# ROOK > ROOK Connect, from Rookeries Development Corp., collects health data from wearables and phone health stores, normalises it into sleep, physical and body summaries and events, and sends it by webhook or a REST API. - Canonical: https://www.anchorterminal.com/tools/rook - Markdown: https://www.anchorterminal.com/tools/rook.md (~6,300 tokens) - Slim: https://www.anchorterminal.com/tools/rook.min.md (~1,630 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/rook.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-14 ## Overview **Grade C · 54.9/100 · rank #718 of 1076 · #8 in Health records & wellness data · not agent-ready · confidence medium** ## Assessment Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found. ## Facts | Field | Value | | --- | --- | | Vendor | Rookeries Development Corp. (https://www.tryrook.io) | | Kind | HTTP API | | Category | Health records & wellness data (https://www.anchorterminal.com/categories/health-data) | | Transport | HTTP | | Auth | API key · A person registers an organisation in the ROOK Portal, which enables a Sandbox project, then generates a client UUID and secret key. The secret is shown once. Calls use HTTP Basic auth with the UUID as username and the secret as password. Production needs new credentials, an active plan and signed agreements. No scopes or key rotation were found. End users authorise each data source through ROOK's authoriser pages, the mobile SDKs or the ROOK App. | | Pricing | Paid ($399 / mo) · Core $399 a month for up to 750 active users, Core+ $999 for 5,000, Business $1,999 for 15,000, Enterprise custom. Add-ons cost $79 to $499 a month. A Sandbox is available before buying a plan. The standard term is 12 months with 30 days' notice to cancel (checked 2026-10-14). | | x402 | No · No x402, MPP or L402 in the docs, the OpenAPI file or the pricing page (checked 2026-10-14). | | Licence | Proprietary service under ROOK's Terms and Conditions for ROOK services | | Packages | npm: `react-native-rook-sdk`; npm: `capacitor-rook-sdk` | | Source | https://github.com/RookeriesDevelopment | | Docs | https://docs.tryrook.io | | llms.txt | https://docs.tryrook.io/llms.txt | | Last release | 2026-10-07 | | API | REST, OpenAPI 3.0.3, version 2.0.1, 29 operations under /api/v1, /api/v2 and /v2/processed_data. Production https://api.rook-connect.com, Sandbox https://api.rook-connect.review | | Data | Sleep, physical and body health summaries and events (heart rate, steps, oxygenation, stress, nutrition, hydration, blood glucose, blood pressure, temperature, mood), from API sources such as Garmin, Fitbit, Oura, Polar, Withings, Whoop and Dexcom and SDK sources such as Apple Health, Health Connect and Samsung Health | | Credentials | Client UUID and secret key per environment from the ROOK Portal, sent by HTTP Basic auth. The secret is shown once. No scopes found | | Rate limits | Typical 60 requests a minute and 10,000 a day, varying by plan. No 429 or Retry-After behaviour documented | | Webhooks | Data webhook configured in the portal with X-ROOK-HASH HMAC validation and staggered retries. Notification webhook set up by support | | Consent | Users authorise each source through ROOK's authoriser links, the SDKs or the ROOK App. A revoke endpoint ends a connection | | SDKs | iOS, Android, Flutter, React Native (react-native-rook-sdk 5.2.0, 2 October 2026) and Capacitor (capacitor-rook-sdk 4.2.1, 8 October 2026). SDK 4.2.0 LTS has six months of support | | Pricing | Core $399 a month (750 active users), Core+ $999 (5,000), Business $1,999 (15,000), Enterprise custom. Add-ons $79 to $499 a month. Lab Data API from $249 a month for 300 files | | Status | rook.statuspage.io with components for the API, the connections page and each authorisation source | | Compliance | HIPAA-aligned security programme, BAAs with covered entities, GDPR as processor, per tryrook.io. Data stored in AWS in the United States per the privacy policy | | Capabilities | health.wearables, health.consent, health.fhir | | Tags | hosted, wearables, health-data, api-key, openapi, llms-txt, sandbox, webhooks, status-page, hipaa | | JSON | https://www.anchorterminal.com/api/v1/tools/rook.