Apple Health webhook: send data to your own server

Syncky Health POSTs the Apple Health types you choose from your iPhone to your own server. Your server receives plaintext; use HTTPS. Nothing passes through Syncky's servers on this route.

Free during launch; plans are coming later. See launch access and pricing.

What does the iPhone POST?

Read X-Syncky-Format to select the parser. These are short, synthetic excerpts from the protocol's request vectors; see the full body formats for envelopes and supported kinds.

Syncky JSON (native), a sample object:

{"uuid":"4EA70000-0000-4000-8000-000000000001","type":"heart_rate","value":64,"unit":"count/min","start":"2026-10-14T07:01:03Z","end":"2026-10-14T07:01:03Z","source":{"app":"com.apple.Health","device":"Apple Watch"}}

Health Auto Export-style JSON (hae), a metric object:

{"name":"apple_stand_hour","units":"count","data":[{"date":"2026-10-14 08:00:00 +0200","qty":1,"source":"Apple Watch"}]}

CSV (csv), the header and one row:

type,uuid,start,end,value,unit,value_name,source,device,user_entered
characteristic,characteristic:blood_type,,,1,,a_positive,,,

InfluxDB line protocol (influx), one line:

heart_rate,device=Apple\ Watch,source=com.apple.Health,unit=count/min value=64 1791961263000000000

How do authentication and signing work?

Choose none, Bearer, Basic or a custom header. For internet-reachable servers, turn on Sign requests (HMAC). The secret is whsec_ plus 43 base64url characters. Use the whole secret string as the UTF-8 key for HMAC-SHA256 over X-Syncky-Timestamp + . + the raw body bytes, before parsing. Compare X-Syncky-Signature in constant time with v1= plus 64 lowercase hex digits; accept only timestamps within 300 seconds of your clock. See signature verification.

When will data arrive, and how do I handle repeats?

iOS decides background scheduling; there is no fixed interval. Health data is readable only while the iPhone is unlocked. Redirects are never followed: answer at the configured URL itself.

Delivery is at least once. Deduplicate samples by (device, uuid) and workout-route or heartbeat-series parts by (device, uuid, part). Replace characteristics (characteristic:<name>) and activity-summary days in place. Native device is the install id; for other formats, give each iPhone its own server entry or URL path. See batching and keys.

Can my server reply with writes, and where do I start?

The app applies supported commands from a successful data reply only when Accept writes to Health is on for the server and the iPhone has the Sync plan. Writes apply at the next sync for the types the owner allowed for writing in the app, with iOS Health permission. Commands wait for a data request to answer; check the phone's results. See write-back permissions and results.

Use the full server contract, n8n, Home Assistant, Node-RED, InfluxDB and Grafana, Zapier, Make, Google Sheets through an automation receiver or migration from Health Auto Export. For other routes, see Apple Health API options and file export.

For an AI agent, Relay sees delivery metadata and no health values; hub notices are plaintext. Sealed envelopes wait until acknowledgment or expiry, at most 7 days. Your agent receives plaintext, and a chosen model sees what the agent supplies.