Changelog

​

Added

• EHR action catalog (read-only). GET /ehr/actions and GET /ehr/actions/{actionName} list what HealOS can do in each connected EHR, with inputs, outputs and a safety box per action. GET /ehr/connections shows which EHRs your organization has connected (status only, never credentials). All three need the new ehr:read scope. See EHR actions. Running actions through the API is not available yet. These three endpoints are rolling out: until they reach your environment they return 404.

​

Changed

• Keys follow their creator’s admin role. A key works only while the admin who created it is still an admin of the organization. Removing that person from the organization, or making them a non-admin, turns their keys off (401). Create production keys from an admin account that will stay in place.
• Stricter organization isolation. Appointments, notes on sessions with no patient yet, session reassignment and templates are always limited to the key’s organization, including for clinicians who belong to more than one organization. Older appointments that have no organization are visible only to their patient’s organization, and updating another organization’s appointment returns 404.
• Input limits. These reject some requests that were accepted before. See Rate limiting.
  • limit is at most 100; larger values are treated as 100. A page or limit that is not a positive whole number returns 400 instead of being ignored.
  • JSON bodies up to 1 MB, document uploads up to 10 MB and audio uploads up to 100 MB. Larger bodies return 413.
  • Uploaded documents and audio are checked by their content. A file whose content doesn’t match its type returns 400, for example a HEIC photo renamed to .jpg.

​

Fixed

• For a few hours after the input limits went live, a request sent without a body, which includes every DELETE (delete a patient, document or appointment), could fail with 500. Fixed the same day; no change is needed on your side.

​

CLI

• @healos/cli 0.1.0 is on npm: sign in from the browser (healos login, read-only by default), and a command for every API operation, with --json output for scripts and AI agents. See HealOS CLI.
• 0.1.1 changes only how the package is built and published. Commands and output are the same as 0.1.0.

• GET /me returns the organization, scopes and expiry of the calling key. It works with any valid key, whatever its scopes. See Check your key.

• POST /notes/from-text and POST /notes/from-audio generate a note from a transcript or a recording. Both answer 202 with a session_id. Each call uses one Scribe session from the organization’s plan.
• PATCH /sessions/{sessionId} files a session and its notes under a patient.
• Notes include model, the note quality (fast, balanced or detailed) that produced them.
• Prior authorization: GET /prior-auth/requests, GET /prior-auth/requests/{requestId}, GET /prior-auth/requests/{requestId}/events, GET /prior-auth/workflows and POST /prior-auth/status-checks, with the prior_auth:read and prior_auth:write scopes. See Prior authorization.

• Validation errors return 400 with error: "Validation error" and a details object keyed by field. See Error catalog.
• POST /patients/{patientId}/notes/from-documents uses the organization’s default template when you don’t send template_id.
• Eligibility checks name the missing fields when a required field is left out.

• GET /templates lists the templates your organization can generate notes with.
• GET /sessions/{sessionId} returns a session’s details.
• POST /patients/{patientId}/notes/from-documents writes a note from a patient’s uploaded documents (202).
• Eligibility checks: POST /benefits/eligibility-checks, GET /benefits/eligibility-checks, GET /benefits/eligibility-checks/{checkId} and GET /benefits/payers/search, with the benefits:read and benefits:write scopes. See Benefit verification.
• POST /sessions/{sessionId}/notes/regenerate accepts only the note quality choices offered in the dashboard (fast, balanced, detailed) for model.

• Webhooks for DOCUMENT_STATUS_CHANGED, NOTE_CREATED, NOTE_REGENERATED and NOTE_UPDATED. Payloads carry ids and a URL to fetch, not content. See Webhooks.
• POST /sessions/{sessionId}/notes/regenerate queues a fresh note (202). Send an Idempotency-Key header so a retried request doesn’t start a second regeneration.

• Patients carry first and last name, date of birth, gender, phone, email, address and MRN, and GET /patients?q= searches them. MRN is optional.
• POST /patients/{patientId}/documents/{documentId}/extract starts or retries text extraction.
• Document upload returns as soon as the file is stored; text extraction runs in the background. Follow it on the document’s status.
• Invalid appointment input returns a 400 that names the problem.

• GET /notes, GET /notes/{noteId}, GET /notes/export and GET /sessions/{sessionId}/notes read and export clinical notes, with the notes:read scope. See Clinical notes.
• GET /providers and GET /providers/{providerId} list your organization’s clinicians, with the providers:read scope.

• Patients, appointments and documents accept your own external_id, unique in the organization, and can be looked up with ?external_id=. See External IDs.

• The HealOS API at https://api.healos.ai/ext-api/v1: patients, patient documents and appointments, with organization API keys (X-API-Key), scopes, pagination and rate limits.
• Patient ids are opaque numeric strings generated by HealOS. Store them as strings.