Zocdoc opens booking to AI agents: MCP server, REST API, consent

Zocdoc opened its booking system to AI agents. Registered agents can now find providers, check insurance and put confirmed appointments on real calendars. Much of the web is blocking AI agents or charging them. Zocdoc went the other way. For any business that sells time, here is the hook: the agent books with whoever is easiest to book. Easy means an API, not a phone tree.

What actually happened

Zocdoc announced the program on October 28. According to the press release, agents connect through four doors: an MCP server, a REST API, agent guidance in an llms.txt file, and deep links.

The rules are short. Agents must register and identify themselves. They must get explicit patient consent before they book, and they must protect patient and provider data. Healthcare Dive reports that an approved agent can search the directory, check availability, verify insurance and book. It checks with the patient before it confirms. Agents may not train on the data, resell it or republish it.

Google Gemini, Amazon Health AI and Instinct, a text-and-call agent, are already connected. Zocdoc also announced a partnership with Instinct, which gets direct MCP access. Zocdoc says agent traffic to its site is up nearly 30x since July.

What is missing: there is no pricing, no approval criteria, and no published timeline for approval. Healthcare Dive also notes that Zocdoc did not say how it will enforce the data rules.

Why agent booking matters for your business

The agent picks the business it can book. A patient asks Gemini for a dermatologist on Tuesday. The agent does not call five offices. It books through the system that answers in JSON. If you run a clinic, a salon, a shop or a home-service crew, the same logic will reach your category.

Consent is the pattern to copy. Zocdoc did not just open the API. It said who can come in (registered agents), what they must do (get consent), and what they cannot do (train or resell). Write those three rules for your own booking endpoint before you open it.

Identify the bots you let in. "Agents that register" is a policy you can enforce. Anonymous scraping is not. Give partner agents their own keys and rate limits, and log every booking they make.

Sources: Zocdoc via PR Newswire, Healthcare Dive.