service/", "privacy": "https://1up.health/privacy-policy/", "statusPage": "https://status.1up.health", "changelog": "https://docs.1up.health/docs/release-notes", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The Terms of Service (effective 1 August 2024) name 1upHealth, Inc., 280 Summer Street, Boston, MA 02210, and include the SLA as Exhibit A.", "The privacy policy (last updated 25 June 2026) covers the website, keeps logs up to 24 months, clears production data within 30 days and backups within 90 days of a deletion request, keeps data in the US, and leaves PHI to customer BAAs.", "The demo API answers on 1uphealthdemo.com, a separate domain.", "1up.health/.well-known/security.txt returns 404. The trust centre sends vulnerability reports to security@1up.health.", "Release notes carry version numbers such as 26.09.2 but no dates.", "RDAP gives 1up.health a registration date of 2017-07-20." ], "score": 82 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/1uphealth.json", "live": { "slug": "1uphealth", "vendorStatus": { "page": "https://status.1up.health", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:38:50.511902685Z" }, "updatedAt": "2026-10-14T09:38:50.511902685Z" } } ] }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/categories/health-data", "json": "https://www.anchorterminal.com/categories/health-data.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/categories/health-data.md", "slim": "https://www.anchorterminal.com/categories/health-data.min.md" }, "markdown": "APIs that retrieve a patient's clinical records from hospitals and health information networks, connect to EHRs, store records on a FHIR server, or read data from wearables and health apps. Compared on record coverage, FHIR support, consent and patient authorisation, compliance terms and how access is granted.\n\n- Tools ranked: 12 · agent-ready (BB or better): 0 · accept x402: 0 · hosted endpoints: 4 · desk reviews by the panel: 0\n- JSON: https://www.anchorterminal.com/api/v1/tools.json (list) · https://www.anchorterminal.com/api/v1/rankings.json (ranked) · https://www.anchorterminal.com/api/v1/x402.json (payable) · https://www.anchorterminal.com/api/v1/capabilities.json (by capability)\n- Grades run AA, A, BB, B, C, D, E, F · methodology: https://www.anchorterminal.com/benchmark/\n\n- Shortlist and picks by need: https://www.anchorterminal.com/best/health-data/index.md\n- Head-to-head comparisons (63): https://www.anchorterminal.com/compare/health-data/index.md\n- Capabilities in this category: health.records, health.fhir, health.ehr, health.wearables, health.consent\n- https://letme.dev/health.records picks the top-graded tool in this list and says how to call it direct; calling through letme comes later (https://www.anchorterminal.com/letme/index.md)\n\n## Ranking\n\n| # | Tool | Vendor | Kind | Category | Grade | Score | Confidence | x402 | Auth | Where | Reviews | Page |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| 216 | Medplum | Orangebot, Inc. (dba Medplum) | HTTP API | Health | B | 68.7 | medium | no | OAuth | hosted | none | https://www.anchorterminal.com/tools/medplum.md |\n| 327 | Terra API | Terra Enabling Developers Inc. | HTTP API | Health | B | 65.9 | medium | no | OAuth or key | hosted | none | https://www.anchorterminal.com/tools/terra.md |\n| 385 | Aidbox | Health Samurai, Inc. | HTTP API | Health | B | 64.2 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/aidbox.md |\n| 583 | Health Gorilla | Health Gorilla, Inc. | HTTP API | Health | C | 59.3 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/health-gorilla.md |\n| 618 | Redox | Redox, Inc. | HTTP API | Health | C | 58.3 | medium | no | OAuth | hosted | none | https://www.anchorterminal.com/tools/redox.md |\n| 628 | Validic Inform | Validic, Inc. (ChartSpan) | HTTP API | Health | C | 57.9 | medium | no | API key | local | none | https://www.anchorterminal.com/tools/validic.md |\n| 669 | Zus Health | Zus Health, Inc. | HTTP API | Health | C | 56.6 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/zus-health.md |\n| 718 | ROOK | Rookeries Development Corp. | HTTP API | Health | C | 54.9 | medium | no | API key | local | none | https://www.anchorterminal.com/tools/rook.md |\n| 773 | Medblocks | Medblocks Inc. | HTTP API | Health | D | 52.7 | medium | no | OAuth or key | hosted | none | https://www.anchorterminal.com/tools/medblocks.md |\n| 833 | Metriport Medical API | Metriport Inc. | HTTP API | Health | D | 50.1 | medium | no | API key | local | none | https://www.anchorterminal.com/tools/metriport.md |\n| 867 | Particle Health | Particle Health, Inc. | HTTP API | Health | D | 48.6 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/particle-health.md |\n| 903 | 1upHealth | 1upHealth, Inc. | HTTP API | Health | D | 46.8 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/1uphealth.md |\n\nScores are from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/), with Performance and Task success pending. p95 latency and context cost come from our probes, which haven't run yet.