Developers
V1MeApp activity

Record at most one consented app-active event for the current Malaysia day

The server derives the authenticated owner and current time. No event is stored without analytics consent. Send an empty object; no health, device, session or client-time fields are accepted.

POST
/v1/me/app-activity

Authorization

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/me/app-activity" \  -H "Content-Type: application/json" \  -d '{}'
{  "recorded": true,  "day": "2019-08-24"}

Explicitly grant or withdraw product-usage analytics consent PATCH

Off by default. Granting consent does not record activity. Withdrawal removes account and session links from prior app activity; opting back in never reuses those links. This consent is separate from health, research, advertising and marketing.

Analyse a photo into an unsaved review draft POST

Requires the current category notice ID, its version and explicit acceptance. Only JPEG/PNG base64 is accepted, up to 4 MiB encoded image bytes and 16 megapixels. The advertised notice identifies the configured recipient: a private self-hosted health service, or explicitly enabled OpenRouter with Azure (US). Auto detects food/BP/glucose in one call and requires consent for all three. Identified meter photos are retained encrypted for up to 30 days; food photos are never persisted. Reuse captureId and identical input after network failure; an existing processing receipt never creates a second provider call. Unsupported, mixed, ambiguous or unreadable results require a retake. Identity documents and lab reports are not supported.