# Zus Health > Zus Health assembles a patient's history from CommonWell, Carequality, Surescripts, Quest and ADT networks into the Zus Aggregated Profile, and exposes it through FHIR R4 REST, GraphQL and webhook APIs for care organisations it onboards. - Canonical: https://www.anchorterminal.com/tools/zus-health - Markdown: https://www.anchorterminal.com/tools/zus-health.md (~5,600 tokens) - Slim: https://www.anchorterminal.com/tools/zus-health.min.md (~1,430 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/zus-health.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-14 ## Overview **Grade C · 56.6/100 · rank #669 of 1076 · #7 in Health records & wellness data · not agent-ready · confidence medium** ## Assessment FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK. ## Facts | Field | Value | | --- | --- | | Vendor | Zus Health, Inc. (https://www.zushealth.com) | | Kind | HTTP API | | Category | Health records & wellness data (https://www.anchorterminal.com/categories/health-data) | | Transport | HTTP | | Auth | OAuth · OAuth 2.0 bearer tokens valid for one hour. Backend systems use machine-to-machine App Clients created in the Zus app or through the Auth Service API, limited to 200 token requests an hour per client. Apps can exchange an OIDC ID token from their own identity provider for a Zus token, and integration App Clients with the Builder Data Integration role can fetch tokens for users through the proxy-token endpoint. Accounts are provisioned by Zus, with an initial admin per customer. | | Pricing | Paid (Paid) · No public prices. The Builder Terms set fees in an executed Order Form or pricing list, invoiced monthly. A developer sandbox is requested through a Google Form on the docs site, and its cost is not stated (checked 2026-10-14). | | x402 | No · No x402, MPP or L402 in the documentation, llms.txt or the Builder Terms (checked 2026-10-14). | | Licence | Proprietary service under the Zus Builder Terms of Service (last updated 11 March 2025), the Developer Sandbox Terms and the Zus Business Associate Addendum | | Docs | https://docs.zushealth.com | | llms.txt | https://docs.zushealth.com/llms.txt | | Last release | 2026-10-14 | | Endpoints | FHIR R4 at https://api.zusapi.com/fhir (sandbox https://api.sandbox.zusapi.com/fhir), GraphQL at https://fqs.zusapi.com/query, Auth Service, Patient History and ZAP Data Subscriptions APIs | | Data sources | EHR data through CommonWell and Carequality, pharmacy fills through Surescripts, ADT through PointClickCare and Bamboo Health, labs through Quest | | FHIR | Most FHIR R4 resource types, POST, PUT, JSON Patch and DELETE, transaction Bundles, conditional create, update and delete by identifier, `Zus-If-Match` version checks | | Pagination | Ordered by lastUpdated, 10 per page by default and up to 500 | | Rate limits | 2,000 FHIR requests a minute per customer, 200 token requests an hour per App Client, one Patient History request per patient per 24 hours and 10 priority jobs a minute per customer | | Webhooks | ZusHooks push events such as ADTs, and Data Marts export to customer warehouses | | EHR integrations | Epic, athenahealth, Elation, eClinicalWorks, Salesforce Health Cloud, Healthie, Canvas and Medplum | | SLA | 99.5 per cent monthly uptime for Builder Services, credits 2, 5 or 10 per cent of the month's invoice | | Status | status.zusapi.com on StatusPal with components for the app, EHR integrations, FHIR and Patient History APIs, each network, ZusHooks and the Auth Service | | Capabilities | health.records, health.fhir, health.ehr, health.consent | | Tags | hosted, health-records, fhir, graphql, oauth, llms-txt, webhooks, status-page, sla, sales-led | | JSON | https://www.anchorterminal.com/api/v1/tools/zus-health.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 66 | 13.2 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 77 | 12.5 | | Agent ergonomics | 13% | 16.2 | 67 | 10.9 | | Security & auth | 14% | 17.5 | 49 | 8.6 | | Payments & pricing | 10% | 12.5 | 5 | 0.6 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 64 | 5.6 | | Transparency & trust (editorial 46, provenance 71) | 7% | 8.8 | 59 | 5.2 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **56.6 → C** | ### Why each score - Reliability 66: Read with the hosted lines. status.zusapi.com on StatusPal with components and history (20). Between 16 July and 14 October 2026 it lists major incidents on the athenahealth embedded app (27 July), ZusHooks delays of up to two hours (4 August), risk gap calculations (5 August) and the embedded app across EHRs (13 August), with FHIR API errors on 24 August marked minor. Several majors, none on the FHIR API itself (5 of 30). Rate limits with numbers for FHIR, tokens and Patient History (15). 