\n\n## Summaries\n\n### 216. Medplum, B (68.7)\n\nOpen-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy. Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.\n\n- Page: https://www.anchorterminal.com/tools/medplum · Markdown: https://www.anchorterminal.com/tools/medplum.md · JSON: https://www.anchorterminal.com/api/v1/tools/medplum.json\n- Capabilities: health.fhir, health.records · endpoint: `https://api.medplum.com/mcp/stream`\n\n### 327. Terra API, B (65.9)\n\nTerra's Unified API collects activity, sleep, body and nutrition data from 500+ wearables and health apps, normalises it into one schema and sends it by webhook or REST. An MCP server, Terra AI, lets agents read a connected user's data. Graded on the Unified API and the Terra AI MCP server. A public OpenAPI 3.1 spec, llms.txt, per-user rate limits with Retry-After, and scoped admin tokens with approvals. Access starts at $499 a month with billing details at sign-up, the data API key has no scopes, and API key requests failed for 2 hours 38 minutes on 7 August 2026.\n\n- Page: https://www.anchorterminal.com/tools/terra · Markdown: https://www.anchorterminal.com/tools/terra.md · JSON: https://www.anchorterminal.com/api/v1/tools/terra.json\n- Capabilities: health.wearables, health.consent, health.fhir · endpoint: `https://access.tryterra.co/api/v2/mcp/\u003cuser_id\u003e`\n\n### 385. Aidbox, B (64.2)\n\nFHIR R4 and R5 server on PostgreSQL from Health Samurai, run from Docker images under a free development licence or a paid production licence. Agents use each instance's FHIR REST API or its alpha MCP server. Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.\n\n- Page: https://www.anchorterminal.com/tools/aidbox · Markdown: https://www.anchorterminal.com/tools/aidbox.md · JSON: https://www.anchorterminal.com/api/v1/tools/aidbox.json\n- Capabilities: health.fhir, health.records, health.consent\n\n### 583. Health Gorilla, C (59.3)\n\nHealth Gorilla is a designated TEFCA QHIN whose FHIR R4 API retrieves patient records from national networks (Patient360), places lab orders and returns results, and sends ADT and clinical alerts, for organisations it onboards. A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.\n\n- Page: https://www.anchorterminal.com/tools/health-gorilla · Markdown: https://www.anchorterminal.com/tools/health-gorilla.md · JSON: https://www.anchorterminal.com/api/v1/tools/health-gorilla.json\n- Capabilities: health.records, health.fhir, health.consent\n\n### 618. Redox, C (58.3)\n\nRedox connects software vendors to hospital EHRs and clinical networks, translating HL7v2, C-CDA, X12 and DICOM into FHIR or Redox data models, with a FHIR API, a Platform API and a hosted MCP server for managing integrations. Redox connects to EHRs and clinical networks behind a FHIR API, with signed-JWT OAuth keys, a 99.95 per cent SLA, a HackerOne bug bounty and a hosted MCP server for managing integrations. The MCP server exposes 107 tools at once with write and delete tools unconfirmed, OpenAPI files sit behind login, and the sandbox plan costs $15,000 a year.\n\n- Page: https://www.anchorterminal.com/tools/redox · Markdown: https://www.anchorterminal.com/tools/redox.md · JSON: https://www.anchorterminal.com/api/v1/tools/redox.json\n- Capabilities: health.ehr, health.fhir, health.records · endpoint: `https://api.redoxengine.com/mcp`\n\n### 628. Validic Inform, C (57.9)\n\nValidic Inform normalises data from wearables, health apps and in-home medical devices into one API, with a REST API for per-user reads and a server-sent events Streaming API for bulk delivery, and a free self-service developer tier. Graded on the Inform REST and Streaming APIs. An agent can create a free developer account through a sign-up API, with only an emailed code needing a person's inbox, and llms.txt plus agent guides document every step. The organisation token travels in the URL query string, the free tier holds synthetic data only, and production access needs an Enterprise contract.\n\n- Page: https://www.anchorterminal.com/tools/validic · Markdown: https://www.anchorterminal.com/tools/validic.md · JSON: https://www.anchorterminal.com/api/v1/tools/validic.json\n- Capabilities: health.wearables, health.consent\n\n### 669. Zus Health, C (56.6)\n\nZus Health assembles a patient's history from CommonWell, Carequality, Surescripts, Quest and ADT networks into the Zus Aggregated Profile, and exposes it through FHIR R4 REST, GraphQL and webhook APIs for care organisations it onboards. FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK.\n\n- Page: https://www.anchorterminal.com/tools/zus-health · Markdown: https://www.anchorterminal.com/tools/zus-health.md · JSON: https://www.anchorterminal.com/api/v1/tools/zus-health.json\n- Capabilities: health.records, health.fhir, health.ehr, health.consent\n\n### 718. ROOK, C (54.9)\n\nROOK Connect, from Rookeries Development Corp., collects health data from wearables and phone health stores, normalises it into sleep, physical and body summaries and events, and sends it by webhook or a REST API. Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.\n\n- Page: https://www.anchorterminal.com/tools/rook · Markdown: https://www.anchorterminal.com/tools/rook.md · JSON: https://www.anchorterminal.com/api/v1/tools/rook.json\n- Capabilities: health.wearables, health.consent, health.fhir\n\n### 773. Medblocks, D (52.7)\n\nMedblocks Platform lets an app or agent connect a patient's hospital, clinic and insurer records through SMART on FHIR and read them back as FHIR R4, through a REST API, a TypeScript SDK or a remote MCP server. Patient-authorised record retrieval with a ten-tool remote MCP server, OAuth with per-capability consent, an audit entry for every call and a free plan for 1,000 active patients. No status page, no published rate limits and no idempotency keys were found, and the OpenAPI file behind the reference is not published.\n\n- Page: https://www.anchorterminal.com/tools/medblocks · Markdown: https://www.anchorterminal.com/tools/medblocks.md · JSON: https://www.anchorterminal.com/api/v1/tools/medblocks.json\n- Capabilities: health.records, health.consent, health.ehr, health.fhir, agent.tools · endpoint: `https://app.medblocks.com/mcp`\n\n### 833. Metriport Medical API, D (50.1)\n\nMetriport's Medical API retrieves a patient's records from US health information exchanges, pharmacies and labs, converts them to deduplicated FHIR, and returns them through a REST API with webhooks. Production use requires a covered entity with an NPI. One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.\n\n- Page: https://www.anchorterminal.com/tools/metriport · Markdown: https://www.anchorterminal.com/tools/metriport.md · JSON: https://www.anchorterminal.com/api/v1/tools/metriport.json\n- Capabilities: health.records, health.fhir, health.consent, health.ehr\n\n### 867. Particle Health, D (48.6)\n\nParticle Health retrieves patient records from Carequality, CommonWell, eHealth Exchange, state HIEs and Surescripts, and returns them as FHIR R4B, flat datasets or C-CDA through a REST API, with Signal webhooks for care events. Particle queries Carequality, CommonWell, eHealth Exchange and state HIEs for a patient and returns FHIR R4B, flat data or C-CDA, with project-scoped 60-minute tokens and OpenAPI fragments per endpoint. Credentials come through a representative, the free sign-up link was dead on 14 October 2026, and rate limits, SLA and changelog are unpublished.\n\n- Page: https://www.anchorterminal.com/tools/particle-health · Markdown: https://www.anchorterminal.com/tools/particle-health.md · JSON: https://www.anchorterminal.com/api/v1/tools/particle-health.json\n- Capabilities: health.records, health.fhir\n\n### 903. 1upHealth, D (46.8)\n\n1upHealth runs FHIR APIs for US health plans, including the CMS Patient Access, Provider Access and Payer-to-Payer APIs, which let member-authorised third-party apps read claims, coverage and clinical data. Self-serve Dev Portal sandbox clients and a demo health plan let an app test the CMS Patient Access, Provider Access and Payer-to-Payer FHIR APIs, backed by HITRUST and SOC 2 Type 2. No rate limits, error formats or dated releases are documented, and the Patient Access OAuth step needs the member in a browser.\n\n- Page: https://www.anchorterminal.com/tools/1uphealth · Markdown: https://www.anchorterminal.com/tools/1uphealth.md · JSON: https://www.anchorterminal.com/api/v1/tools/1uphealth.json\n- Capabilities: health.records, health.fhir, health.consent\n\n## How we test this category\n\nIn this run, public evidence against the published checklist. When the task suites run, one synthetic patient queried through each listing's sandbox. We request records or wearable data, write an observation where the API allows it, and read it back. We check FHIR conformance, the consent step, latency and what access took. This test hasn't run yet, so Task success is pending and the grades here come from the categories assessed from public evidence.\n\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Health records \u0026 wellness data", "url": "" } ], "description": "12 health records \u0026 wellness data listings ranked by the Anchor benchmark. Leader Medplum (B). APIs that retrieve a patient's clinical records from hospitals and health information networks, connect to EHRs, store records on a FHIR server, or read data from wearables and health apps. Compared on record coverage, FHIR support, consent and patient authorisation, compliance terms and how access is granted.", "facts": [ "Medplum B", "Terra API B", "Aidbox B" ], "h1": "Health record and wellness data APIs for AI agents", "image": "https://www.anchorterminal.com/assets/og/categories-health-data.png", "path": "/categories/health-data", "published": "", "section": "tools", "title": "Health record and wellness data APIs for AI agents, ranked", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/categories/health-data" }, "tokens": { "markdown": 3800, "slim": 580 }, "version": 1 }