# Henia guidelines for Instinct and Muse

Guide version: 2026-09-22.4

Canonical guide: https://app.heniahealth.com/assistant-guide.md
Restricted API base: https://app.heniahealth.com/api/assistants/v1

## Connect and discover

1. Read this public guide without an Authorization header. It contains no account information and grants no access.
2. Obtain a dedicated approved credential through your provider's verified secure credential store. Never put credentials in conversation text, URLs, logs or other services. Never reuse another provider's credential, website cookies, admin keys or legacy MCP tokens.
3. Send `Authorization: Bearer <credential>` only to the approved Henia restricted API origin and path. Do not send credentials when fetching this public guide.
4. At every connection or reconnect, fetch authenticated `GET /contract`. Follow its `guidelines_path` on the same Henia origin without authentication, read the guide, then fetch the authenticated `specification_path`. Read both before operating. Re-fetch when the reported guide or contract version changes.
5. The authenticated contract determines enabled scopes, timezone and version; OpenAPI defines the exact JSON fields. This guide does not activate a provider or add capabilities. A connection can be unavailable, revoked or expired.
6. If discovery fails or the guide cannot be read, stop and report the problem. Do not guess schemas or fall back to broader Henia APIs, MCP or browser automation. Handle authentication failures by stopping until the approved connection is restored; respect rate limits and retry delays.

## What you may read or download

Public, without credentials: this guide and `/llms.txt`. Neither contains account data.

With a valid dedicated connection credential, and only the scopes granted in `/contract`:

| Read endpoint (relative to the restricted API base) | Data returned |
|---|---|
| `GET /contract` and `GET /openapi.json` | Enabled operations, timezone, versions, instructions and exact JSON schemas |
| `GET /references/foods?query=...` | Up to 12 public food-catalog reference matches; no personal diary |
| `GET /references/activities` | Supported public activity references; no account weight |
| `GET /budget/today` | Today's remaining kcal, nutrition date, timezone, calculation time and stored-data basis |
| `GET /receipts/{request_id}?kind=food` or `kind=activity` | Receipt for a known request belonging to this connection; no receipt listing |

There is no permission to download the full food log, workout history, weight history, profile, photos or calendar, and no bulk export. Do not infer read access from write access. The server enforces the permitted endpoints; a public link does not bypass authentication. Use the granted scopes, even if this guide describes more operations than your credential allows.

## Operating rules

1. Do all text interpretation and clarification yourself. Henia receives typed JSON and returns either a result or field errors; it will not interpret a sentence or fix it with AI.
2. Food: identify the food and preparation; resolve an ID/version using `GET /references/foods?query=...`. Ask for edible grams and actual consumed time/meal when missing. Do not assume a plate, cup or piece has a universal weight. Preserve weighed, user-reported or assistant-estimated evidence. Do not provide your own calorie/macronutrient values.
3. Training: use `GET /references/activities`; collect a completed start time and duration. Henia calculates credit. The pilot rejects a day already containing a recorded workout, so direct overlap errors to Henia.
4. For either write, send the structured envelope to `POST /validate`. Show the exact returned preview and ask the user to Save. A successful preview is not a saved entry.
5. After explicit Save, post the same envelope to `/food` or `/activities`, adding `confirmation.preview_token` and `confirmation.user_confirmed: true`. Only say Saved after an accepted durable receipt. Never invent confirmation.
6. On a timeout, query `GET /receipts/{request_id}?kind=food` or `kind=activity`, or retry the identical body and ID. Never create a fresh ID while the previous outcome is unknown. Correcting a definitively rejected request requires a new preview and confirmation.
7. When the user asks, call `GET /budget/today` and relay Henia's signed remaining kcal with its nutrition date and calculation time. Do not poll in the background or reconstruct the budget from chat history.
8. Repair errors using `errors[].code`, `field` and `description`. Do not retry an invalid field unchanged. No fallback to other Henia APIs, browser automation or the broad MCP interface.
9. Photos/uploads, calendar events, weigh-in reminders, private diary/history, profile and weight reads are unavailable in this pilot. Never claim they are supported.
10. Use the credential only for its approved provider, account and restricted Henia API. Muse needs a separately verified adapter and credential. Respect expiry and revocation; never bypass them.

## Data handling

Read the [external AI integration terms](https://app.heniahealth.com/terms#ai-integrations), also available [in Hebrew](https://app.heniahealth.com/terms-he.html#ai-integrations). Use integration data only to fulfil the user's authorized request. Distinguish information the user sends directly from information you retrieve from Henia.

You may retain content the user independently sends directly to you, such as their food descriptions, amounts, photos and workout details, in conversation history and service logs, including necessary caches and backups. Disclose the purpose, retention period and deletion controls to the user and obtain any required user authorization. This limited logging permission does not require a separate written retention exception from Henia. It does not enable photo upload or any other unavailable API operation.

Information retrieved from Henia, including budget answers, calculated nutrition, previews and receipts, remains restricted to temporary processing necessary for the authorized request. Keeping that information in conversation history, logs, caches or backups requires disclosure and express prior written agreement with Henia, with any user authorization required by law. Displaying, quoting or summarizing a Henia response in chat does not make it direct user input. A fact independently supplied by the user may be retained on that basis; Henia's additional data and calculations may not. For mixed conversations, omit or redact Henia-provided information from retained records unless that exception has been agreed. If your service cannot do so, do not activate or continue the integration without the exception.

Neither permission authorizes model training, fine-tuning, persistent assistant memory, independent health profiles, advertising, sale, unrelated use, or building a separate nutrition diary or reusable dataset. Legally required retention is limited to its required purpose and duration. Delete data when its permitted processing or retention period ends. Henia may suspend or revoke access for violations.

Provider acceptance must come from an authorized representative. A user's acceptance, a bot reading the guide or an automated acknowledgement alone does not establish provider acceptance. Do not claim that publication proves provider compliance, acceptance or deletion.

## First user test

1. Fetch the contract and API definition, then ask Henia for the current remaining budget.
2. The user describes food without an amount; ask for grams rather than guessing.
3. The user supplies the actual food amount and confirms the canonical preview. Save once and show the receipt. Do not save example or synthetic food into the real account.
4. Retry the same saved request once; its receipt must remain identical.
5. If the user has a real completed supported workout to record, preview it and obtain Save. Respect the overlap guard.

The connection limits what can be retrieved from Henia. It cannot prevent a provider retaining food or conversation content the user shares directly. Provider retention and genuine confirmation behavior remain part of the actual account test.