canonical: https://jentic.com/apis/amazonaws.com/amazon-healthlake

# AWS Amazon HealthLake

Jentic publishes the only available OpenAPI specification for Amazon HealthLake, keeping it validated and agent-ready. Amazon HealthLake is a HIPAA-eligible service that stores, transforms, queries, and analyses FHIR-formatted health data in the cloud. The control-plane API manages FHIR datastores and the import and export jobs that move bulk FHIR resources in and out of those datastores. With 13 operations it is a focused control surface for provisioning HealthLake infrastructure and running data movement jobs.

## For AI agents

Provision and manage Amazon HealthLake FHIR datastores and orchestrate FHIR import and export jobs for bulk movement of healthcare data into AWS.

## Scope

Does not handle FHIR resource CRUD, clinical NLP, or appointment scheduling - use for HealthLake datastore provisioning and bulk import/export jobs only.

## Capabilities

- Create FHIR datastores configured for HIPAA-eligible workloads with optional SMART on FHIR support
- Describe and list FHIR datastores filtered by status
- Start FHIR import jobs that load bulk NDJSON data from S3 into a datastore
- Start FHIR export jobs that write a datastore's resources to S3 in NDJSON
- Cancel running export jobs and inspect their status
- Tag HealthLake datastores and manage resource tags for cost allocation
- Delete FHIR datastores and free associated storage when retention requirements allow

## Use cases

### FHIR Data Lake Provisioning

Stand up a HIPAA-eligible FHIR R4 datastore for clinical research or population-health analytics. CreateFHIRDatastore provisions storage and a FHIR endpoint, optionally attaching SMART on FHIR for OAuth-style access and a KMS key for encryption. Once provisioned, the datastore endpoint is a fully compliant FHIR REST API.

Example prompt: Call CreateFHIRDatastore with DatastoreTypeVersion=R4, DatastoreName=research-prod, and a SseConfiguration referencing a customer-managed KMS key

### Bulk EHR Migration to HealthLake

Migrate millions of FHIR resources from a legacy EHR or staging bucket into HealthLake using StartFHIRImportJob. The import reads NDJSON files from S3, transforms them into the datastore, and writes results back to a configured output bucket. DescribeFHIRImportJob and ListFHIRImportJobs surface progress and failures during the migration.

Example prompt: Call StartFHIRImportJob with InputDataConfig pointing at s3://my-fhir-staging/patients/ and JobOutputDataConfig pointing at s3://my-fhir-output/

### Periodic Export for Analytics

Export FHIR resources on a schedule for downstream analytics in a data warehouse or ML pipeline. StartFHIRExportJob writes NDJSON to S3, and DescribeFHIRExportJob reports completion. This decouples analytical workloads from the live FHIR endpoint while still providing point-in-time data extracts.

Example prompt: Call StartFHIRExportJob with the DatastoreId and OutputDataConfig pointing at s3://analytics-fhir/exports/2026-06/

### AI Agent Healthcare Operations

Through Jentic, an AI agent can orchestrate HealthLake provisioning and data movement as part of a wider healthcare workflow - for example, creating a research datastore, starting an import, and emitting a notification once it completes. Jentic exposes the 13 control-plane operations as discoverable tools.

Example prompt: Search Jentic for 'start fhir import job', load the StartFHIRImportJob schema, and execute it for a specified datastore and S3 input path

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | / | CreateFHIRDatastore - provision a new FHIR datastore |
| POST | / | DescribeFHIRDatastore - fetch datastore configuration and status |
| POST | / | ListFHIRDatastores - list datastores in the account |
| POST | / | StartFHIRImportJob - bulk-load FHIR data from S3 |
| POST | / | StartFHIRExportJob - export FHIR data to S3 |
| POST | / | DescribeFHIRImportJob - check status of an import job |
| POST | / | DescribeFHIRExportJob - check status of an export job |
| POST | / | DeleteFHIRDatastore - delete a datastore and its resources |

## Key resources

- **FHIRDatastore** — HIPAA-eligible FHIR R4 datastore with a managed FHIR REST endpoint
- **FHIRImportJob** — Job that loads NDJSON FHIR resources from S3 into a datastore
- **FHIRExportJob** — Job that exports FHIR resources from a datastore to S3

## Why Jentic

- **Setup:** Wiring Amazon HealthLake by hand means implementing AWS Signature v4 request signing, resolving the healthlake host, and dispatching each datastore and import/export action through one endpoint by the operation named in the request. Through Jentic you install once, import Amazon HealthLake from the API Directory, store the AWS credentials once, and your agent calls it.
- **Permission scoping:** This API routes every call through a single endpoint with the action named in the request, covering operations like CreateFHIRDatastore, StartFHIRImportJob, and StartFHIRExportJob. Limit the agent to the operations it needs, such as DescribeFHIRDatastore and ListFHIRDatastores, so DeleteFHIRDatastore is not included unless you add it.
- **Credential handling:** Your AWS credentials are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a FHIR datastore' or 'start a bulk FHIR import from S3', and Jentic returns the matching Amazon HealthLake operation with its input schema so the agent calls the right endpoint without browsing the AWS service reference.

## Related APIs

- **Amazon Comprehend** — Comprehend Medical extracts clinical entities from unstructured notes that can be loaded into HealthLake
- **Amazon SageMaker** — Train and deploy ML models on FHIR data exported from HealthLake
- **AWS CloudTrail** — Audit log of every HealthLake control-plane API call for compliance

## FAQ

### Why is there no official OpenAPI spec for Amazon HealthLake?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Amazon HealthLake via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Amazon HealthLake API use?

The control-plane API uses AWS Signature Version 4 (HMAC) request signing with an AWS access key ID and secret access key. The FHIR data-plane endpoint on a datastore uses SigV4 by default and optionally SMART on FHIR OAuth tokens.

### Can I import bulk FHIR data with the Amazon HealthLake API?

Yes. Call StartFHIRImportJob with an InputDataConfig that points to S3 NDJSON files and a JobOutputDataConfig for results. Use DescribeFHIRImportJob to monitor progress and inspect failed resources.

### What are the rate limits for the Amazon HealthLake API?

AWS applies per-account, per-region request quotas to HealthLake control-plane operations and these vary by call. Datastore creation has lower quotas than describe and list operations. Check AWS Service Quotas for current limits.

### How do I create a HealthLake datastore through Jentic?

Search Jentic for 'create healthlake fhir datastore', load the CreateFHIRDatastore schema, and execute with DatastoreTypeVersion=R4, a DatastoreName, and an optional KMS SseConfiguration. The response includes the DatastoreEndpoint URL once status reaches ACTIVE.

### Is Amazon HealthLake HIPAA-eligible?

Yes. HealthLake is a HIPAA-eligible service and customers can use it for protected health information under a Business Associate Addendum with AWS. Encryption at rest with KMS and TLS in transit is enforced by default.

### Can I limit what my agent is allowed to do with the AWS HealthLake API?

Yes. Because you run Jentic One yourself, your own rules decide which HealthLake operations the agent may call, even though every request goes through a single endpoint with the action named in the request. You can allow read-only operations such as DescribeFHIRDatastore and ListFHIRDatastores while withholding write actions like CreateFHIRDatastore, StartFHIRImportJob, and StartFHIRExportJob. DeleteFHIRDatastore stays out of reach unless you explicitly add it, and the AWS credentials the agent uses are supplied by your instance at execution time rather than exposed to the agent.