> ## Documentation Index
> Fetch the complete documentation index at: https://docs.healos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> What changed in the HealOS API and the HealOS CLI, newest first

Changes to the HealOS API (`/ext-api/v1`) and the [`healos` CLI](https://docs.healos.ai/cli),
newest first. Additive changes, such as new endpoints and new response fields,
ship without notice and are listed here. Breaking changes are announced here in
advance; see [Versioning and deprecation](https://docs.healos.ai/versioning.md).

**October 27, 2026**

Key ownership, input limits, EHR catalog, CLI

### Added

* **EHR action catalog (read-only).** `GET /ehr/actions` and
  `GET /ehr/actions/{actionName}` list what HealOS can do in each connected
  EHR, with inputs, outputs and a safety box per action.
  `GET /ehr/connections` shows which EHRs your organization has connected
  (status only, never credentials). All three need the new `ehr:read` scope.
  See [EHR actions](https://docs.healos.ai/ehr-actions/overview.md). Running actions through the API
  is not available yet. These three endpoints are rolling out: until they
  reach your environment they return `404`.

### Changed

* **Keys follow their creator's admin role.** A key works only while the
  admin who created it is still an admin of the organization. Removing that
  person from the organization, or making them a non-admin, turns their keys
  off (`401`). Create production keys from an admin account that will stay in
  place.

* **Stricter organization isolation.** Appointments, notes on sessions with
  no patient yet, session reassignment and templates are always limited to
  the key's organization, including for clinicians who belong to more than
  one organization. Older appointments that have no organization are visible
  only to their patient's organization, and updating another organization's
  appointment returns `404`.

* **Input limits.** These reject some requests that were accepted before.
  See [Rate limiting](https://docs.healos.ai/rate-limiting.md#request-size).
  * `limit` is at most 100; larger values are treated as 100. A `page` or
    `limit` that is not a positive whole number returns `400` instead of
    being ignored.
  * JSON bodies up to 1 MB, document uploads up to 10 MB and audio uploads
    up to 100 MB. Larger bodies return `413`.
  * Uploaded documents and audio are checked by their content. A file whose
    content doesn't match its type returns `400`, for example a HEIC photo
    renamed to `.jpg`.

### Fixed

* For a few hours after the input limits went live, a request sent without
  a body, which includes every `DELETE` (delete a patient, document or
  appointment), could fail with `500`. Fixed the same day; no change is
  needed on your side.

### CLI

* **`@healos/cli` 0.1.0** is on npm: sign in from the browser
  (`healos login`, read-only by default), and a command for every API
  operation, with `--json` output for scripts and AI agents. See
  [HealOS CLI](https://docs.healos.ai/cli.md).
* **0.1.1** changes only how the package is built and published. Commands
  and output are the same as 0.1.0.

**October 23, 2026**

GET /me

* `GET /me` returns the organization, scopes and expiry of the calling key.
  It works with any valid key, whatever its scopes. See
  [Check your key](https://docs.healos.ai/authentication.md#check-your-key).

**October 22, 2026**

Notes from text and audio, prior auth

* `POST /notes/from-text` and `POST /notes/from-audio` generate a note from a
  transcript or a recording. Both answer `202` with a `session_id`. Each call
  uses one Scribe session from the organization's plan.
* `PATCH /sessions/{sessionId}` files a session and its notes under a
  patient.
* Notes include `model`, the note quality (`fast`, `balanced` or `detailed`)
  that produced them.
* Prior authorization: `GET /prior-auth/requests`,
  `GET /prior-auth/requests/{requestId}`,
  `GET /prior-auth/requests/{requestId}/events`,
  `GET /prior-auth/workflows` and `POST /prior-auth/status-checks`, with the
  `prior_auth:read` and `prior_auth:write` scopes. See
  [Prior authorization](https://docs.healos.ai/prior-auth.md).

**October 21, 2026**

Validation errors

* Validation errors return `400` with `error: "Validation error"` and a
  `details` object keyed by field. See [Error catalog](https://docs.healos.ai/errors.md).
* `POST /patients/{patientId}/notes/from-documents` uses the organization's
  default template when you don't send `template_id`.
* Eligibility checks name the missing fields when a required field is left
  out.

**October 20, 2026**

Templates, sessions, notes from documents, eligibility

* `GET /templates` lists the templates your organization can generate notes
  with.
* `GET /sessions/{sessionId}` returns a session's details.
* `POST /patients/{patientId}/notes/from-documents` writes a note from a
  patient's uploaded documents (`202`).
* Eligibility checks: `POST /benefits/eligibility-checks`,
  `GET /benefits/eligibility-checks`,
  `GET /benefits/eligibility-checks/{checkId}` and
  `GET /benefits/payers/search`, with the `benefits:read` and
  `benefits:write` scopes. See [Benefit verification](https://docs.healos.ai/benefits.md).
* `POST /sessions/{sessionId}/notes/regenerate` accepts only the note
  quality choices offered in the dashboard (`fast`, `balanced`, `detailed`)
  for `model`.

**August 2026**

Webhooks and note regeneration

* Webhooks for `DOCUMENT_STATUS_CHANGED`, `NOTE_CREATED`, `NOTE_REGENERATED`
  and `NOTE_UPDATED`. Payloads carry ids and a URL to fetch, not content. See
  [Webhooks](https://docs.healos.ai/webhooks.md).
* `POST /sessions/{sessionId}/notes/regenerate` queues a fresh note (`202`).
  Send an `Idempotency-Key` header so a retried request doesn't start a
  second regeneration.

**July 2026**

Patient details, async uploads

* Patients carry first and last name, date of birth, gender, phone, email,
  address and MRN, and `GET /patients?q=` searches them. MRN is optional.
* `POST /patients/{patientId}/documents/{documentId}/extract` starts or
  retries text extraction.
* Document upload returns as soon as the file is stored; text extraction runs
  in the background. Follow it on the document's `status`.
* Invalid appointment input returns a `400` that names the problem.

**June 2026**

Clinical notes and providers

* `GET /notes`, `GET /notes/{noteId}`, `GET /notes/export` and
  `GET /sessions/{sessionId}/notes` read and export clinical notes, with the
  `notes:read` scope. See [Clinical notes](https://docs.healos.ai/clinical-notes.md).
* `GET /providers` and `GET /providers/{providerId}` list your
  organization's clinicians, with the `providers:read` scope.

**May 2026**

external\_id

* Patients, appointments and documents accept your own `external_id`,
  unique in the organization, and can be looked up with
  `?external_id=`. See [External IDs](https://docs.healos.ai/making-requests.md#external-ids).

**April 2026**

First release

* The HealOS API at `https://api.healos.ai/ext-api/v1`: patients, patient
  documents and appointments, with organization API keys (`X-API-Key`),
  scopes, pagination and rate limits.
* Patient ids are opaque numeric strings generated by HealOS. Store them as
  strings.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.