> ## Documentation Index > Fetch the complete documentation index at: https://docs.arlohealth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start Records Connection > Starts a records connection: the user signs in to their insurer, or verifies their identity for a nationwide TEFCA search when `ial2Mode` is true. Returns an `authorizationUrl` to hand to the user (valid 15 minutes, can be reopened), a `linkNonce` to poll with, and a `notice` to relay to the user in plain words BEFORE they open the link: it is the notice at collection for their records. Then poll GET /api/health-records/link/{linkNonce} every 10 to 15 seconds, or when the user says they are done. ## OpenAPI ````yaml api-reference/openapi.yaml POST /api/health-records/link openapi: 3.1.0 info: title: Arlo Health MCP Server version: 1.0.0 description: | Healthcare infrastructure for AI agents. Everything an agent needs to act in healthcare for its user. ## Overview This server exposes two interfaces: - **MCP** (Model Context Protocol) over streamable HTTP at `/` for AI agents - **REST API** at `/api/*` for bots, skills, and direct HTTP clients Both interfaces use the same tool handlers and authentication. ## Authentication OAuth 2.1 with PKCE. All `/api/*` endpoints require a Bearer token. Discovery endpoints (no auth required): - `/.well-known/oauth-protected-resource` - `/.well-known/oauth-authorization-server` - `/.well-known/mcp.json` (MCP Server Card) ## Service Regions Care is licensed by where the patient is physically located when they request it, so every conversation carries an ISO 3166-2 `region` code. Arlo currently serves California, United States (`US-CA`); an unsupported region is refused with `REGION_NOT_SUPPORTED`, whose payload names the regions Arlo serves at that moment. contact: name: Arlo Health url: https://arlohealth.ai license: name: Proprietary url: https://arlohealth.ai/tos servers: - url: https://mcp.arlohealth.ai description: Production MCP Server security: - oauth2: - openid - profile - email - offline_access tags: - name: Discovery description: MCP and OAuth discovery endpoints (no auth required) - name: Profile description: User profile and patient information - name: Consultations description: Healthcare consultation management - name: Messaging description: Conversation messaging and media - name: Prescriptions description: Prescription orders (read-only; Photon Health fulfills them) - name: Health Records description: The user's connected insurance and health records (US) - name: Care Pricing description: Free price transparency under the user's plan (US) - name: Care Jobs description: >- Real-world care actions Arlo's care team executes after the patient approves (US) - name: Payment description: Billing and pay-per-use payment management - name: Webhooks description: Webhook registration and status paths: /api/health-records/link: post: tags: - Health Records summary: Start connecting health records description: | Starts a records connection: the user signs in to their insurer, or verifies their identity for a nationwide TEFCA search when `ial2Mode` is true. Returns an `authorizationUrl` to hand to the user (valid 15 minutes, can be reopened), a `linkNonce` to poll with, and a `notice` to relay to the user in plain words BEFORE they open the link: it is the notice at collection for their records. Then poll GET /api/health-records/link/{linkNonce} every 10 to 15 seconds, or when the user says they are done. operationId: startRecordsLink requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/RecordsLinkInput' responses: '200': description: Link started content: application/json: schema: $ref: '#/components/schemas/RecordsLinkStarted' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' components: schemas: RecordsLinkInput: type: object properties: ial2Mode: type: boolean description: >- true for a nationwide TEFCA record search with identity verification; false or omitted for an insurer or provider-portal sign-in patientId: type: string description: Optional patient id (defaults to the primary patient) RecordsLinkStarted: type: object required: - authorizationUrl - linkNonce properties: authorizationUrl: type: string format: uri description: >- Give this to the user to open in their browser. Valid for 15 minutes and can be reopened. linkNonce: type: string description: Poll GET /api/health-records/link/{linkNonce} with it notice: type: string description: >- Notice at collection for the records connection. Relay it to the user before they open the link. nextStep: type: string Error: type: object description: Error response properties: error: type: string description: Error code reason: type: string description: Human-readable explanation code: type: string description: Detailed error code responses: BadRequest: description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid authentication content: application/json: schema: type: object properties: error: type: string needsAuth: type: boolean securitySchemes: oauth2: type: oauth2 description: OAuth 2.1 with PKCE flows: authorizationCode: authorizationUrl: /oauth/authorize tokenUrl: /oauth/token scopes: openid: OpenID Connect profile: User profile email: Email address offline_access: Refresh tokens ````