Using notifications, you can be notified when a user has connected a device or when new data is available.


Syncing User Data

Notifications are one way to keep you user's information up-to-date. For best practices, see Keeping User Data Up-to-date.

Human API Notifications will alert your application when a user has connected a device or has new data that is available to pull. Specifically, notifications are sent whenever Human API servers receive new or updated user data and are thus a great way to keep local user data within your app in sync.

In order to take advantage of notification functionality, there are a few steps that you will need to take described below.

Set Up a POST Endpoint to Receive Notifications

Notifications are sent via a POST request to a specified endpoint on your server. Please create a dedicated endpoint and ensure that this endpoint:

  • Is publicly accessible
  • Accepts POST requests
  • Replies with a 200 status code within 3 seconds



Both HTTP and HTTPS endpoints are supported, though the latter is preferred for production environments.

Update Developer Portal

After creating an endpoint to receive notifications, you must then add it to your Human API account.

To do so, log into the Developer Portal, click the appropriate app and navigate to the Notifications page. On the Notifications page, check "Enable notifications", add the URL of the endpoint that you created in the "Notify URL" field and Save Changes.



Testing Your Notifications Endpoint

To test your newly created endpoint, simply add a user to your application and connect a device. This should trigger a Notification from Human API that will display on the righthand side of the notifications page in blue as shown above.

Authenticate Notification with HMAC-SHA1 Signature (optional)

Along with HTTPS, using the notification signature (X-HumanAPI-Signature) is a good way to ensure that notifications are entering your system securely.

The HMAC-SHA1 signature is calculated using String(payload + timestamp + nonce) as the message and your app's Client Secret (found under the Settings tab) as the key. For Node.js, we recommend that you use crypto-js for this calculation like so:

var crypto = require('crypto'); //npm install crypto-js --save
// ...

var payload = '{"contents":"supersecretstuff"}';
var timestamp = 1403591492088;
var nonce = 105850310064852240;

var clientSecret = 'itsfullofsecrets';

// crypto.createHmac(algorithm, key)
var signature = crypto.createHmac('sha1', clientSecret).update(payload + timestamp + nonce).digest('base64');

//Correct Result:
//signature == "fQkvPoMVwsZWM4/r4VrKlMaCOAw="

using System;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Security.Cryptography;
using System.IO;

namespace test
	class MainClass
		public static void Main (string[] args)
			string payload   = "{\"contents\":\"supersecretstuff\"}";
			string timestamp = "1403591492088";
			string nonce	 = "105850310064852240";

			byte[] signature = GenerateSignature("itsfullofsecrets", payload + timestamp + nonce);


		public static byte[] GenerateSignature(string secret, string content)
			HMACSHA1 myhmacsha1 = new HMACSHA1(Encoding.UTF8.GetBytes(secret));
			MemoryStream stream = new MemoryStream(Encoding.UTF8.GetBytes(content));
			return myhmacsha1.ComputeHash(stream);

There are also standard HMAC-SHA1 libraries for most languages.


Testing Your Signature

Use the demo data in the example above to test your implementation.

Correct Result : fQkvPoMVwsZWM4/r4VrKlMaCOAw=

From now on, so long as the X-HumanAPI-Signature == your calculated signature you can ensure that each notification is from us. If these values are not equal, you should ignore and not respond to that request.

Parse the Notification Payload

Notifications will be batched for performance, meaning that each notification may contain entries for multiple users.


Please note that only the app's owner can modify the notification settings.

POST Header Structure

Content-Type: application/json; charset=utf-8
User-Agent: HumanAPI/1.0

X-HumanAPI-Nonce: 105850310064852240
X-HumanAPI-Timestamp: 1403591492088
X-HumanAPI-Signature: ZTQ0MDg3MmExYjg5ZmYOTA3Y2M4Zjc4NQ==
Content-TypeStringPayload type, always set to application/json
User-AgentStringHumanAPI plus the notifications version (currently only 1.0)
X-HumanAPI-NonceStringUnique string used in calculating X-HumanAPI-Signature.
X-HumanAPI-TimestampIntegerUnix timestamp in seconds.
X-HumanAPI-SignatureStringHMAC-SHA1 signature calculated from String(payload + timestamp + nonce) using your app's clientSecret as the key.

POST Payload Structure

	"humanId": "1cb3eb4ddef09ff8f59f990c104c31ac",
	"updatedAt": "2016-02-02T02:10:40+00:00",
	"type": "activitysegment",
	"model": "activitysegment",
	"action": "created",
	"objectId": "56b01020131e6208005bc346",
	"endpoint": ""
}, {
	"humanId": "1cb3eb4ddef09ff8f59f990c104c31ac",
	"updatedAt": "2016-02-02T02:10:40+00:00",
	"type": "activitysummary",
	"model": "activitysummary",
	"action": "updated",
	"objectId": "56b01020131e6208005bc351",
	"endpoint": ""
humanIdStringThe unique Human API ID of your app user.
updatedAtDateThe time at which the record was last updated on our servers (in UTC).
typeStringIndicates the type of a measurement object.
modelStringThe updated record's model.
actionStringEither created or updated
objectIdStringThe record's unique ID, which can be added to the request route to grab only the updated record.
endpointStringThe endpoint to which you can append the user's accessToken to query for data.

Models & Type



Model/type information has been deprecated. Instead, design your processing system to use the endpoint URL (see below for details).

Responding To Notifications

To respond to the notification and query for the updated data, simply use the provided endpoint and objectId attributes along with the accessToken on your server that corresponds with the provided humanId.

So, for the following notification:

	"humanId": "1cb3eb4ddef09ff8f59f990c104c31ac",
	"updatedAt": "2016-02-02T02:10:40+00:00",
	"type": "activitysegment",
	"model": "activitysegment",
	"action": "created",
	"objectId": "56b01020131e6208005bc346",
	"endpoint": ""

The appropriate query to generate would be:

-H "Authorization: Bearer accessToken-for-humanId-1cb3eb4ddef09ff8f59f990c104c31ac"

Notification behaviors


When a user connects a Wellness account, notifications are sent for historical data and new dataβ€”even if the user has connected the account using Human API previously.


When a user connects their live Medical account, historical data will be collected and notifications will be sent. However, if the user connects the same account somewhere else using Human API (such as an internal test account that has already been connected before), notifications will not be sent. Please use a live and unique set of patient portal credentials in order to receive notifications.Β 

Alternatively, you may also use our Starfleet credentials in order to simulate notifications.