429 is documented with no Retry-After or backoff guidance, while conditional writes by identifier and `Zus-If-Match` make retries safe (8 of 15). A published SLA of 99.5 per cent with credits (10). FHIR REST is generally available and GraphQL is beta (8 of 10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 77: Each reference page carries an OpenAPI 3.0.3 fragment with enums and required fields, with no single specification file found (18 of 25). llms.txt and Markdown pages (10). Guides explain the ZAP, Patient History jobs and when to subscribe or query once (13 of 20). Typed inputs with enums on Auth Service and Patient History operations, FHIR search parameters listed (12 of 15). A Postman collection and Loom walkthroughs, with little on error bodies (9 of 15). A dated changelog with about ten entries since 29 July 2026 (15). - Agent ergonomics 67: `_count` up to 500, and GraphQL selects only the fields requested, though GraphQL is beta (20 of 25). FHIR search parameters across resources and lastUpdated ordering (18 of 20). Error responses are not described beyond 429 (10 of 20). Conditional create by identifier and `Zus-If-Match` version checks, no idempotency keys (14 of 20). No official SDK, a Postman collection only (5 of 15). - Security & auth 49: OAuth 2.0 with one-hour tokens, machine-to-machine App Clients managed in the app, token exchange from the customer's identity provider and a proxy-token endpoint now limited to a dedicated role (22 of 30). Managed roles such as Builder Admin and Builder Data Integration, with no read-only API role confirmed (12 of 20). The ZAP returns documents and data from outside organisations with no prompt-injection guidance (3 of 15). AuditEvent is a supported resource and the Builder Security Policy asks builders to keep audit logs, with no operator-facing API log documented (7 of 15). No named certification, an annual third-party audit summary on request, no security.txt or bug bounty (5 of 20). - Payments & pricing 5: Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). A developer sandbox is requested by Google Form, limited to test data, with no price stated (5 of 20). Zus provisions accounts and users (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 64: The Builder Data Integration role change took effect on 14 October 2026 and the last dated entry is 21 September 2026 (30). About ten dated changelog entries since 29 July 2026 (20). A public changelog, a weekly product email and a Zendesk support form. We did not test support (11 of 15). No official SDK was found (0 of 15). A maintained Postman workspace (3 of 10). - Transparency & trust 59: Closed service with published Builder Terms, Developer Sandbox Terms, BAA and SLA (15 of 30). The terms forbid de-identifying Patient Data for sale but let Zus use and sell System Data. The privacy policy covers the website only, with no retention periods (15 of 30). The terms promise reasonable efforts at 60 days' notice for changes that aren't backwards-compatible, and the changelog announces dated changes in advance (14 of 20). No sub-processor list or data location found (2 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (13 items): https://www.anchorterminal.com/fixes/zus-health.md (JSON https://www.anchorterminal.com/fixes/zus-health.json) ### What we couldn't check - Whether the developer sandbox is free and how quickly a form request is answered is not stated - unchecked: whether Zus holds SOC 2 or HITRUST, since no certification was named on the pages read - No error response format was found in the documentation read ### Sources - documentation index: (seen 2026-10-14) - rate limits: (seen 2026-10-14) - user authentication: (seen 2026-10-14) - FHIR REST capabilities: (seen 2026-10-14) - sandbox sign-up: (seen 2026-10-14) - changelog entry: (seen 2026-10-14) - status history: (seen 2026-10-14) - SLA: (seen 2026-10-14) - Builder Terms: (seen 2026-10-14) - Developer Sandbox Terms: (seen 2026-10-14) - Builder Security Policy: (seen 2026-10-14) - privacy policy: (seen 2026-10-14) ## Who's