Google Health API access: verification, the 100-user cap and rate limits

To prepare for verification, review and follow the OAuth 2.0 Restricted Scopes guide. This guide outlines the steps to prepare for and request verification in the Google Cloud console.

Be specific when explaining why your app needs each scope. Vague or duplicate justifications for different scopes can cause delays in the verification process.

In addition to OAuth verification, apps using restricted scopes must also complete an annual security assessment based on the Cloud App Security Assessment framework (CASA). Google's Trust and Safety team notifies you with instructions when this needs to be completed.

A third-party security firm performs this assessment to confirm that your app handles user data securely and can delete user data upon request. CASA uses the industry-recognized OWASP Application Security Verification Standard (ASVS). After you pass the assessment, your app receives a Letter of Validation (LOV) from the security assessor.

For more details on the CASA program and to find authorized security assessors, visit the Cloud Application Security Assessment website.

If you have existing security certifications or recent penetration test results that align with accepted industry standards, you might be able to expedite the CASA process. CASA offers an Accelerator program that lets assessors use existing valid documentation from Accepted Security Frameworks to reduce redundant checks and potentially lower assessment costs.

Google accepts HITRUST, SOC 2, and ISO/IEC 27001 certifications that you have already completed. To use these certifications, you must still work with an authorized CASA assessor and provide your completed HITRUST, SOC 2, or ISO/IEC 27001 documentation. The CASA assessor checks off these certifications against their list of CASA requirements, which reduces the time required to complete the CASA assessment.

The security assessment can take 2-3 weeks for tier-2 applications and 4-6 weeks for tier-3 applications to complete and involves fees payable to the third-party assessor, ranging from $500 to $4,500 USD, depending on your app's complexity. Trust and Safety will tell the developer when to start the CASA process.

After you get your Letter of Validation (LOV), submit the letter to Google's Trust and Safety team to complete your security assessment.

The CASA assessment is performed by a third party, and Google does not have control over this assessment process. Any issues with the assessment should be raised directly with your chosen security assessor.

When your application exceeds an allocated rate limit, the API rejects the request and returns the error 429 Too Many Requests. To mitigate the error, your application should backoff sending requests and implement retry logic to gracefully handle rate-limiting events.

If your application requires higher throughput than the default allocations provided, you can request an adjustment through the Google Cloud Console. See View and manage quotas.

One of the core benefits of the Google Health API is the ability to track a user's performance and monitor their health vitals over long periods of time. You can query a user's data as far back as it has been recorded; the API imposes no limitations or restrictions on the amount of historical data your application can consume.

However, querying historical data is still governed by standard rate limits. To manage system stability and prevent excessive payloads, the Google Health API uses automatic pagination with endpoint-specific page sizes. Note the following boundaries and behavior:

• Automatic pagination: If you query a long span of data, the API will only return the first page of results up to the page size cap for that endpoint, along with a nextPageToken. You must use the nextPageToken to request subsequent pages.
• Variable page sizes: Capping limits depend on the endpoint and data type. For most data types, page sizes are capped at a maximum of 10,000. However, for certain data types like exercise and sleep, the default and maximum page size is capped at 25. For example, if a client requests all sleep data for the past 10 years, the API will still return only 25 sleep sessions on the first page.
• Rollup date range restrictions: For data rollup and aggregation endpoints (such as rollUp and dailyRollUp), query date ranges are restricted based on the data type:
  • A maximum range of 14 days for calories-in-heart-rate-zone, heart-rate, active-minutes, and total-calories.
  • A maximum range of 90 days for all other rollup data types.

Depending on the volume of historical data your application needs, retrieving the entire dataset will require paginating through the pages sequentially. Keep this in mind when designing your application's data synchronization process.

To ensure optimal performance and avoid API errors, follow these guidelines when querying historical data: