Is there a Health Connect REST API?

Health Connect has no REST API: it is an on-device Android data store. HC Sync provides a separate REST API for records your Android app uploads with user permission. Your backend can read raw records or daily summaries and receive signed webhooks. Real device data still requires an installed Android app.

Last updated: 2026-11-04. The examples request 100 raw records or 7 days of summaries. Source for the 2026 service details: HC Sync page details.

What does Health Connect expose?

An Android application requests access to selected health data types and reads them through the device SDK. The records available depend on what source apps wrote into Health Connect and what the user allowed your app to read. A website, Python script or server cannot substitute a bearer token for that device permission flow. There is no Health Connect REST endpoint that reveals a user's phone records remotely.

Google Fit migration searches often lead here because a cloud API feels like a natural replacement. The architecture is different: a server-side integration must add an Android app or a companion app on the user's phone. HC Sync does not turn a Google Fit credential into Health Connect access, nor does it connect directly to every watch vendor. It transports the records your app can actually read.

How do you get a backend API?

Create a project, keep the secret key on your server, and mint one scoped token for each signed-in user. Add our Android library or React Native wrapper to the app. Explain the upload purpose, collect consent, request the selected Health Connect permissions, and sync. Your server can then read records over HTTPS independently of the phone, but freshness still depends on later device uploads.

curl -X POST https://hcsync.dev/v1/user-tokens \
  -H "authorization: Bearer $HCSYNC_SECRET" \
  -H "content-type: application/json" -d '{"user_id":"maya"}' 

How do you read raw records or daily summaries?

curl "https://hcsync.dev/v1/records?user_id=maya&type=steps&limit=100" \
  -H "authorization: Bearer $HCSYNC_READ_KEY"
curl "https://hcsync.dev/v1/summary?user_id=maya&days=7&tz=Europe/London" \
  -H "authorization: Bearer $HCSYNC_READ_KEY"

Records default to the last seven days and return an opaque next_cursor for paging. For a stable export, set from and to once and repeat the same filters with each cursor. Raw records preserve source information. Summary applies source overlap handling for steps, distance and active calories, and combines sleep and exercise intervals. Choose raw records when you need the original values and summary when those aggregation rules match your feature.

How do webhooks push data to your service?

Set a public HTTPS webhook URL with PUT /v1/webhook. HC Sync sends signed records.synced, records.deleted and user.deleted events. Verify the timestamp and HMAC against the raw body before parsing; the documentation contains complete Express and Flask receivers. Return a successful response only after you have safely accepted the event for processing.

Use GET /v1/users to inspect who has uploaded and when. The dashboard shows record counts, delivery attempts and the pending queue. Neither a successful sample read nor a webhook test proves that a phone is syncing. Test each boundary separately, including denied permissions, missing source records and your own backend being unavailable.

How do you verify the full integration?

Create a free project and save the secret key, read key, webhook secret and recovery code somewhere secure. The secret key belongs on your backend. A user token authorizes writes for one user; it is not a credential for reading records. Your own authenticated endpoint must select the user id from the signed-in session rather than accepting an arbitrary id from the app.

Start with sample data to test server reads without a phone. The sample user proves that your API credentials and parsing work; it does not prove Health Connect permissions or a device integration. Next test a real Android phone, grant only the permissions your feature uses, and confirm that a source app actually wrote those records into Health Connect. An empty response can mean no source data, denied permission, an incorrect user id or a time window that misses the records.

How should you handle consent, deletion and operations?

Before uploading health data, show a separate explicit consent choice with an unticked control, your purpose, the requested data types, US storage through HC Sync, and a way to withdraw. Android permission approval alone does not explain your server processing. Match your privacy notice and Play declarations to the actual types you collect. The consent and publishing checklist gives sample copy to adapt.

Keep your own downstream storage consistent with deletion events. Deleting a user with the secret-key API removes their server records and revokes existing device tokens. Stop local sync on withdrawal as well. Reads expose current records, not a permanent history of deletions. Webhook delivery can fail, so monitor attempts in the dashboard, retain event ids for deduplication, and handle retries without duplicating side effects. The API documentation describes queue limits and replay.

What are the common integration questions?

Is HC Sync the official Google Health Connect REST API?

No. HC Sync is a separate service that stores and serves records uploaded by your app. Health Connect itself is on-device.

Does this work for a web-only product?

Real data needs an Android app on the user’s phone. Your web backend can read the uploaded data through REST afterward.

React Native Health Connect backend · Expo Health Connect · Health Connect Python · Health Connect REST API

Create a free project