> ## Documentation Index > Fetch the complete documentation index at: https://docs.arlohealth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get Health Records > Read-only view over the patient's insurance and health records, sourced from their insurer via Flexpa. Call with no `section` first: `summary` returns the connection status, the coverage header, demographics, and a record COUNT per category. Then pass a `section` to drill in. Rows are newest-first and capped at 100 per view; when a view is `truncated`, re-call with the same section and `offset: nextOffset`. When no insurance is connected the response carries `connected: false`; offer the user POST /api/health-records/link. Records are optional: care works without them, so never block a consultation on connecting. ## OpenAPI ````yaml api-reference/openapi.yaml GET /api/health-records openapi: 3.1.0 info: title: Arlo Health MCP Server version: 1.0.0 description: | Healthcare infrastructure for AI agents. Everything an agent needs to act in healthcare for its user. ## Overview This server exposes two interfaces: - **MCP** (Model Context Protocol) over streamable HTTP at `/` for AI agents - **REST API** at `/api/*` for bots, skills, and direct HTTP clients Both interfaces use the same tool handlers and authentication. ## Authentication OAuth 2.1 with PKCE. All `/api/*` endpoints require a Bearer token. Discovery endpoints (no auth required): - `/.well-known/oauth-protected-resource` - `/.well-known/oauth-authorization-server` - `/.well-known/mcp.json` (MCP Server Card) ## Service Regions Care is licensed by where the patient is physically located when they request it, so every conversation carries an ISO 3166-2 `region` code. Arlo currently serves California, United States (`US-CA`); an unsupported region is refused with `REGION_NOT_SUPPORTED`, whose payload names the regions Arlo serves at that moment. contact: name: Arlo Health url: https://arlohealth.ai license: name: Proprietary url: https://arlohealth.ai/tos servers: - url: https://mcp.arlohealth.ai description: Production MCP Server security: - oauth2: - openid - profile - email - offline_access tags: - name: Discovery description: MCP and OAuth discovery endpoints (no auth required) - name: Profile description: User profile and patient information - name: Consultations description: Healthcare consultation management - name: Messaging description: Conversation messaging and media - name: Prescriptions description: Prescription orders (read-only; Photon Health fulfills them) - name: Health Records description: The user's connected insurance and health records (US) - name: Care Pricing description: Free price transparency under the user's plan (US) - name: Care Jobs description: >- Real-world care actions Arlo's care team executes after the patient approves (US) - name: Payment description: Billing and pay-per-use payment management - name: Webhooks description: Webhook registration and status paths: /api/health-records: get: tags: - Health Records summary: Read connected insurance and health records description: | Read-only view over the patient's insurance and health records, sourced from their insurer via Flexpa. Call with no `section` first: `summary` returns the connection status, the coverage header, demographics, and a record COUNT per category. Then pass a `section` to drill in. Rows are newest-first and capped at 100 per view; when a view is `truncated`, re-call with the same section and `offset: nextOffset`. When no insurance is connected the response carries `connected: false`; offer the user POST /api/health-records/link. Records are optional: care works without them, so never block a consultation on connecting. operationId: getHealthRecords parameters: - name: section in: query required: false schema: type: string enum: - summary - coverage - conditions - medications - allergies - immunizations - labs - vitals - visits - claims - everything default: summary description: >- Which slice to return. summary is the cheap overview with counts; everything returns all sections at once (large). - name: offset in: query required: false schema: type: integer minimum: 0 default: 0 description: Row offset for paging a truncated view (ignored for summary) responses: '200': description: The requested section content: application/json: schema: $ref: '#/components/schemas/HealthRecords' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' components: schemas: HealthRecords: type: object description: | Shape varies by section. Besides the named fields, each section contributes view blocks keyed by view name (coverage, coverage_class, problems, medication_request, allergies, immunizations, encounters, claims_header, ...), all with the capped-view shape { count, truncated?, showing?, nextOffset?, rows[] }, rows newest-first, count = the true total even when rows were capped. properties: section: type: string connected: type: boolean description: >- Only present (false) when no insurance is connected; offer POST /api/health-records/link. message: type: string howToConnect: type: string connection: type: object description: Insurance connection and sync state properties: payer: type: - string - 'null' importedAt: type: - string - 'null' lastSyncedAt: type: - string - 'null' syncStatus: type: - string - 'null' syncInProgress: type: boolean syncNote: type: - string - 'null' demographics: type: - object - 'null' description: Patient demographics row (summary, coverage, everything) recordCounts: type: object description: summary only, record count per category note: type: string sections: type: object description: everything only, every category block keyed by section name additionalProperties: true Error: type: object description: Error response properties: error: type: string description: Error code reason: type: string description: Human-readable explanation code: type: string description: Detailed error code responses: BadRequest: description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid authentication content: application/json: schema: type: object properties: error: type: string needsAuth: type: boolean securitySchemes: oauth2: type: oauth2 description: OAuth 2.1 with PKCE flows: authorizationCode: authorizationUrl: /oauth/authorize tokenUrl: /oauth/token scopes: openid: OpenID Connect profile: User profile email: Email address offline_access: Refresh tokens ````