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 75 | 15.0 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 74 | 12.0 | | Agent ergonomics | 13% | 16.2 | 49 | 8.0 | | Security & auth | 14% | 17.5 | 32 | 5.6 | | Payments & pricing | 10% | 12.5 | 25 | 3.1 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 73 | 6.4 | | Transparency & trust (editorial 52, provenance 58) | 7% | 8.8 | 55 | 4.8 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **54.9 → C** | ### Why each score - Reliability 75: Read with the hosted lines and scored on the REST API. rook.statuspage.io has components for the API, the connections page and each authorisation source (20). No incident in the 90 days to 14 October 2026. The feed holds seven entries since 2023, the last on 20 October 2025, so the clean record rests on a sparsely used page (30). Typical limits of 60 requests a minute and 10,000 a day are published, varying by plan (12 of 15). No 429 or Retry-After behaviour documented. Dedupe guidance on document_version, and published webhook retries (3 of 15). The services terms cite an SLA page that isn't linked, and pricing lists Basic SLAs on Core with no text found (0). The API carries no beta label (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 74: OpenAPI 3.0.3 file with 29 operations linked from the Redoc reference (25). llms.txt indexes the site and docs, with no Markdown copies of pages found (6 of 10). Descriptions state what each endpoint returns, and the guides say the API is for occasional queries (12 of 20). Four enums and 20 required lists in the file (6 of 15). 286 examples and responses for 400, 401, 403, 404 and 422 on some operations, with test constants in the description (10 of 15). Versions in the path, spec version 2.0.1, and a dated public changelog (15). - Agent ergonomics 49: Summaries and per-type event endpoints size responses by date, with no field selection found (12 of 25). A page parameter and date filters on the data endpoints (12 of 20). Errors are JSON with error, exception, path and method, and the WAF answers 403 for missing User-Agent (12 of 20). Mostly reads. No idempotency keys, and dedupe rests on document_version (6 of 20). Few required parameters, but every call needs a User-Agent and there is no server-side SDK (7 of 15). - Security & auth 32: One client UUID and secret per environment over Basic auth, secret shown once, no scopes, expiry or rotation found (12 of 30). No read-only credential. A revoke endpoint ends a user's connection (5 of 20). Responses are structured health metrics with little free text (10 of 15). No audit log or per-call log found in the reviewed documentation (0 of 15). The site states a HIPAA-aligned programme, BAAs and GDPR processing, and the services terms list AES-256 at rest, TLS 1.2 and MFA. No SOC 2 or ISO 27001, security.txt or bug bounty found (5 of 20). - Payments & pricing 25: Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices with user caps and add-on prices are public, with no per-unit price for usage past the cap (10). A Sandbox comes with portal registration and the pricing page says Get started free. We could not see whether a card is asked for (15 of 20). A person registers in a browser (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 73: Changelog entry dated 7 October 2026 and capacitor-rook-sdk 4.2.1 published on 8 October (30). Five dated changelog entries between 25 August and 7 October 2026 (20). Closed service with a Canny changelog, email and Intercom support and a Slack community. We could not test response times (10 of 15). Mobile SDKs are current, with no server-side SDK and no entry in the official MCP registry (8 of 15). CI results could not be read (5 of 10). - Transparency & trust 55: Closed service with public services terms dated August 2026 (15 of 30). The privacy policy of 28 May 2026 says data is stored in AWS in the United States and names AWS and Google Cloud as core sub-processors. The DPA and BAA are referenced but not public, and no fixed retention periods were found (15 of 30). Terms changes get 30 days' notice, add-ons can be discontinued on reasonable notice, and each SDK LTS release has six months of support (12 of 20). Hosting providers and the US location are named, with no full sub-processor list (10 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/rook.md (JSON https://www.anchorterminal.com/fixes/rook.json) ### What we couldn't check - unchecked: whether portal registration asks for a card, and any user cap in Sandbox. The portal sits behind a login - unchecked: the SLA document the services terms cite as SLAs - ROOK. It isn't linked from the terms or listed in the sitemap - unchecked: GitHub stars, open issues and CI for RookeriesDevelopment. The GitHub API refused us for rate limits - unchecked: live API behaviour beyond one unauthenticated Sandbox request, which returned 401 JSON - The founder's lead gave rookmotion.com, which did not load (expired certificate). ROOK now trades from tryrook.io, and the API lives on rook-connect.com - The pricing page lists an EHR/EMR API on a waitlist, so clinical records are not available today ### Sources - documentation index for agents: (seen 2026-10-14) - OpenAPI specification: (seen 2026-10-14) - API reference: (seen 2026-10-14) - portal configuration: (seen 2026-10-14) - prerequisites and WAF rules: (seen 2026-10-14) - data delivery, webhooks and limits: (seen 2026-10-14) - data extraction: (seen 2026-10-14) - data authorisation: (seen 2026-10-14) - pricing: (seen 2026-10-14) - Terms and Conditions