Particle Health vs ROOK

Particle Health

Particle queries Carequality, CommonWell, eHealth Exchange and state HIEs for a patient and returns FHIR R4B, flat data or C-CDA, with project-scoped 60-minute tokens and OpenAPI fragments per endpoint. Credentials come through a representative, the free sign-up link was dead on 14 October 2026, and rate limits, SLA and changelog are unpublished.

ROOK

Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.

Particle Health

1. Pass projects/<project_id> as the scope when requesting a token, and request a new one every 60 minutes
2. Poll Get Query Status, or wait for the query-complete webhook, before reading FHIR or flat data
3. Back off on 429, since limits change with system load
4. Pass continuation tokens back verbatim when paging
5. Use the published synthetic patients in sandbox, and stay under 500 queries a day

ROOK

1. Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403
2. Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials
3. Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute
4. Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes
5. Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data