behind it (provenance 71/100, checked 2026-10-14) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Zus Health, Inc. | 20/20 | | Domain age | zushealth.com, registered 2012-02-25 (14 years) | 15/15 | | Endpoint on the vendor's domain | is not on zushealth.com | 0/15 | | Terms of service | read, states 7 of the 7 things a reader expects | 10/10 | | Privacy policy | read, states 3 of the 8 things a reader expects | 6.3/10 | | Status page | status.zusapi.com | 10/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | The APIs answer on zusapi.com, a separate domain from zushealth.com. The Builder Terms (last updated 11 March 2025) put term changes into effect 30 days after posting and BAA changes after 90 days. The Developer Sandbox Terms (22 January 2024) limit the sandbox to test data. The website lists 1 Lincoln Street, Suite 2900, Boston, MA 02111. The privacy policy (last updated 24 June 2026) covers the website only and names Google Analytics. The Builder Security Policy (11 March 2025) names no certification and makes a summary of an annual third-party audit available on request. www.zushealth.com/.well-known/security.txt returns 404. RDAP gives zushealth.com a registration date of 2012-02-25. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.zushealth.com/builder-terms-of-service), read 2026-10-14, dated 2025-03-11, states 7 of the 7 things a reader expects. - To know. Says access can be ended without notice or for any reason. "Notwithstanding the foregoing, if no Initial Term is designated on the Order Form either party may terminate your use of the Builder Services at any time with 30 days’ prior written notice to the other party." - Gives the date it was last updated. Last updated 2025-03-11. - Names the governing law or courts. The law of the Commonwealth of Massachusetts. - States a limit on its liability. Capped at the fees paid in the 12 months before the claim. - Says how changes to the terms are announced. Gives 30 days of notice before a change. - Also in the text (2026-10-14). Order Forms renew automatically for one-year periods unless either party gives notice at least 90 days before the term ends. "The Order Form will thereafter automatically renew for additional one-year periods (collectively with the Initial Term, the “Term”) unless either party provides written notice of its intent to terminate no later than 90 days prior to the end of the then current Term." - Also in the text (2026-10-14). Zus may license, sell and receive payment for System Data. "System Data. We may use, disclose, market, license, distribute, sell, receive remuneration for, create derivative works of System Data as permitted by Applicable Law." - Also in the text (2026-10-14). Zus may name the customer as a participant in the Zus Network and a contributor to the Common Patient Record. "Zus may identify you as a Participant in the Zus Network and as a contributor to the Common Patient Record." **Privacy policy** (https://www.zushealth.com/privacy-policy), read 2026-10-14, dated 2026-06-24, states 3 of the 8 things a reader expects. - Gives the date it was last updated. Last updated 2026-06-24. - Not found in the text. Says how long data is kept. - Not found in the text. Says whether personal data is sold or shared for advertising. - Not found in the text. Says what rights people have over their data. - Not found in the text. Gives a privacy contact. - Not found in the text. Says where data is transferred or stored. ## Live (updated 2026-10-14 08:54 UTC) - Vendor status page: unknown, no machine-readable status found - Always current: https://www.anchorterminal.com/api/v1/live/zus-health.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - One profile per patient from EHR, pharmacy, ADT and lab networks, shared across Zus customers treating the same patient - Rate limits with numbers and a published 99.5 per cent SLA with credits - Conditional writes by identifier and `Zus-If-Match` version checks for safe retries - Dated changelog that announces changes ahead, such as the proxy-token role change on 14 October 2026 ## Weaknesses - No public prices, and the sandbox is requested through a Google Form - Four major incidents on the status page between 27 July and 13 August 2026 - No named security certification, security.txt or bug bounty - The GraphQL API is beta and no official SDK exists ## Before you call it (notes for agents) 1. Cache the access token for its hour. More than 200 token requests an hour per App Client returns 429 2. Request Patient History at most once per patient per 24 hours, and poll the job status endpoint 3. Use conditional create by identifier so a retried write doesn't duplicate a resource 4. Send `Zus-If-Match` with the resource's ETag on PUT and PATCH 5. Set `_count` up to 500 on searches, since the default page is 10 ## Connect First request: ```bash GET https://api.sandbox.zusapi.com/fhir/Patient?