Run healthcare AI and data workloads through controlled compute environments with model identity, interoperability tooling, and execution receipts anyone can verify — without trusting us, and without an account.
HEALTH_SECURE runs only on
compute an operator has explicitly approved. It is never sent to the shared network, never to a
browser worker, never to an unapproved machine — and it is never downgraded when
secure capacity runs out. A request with nowhere safe to run fails with
503 SECURE_CAPACITY_UNAVAILABLE. That failure is the product.
One API for controlled healthcare AI execution, with an explicit privacy boundary on every request and an enterprise bill at the end of the month.
Every completed workload produces a signed receipt naming the exact model artifact that ran, the execution class, the policy version and commitments to input and output. No patient data is in it.
Structural validation with precise, path-level errors, and deterministic transformation that reports every field it could not map rather than guessing.
Sections, labelled fields, timelines and document type — with what it looked for and did not find reported alongside what it found.
Biomedical literature and clinical-trial retrieval where a fabricated citation is deleted before you see it, and every remaining sentence is labelled by how it is supported.
Run the execution workers inside your own infrastructure and keep the orchestration, policy and provenance. Sensitive data never leaves your network.
| HEALTH_PUBLIC | HEALTH_SECURE | |
|---|---|---|
| For | Public data, literature, synthetic data, appropriately de-identified data | Anything that may contain PHI |
| Runs on | The Animica network and this gateway's own deterministic executors | Only providers an operator explicitly approved |
| If capacity is short | Queues or uses the gateway's own executor | Fails. 503, never a downgrade. |
| Default when unstated | — | This one. The unsafe answer requires an explicit statement. |
| Purchasable anonymously over x402 | Some operations | Never. |
curl -s https://animica.dev/health/v1/sandbox/signup \
-H 'content-type: application/json' \
-d '{"name":"Acme Health"}'
# -> {"api_key":"ahk_test_...", "organization":{...}}
curl -s https://animica.dev/health/v1/fhir/validate \
-H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
-d '{"execution_class":"HEALTH_PUBLIC","resource":{"resourceType":"Observation","code":{"text":"Glucose"}}}'
# -> {"output":{"valid":false,"issues":[{"path":"Observation.status","severity":"error",
# "message":"Required field missing"}]}, "receipt":{...}}
No card. No wallet. No cryptocurrency. The receipt in that response can be verified by anyone at /health/verify without an account.
A subset of these services — the ones that never touch
patient data — are purchasable per call with no account at all, and are described in machine-readable
form at /.well-known/x402. Each entry declares its privacy
classification and a PHI_ALLOWED flag. Endpoints that can carry patient data are not on that
list and cannot be reached that way.
Receipts are signed with ML-DSA-65 (FIPS 204) — a post-quantum signature scheme — because a receipt may have to be defensible years after the fact, which is exactly the horizon over which a classical signature stops being evidence. Optionally, a digest of the receipt is anchored to the Animica ledger so its existence at a point in time can be corroborated independently. No payload, no commitment and no identifier of any person is ever anchored. You do not need to know any of this to use the API, and none of it requires you to hold a cryptocurrency.
Processing PHI requires healthcare onboarding and an executed Business Associate Agreement.POST /health/v1/access/request
Run the execution workers inside your own infrastructure and keep orchestration and provenance here.
The architecture, data flows, threat model and control inventory are published at /health/compliance.