Aidbox vs ROOK

Aidbox

Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.

ROOK

Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.

Aidbox

1. Ask the operator for a Client with an AccessPolicy limited to the task. Don't rely on the public MCP policy, which the docs mark unsafe
2. Use If-None-Exist on creates and conditional update on identifiers so retries don't duplicate records
3. Use _elements and _count to keep responses small, and follow the Bundle's paging links
4. Throttle yourself. Aidbox applies no rate limit, so a burst lands on the customer's database
5. Don't load real patient data into an instance on a development licence

ROOK

1. Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403
2. Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials
3. Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute
4. Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes
5. Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data