for ROOK services: (seen 2026-10-14) - website terms: (seen 2026-10-14) - privacy policy: (seen 2026-10-14) - home page (compliance section): (seen 2026-10-14) - status incidents: (seen 2026-10-14) - changelog: (seen 2026-10-14) - npm search for ROOK SDKs: (seen 2026-10-14) - unauthenticated Sandbox request: (seen 2026-10-14) ## Who's behind it (provenance 58/100, checked 2026-10-14) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Rookeries Development Corp. | 20/20 | | Domain age | tryrook.io, no registry record we could read | 0/15 | | Endpoint on the vendor's domain | is not on tryrook.io | 0/15 | | Terms of service | read, states 7 of the 7 things a reader expects, and has 1 clause that costs points | 8/10 | | Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 | | Status page | rook.statuspage.io | 10/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | The Terms and Conditions for ROOK services (last updated August 2026) and the website terms (4 June 2026) name Rookeries Development Corp., 224 NE 59th St, Miami, FL 33137. The website terms forbid robots, spiders and page scraping to acquire, copy or monitor any part of the site. robots.txt on www.tryrook.io and docs.tryrook.io allows all paths, and we read public pages only. The API answers at api.rook-connect.com and api.rook-connect.review, which are not on tryrook.io. rookmotion.com, the domain in the founder's list, did not load (expired certificate). The current site is www.tryrook.io. www.tryrook.io/.well-known/security.txt returns 404. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.tryrook.io/terms-rook-connect/), read 2026-10-14, dated 2026-08-01, states 7 of the 7 things a reader expects. - To know. Restricts benchmarking or competitive use (costs points). "copy or replicate the functionality of the Services to develop a competing product" - To know. Requires arbitration or waives class actions. "If the dispute is not resolved within the period in Section 9.5(a), either Party may submit it to final and binding arbitration administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules then in effect." - Gives the date it was last updated. Last updated 2026-08-01. - Names the governing law or courts. The law of the State of Delaware. - States a limit on its liability. Capped at the fees paid in the 12 months before the claim. - Says how changes to the terms are announced. Says it gives notice of a change. - Also in the text (2026-10-14). Fees rise on each anniversary by the greater of 3 per cent or the CPI-U change, capped at 7 per cent. "Fees shall be subject to an annual adjustment effective on each anniversary of the Effective Date, equal to the greater of: (a) three percent (3%); or (b) the percentage change in the U.S. Consumer Price Index for All Urban Consumers (CPI-U)" - Also in the text (2026-10-14). ROOK may use de-identified Derived Data for internal analytics, benchmarking and product improvement without further consent from the customer. "We may use Derived Data for internal analytics, benchmarking, and product improvement without further consent from You." - Also in the text (2026-10-14). ROOK may name the customer and use its logo on its website, customer lists and marketing materials. "We may identify You as a customer and use Your name and logo on Our website, customer lists, and sales and marketing materials, subject to any trademark or brand usage guidelines provided by You in writing." **Privacy policy** (https://www.tryrook.io/privacy-policy/), read 2026-10-14, dated 2026-05-28, states 8 of the 8 things a reader expects. - Gives the date it was last updated. Last updated 2026-05-28. - Says how long data is kept. For as long as needed, with no period named. - Says whether personal data is sold or shared for advertising. Says it does not sell personal data. - Gives a privacy contact. Names a data protection officer. - Says where data is transferred or stored. Relies on standard contractual clauses and the Data Privacy Framework. ## Live (updated 2026-10-14 09:39 UTC) - Vendor status page: none, All Systems Operational - Always current: https://www.anchorterminal.com/api/v1/live/rook.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Core plan, up to 750 active users | $399 | per month (plan) | tryrook.io/pricing, 2026-10-14 | | Business plan, up to 15,000 active users, all add-ons | $1999 | per month (plan) | tryrook.io/pricing, 2026-10-14 | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - OpenAPI 3.0.3 file with 29 operations and production and sandbox servers, linked from the API reference - A self-serve portal enables a Sandbox on registration, and the pricing FAQ says it can be tested before buying a plan - Plan prices are public, from $399 a month for 750 active users, with add-on prices listed - Data webhooks carry an X-ROOK-HASH HMAC header and are retried on a published schedule - Dated changelog with five entries between 25 August and 7 October 2026, and SDK LTS releases with a six-month support period ## Weaknesses - Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented - Typical limits of 60 requests a minute and 10,000 a day vary by plan, and no 429 or Retry-After behaviour is documented - No server-side SDK. The official SDKs are mobile libraries for iOS, Android, Flutter, React Native and Capacitor - The services terms cite an SLA page that isn't linked or published, and no SOC 2 or ISO 27001 report was found - A WAF blocks requests without a User-Agent header and parameters containing localhost or SQL-like text ## Before you call it (notes for agents) 1. Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403 2. Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials 3. Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute 4. Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes 5. Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data ## Connect First request: ```bash curl https://api.rook-connect.review/api/v1/client/users/status \ -u : \ -H 'User-Agent: MyApp/1.0.0' ``` Through letme (picks today, calling later): https://letme.dev/rook. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Terra API | B | 65.9 | 327 | health.wearables, health.consent, health.fhir | no | https://www.anchorterminal.com/tools/terra.md | | Aidbox | B | 64.2 | 385 | health.fhir, health.consent | no | https://www.anchorterminal.com/tools/aidbox.md | | Health Gorilla | C | 59.3 | 583 | health.fhir, health.consent | no | https://www.anchorterminal.com/tools/health-gorilla.md | | Validic Inform | C | 57.9 | 628 | health.wearables, health.consent | no | https://www.anchorterminal.com/tools/validic.md | | Zus Health | C | 56.6 | 669 | health.fhir, health.consent | no | https://www.anchorterminal.com/tools/zus-health.md | | Medblocks | D | 52.7 | 773 | health.consent, health.fhir | no | https://www.anchorterminal.com/tools/medblocks.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The API reference is a Redoc page built from an OpenAPI 3.0.3 file with 29 operations, servers https://api.rook-connect.com and https://api.rook-connect.review (source: ) - The ROOK Portal enables a Sandbox project on registration, where client UUID and secret key are generated, and the secret is shown once (source: ) - The data delivery guide calls webhooks the primary channel and gives typical API limits of 60 requests a minute and 10,000 a day, varying by plan (source: ) - All API requests pass an AWS WAF that blocks calls with no User-Agent and parameters containing localhost, private IPs, SQL or script patterns (source: ) - Plans run from Core at $399 a month (750 active users) to Business at $1,999 (15,000 users), with Enterprise custom and a standard 12-month term (source: ) - rook.statuspage.io lists its last incident on 20 October 2025, an AWS outage, and seven incidents in all since 2023 (source: ) - #8 of 12 in Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md - All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md ## Compare - [1upHealth vs ROOK](https://www.anchorterminal.com/compare/1uphealth-vs-rook.md): D 46.8 vs C 54.9 - [Aidbox vs ROOK](https://www.anchorterminal.com/compare/aidbox-vs-rook.md): B 64.2 vs C 54.9 - [Health Gorilla vs ROOK](https://www.anchorterminal.com/compare/health-gorilla-vs-rook.md): C 59.3 vs C 54.9 - [Medplum vs ROOK](https://www.anchorterminal.com/compare/medplum-vs-rook.md): B 68.7 vs C 54.9 - [Metriport Medical API vs ROOK](https://www.anchorterminal.com/compare/metriport-vs-rook.md): D 50.1 vs C 54.9 - [Particle Health vs ROOK](https://www.anchorterminal.com/compare/particle-health-vs-rook.md): D 48.6 vs C 54.9 - [Redox vs ROOK](https://www.anchorterminal.com/compare/redox-vs-rook.md): C 58.3 vs C 54.9 - [Medblocks vs ROOK](https://www.anchorterminal.com/compare/medblocks-vs-rook.md): D 52.7 vs C 54.9 - [ROOK vs Zus Health](https://www.anchorterminal.com/compare/rook-vs-zus-health.md): C 54.9 vs C 56.6 - [ROOK vs Terra API](https://www.anchorterminal.com/compare/rook-vs-terra.md): C 54.9 vs B 65.9 - [ROOK vs Validic Inform](https://www.anchorterminal.com/compare/rook-vs-validic.md): C 54.9 vs C 57.9 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on tryrook.io or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "rook", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html ROOK on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![ROOK on Anchor Terminal](https://www.anchorterminal.com/badges/rook.svg)](https://www.anchorterminal.com/tools/rook) ``` Plain link: ```html ROOK on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say ROOK is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/rook-dark.png - Light: https://www.anchorterminal.com/assets/share/rook-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=rook