_count=50 Authorization: Bearer ``` Through letme (picks today, calling later): https://letme.dev/zus-health. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Medblocks | D | 52.7 | 773 | health.records, health.consent, health.ehr, health.fhir | no | https://www.anchorterminal.com/tools/medblocks.md | | Metriport Medical API | D | 50.1 | 833 | health.records, health.fhir, health.consent, health.ehr | no | https://www.anchorterminal.com/tools/metriport.md | | Aidbox | B | 64.2 | 385 | health.fhir, health.records, health.consent | no | https://www.anchorterminal.com/tools/aidbox.md | | Health Gorilla | C | 59.3 | 583 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/health-gorilla.md | | Redox | C | 58.3 | 618 | health.ehr, health.fhir, health.records | no | https://www.anchorterminal.com/tools/redox.md | | 1upHealth | D | 46.8 | 903 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/1uphealth.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - FHIR endpoints at api.zusapi.com and fqs.zusapi.com allow 2,000 requests a minute per customer, and Patient History allows one request per patient per 24 hours (source: ) - The SLA commits to 99.5 per cent monthly uptime for Builder Services, with credits of 2 to 10 per cent, excluding third-party network services (source: ) - The Builder Terms promise reasonable efforts to give 60 days' notice of changes that aren't backwards-compatible, and forbid de-identifying Patient Data for sale (source: ) - From 14 October 2026 only App Clients with the new Builder Data Integration role can call the proxy-token endpoint (source: ) - The GraphQL API at fqs.zusapi.com is labelled beta (source: ) - status.zusapi.com on StatusPal lists four major incidents between 27 July and 13 August 2026 on the embedded app, ZusHooks and risk gaps (source: ) - #7 of 12 in Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md - All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md ## Compare - [Aidbox vs Zus Health](https://www.anchorterminal.com/compare/aidbox-vs-zus-health.md): B 64.2 vs C 56.6 - [Medplum vs Zus Health](https://www.anchorterminal.com/compare/medplum-vs-zus-health.md): B 68.7 vs C 56.6 - [1upHealth vs Zus Health](https://www.anchorterminal.com/compare/1uphealth-vs-zus-health.md): D 46.8 vs C 56.6 - [Health Gorilla vs Zus Health](https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health.md): C 59.3 vs C 56.6 - [Medblocks vs Zus Health](https://www.anchorterminal.com/compare/medblocks-vs-zus-health.md): D 52.7 vs C 56.6 - [Metriport Medical API vs Zus Health](https://www.anchorterminal.com/compare/metriport-vs-zus-health.md): D 50.1 vs C 56.6 - [Particle Health vs Zus Health](https://www.anchorterminal.com/compare/particle-health-vs-zus-health.md): D 48.6 vs C 56.6 - [ROOK vs Zus Health](https://www.anchorterminal.com/compare/rook-vs-zus-health.md): C 54.9 vs C 56.6 - [Terra API vs Zus Health](https://www.anchorterminal.com/compare/terra-vs-zus-health.md): B 65.9 vs C 56.6 - [Validic Inform vs Zus Health](https://www.anchorterminal.com/compare/validic-vs-zus-health.md): C 57.9 vs C 56.6 - [Redox vs Zus Health](https://www.anchorterminal.com/compare/redox-vs-zus-health.md): C 58.3 vs C 56.6 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on zushealth.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "zus-health", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html Zus Health on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![Zus Health on Anchor Terminal](https://www.anchorterminal.com/badges/zus-health.svg)](https://www.anchorterminal.com/tools/zus-health) ``` Plain link: ```html Zus Health on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Zus Health is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/zus-health-dark.png - Light: https://www.anchorterminal.com/assets/share/zus-health-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=zus-health