Norvya Partner API changelog

Care-site calls from an organisation that runs no sites (Behaviour change)

Sat, 17 Oct 2026 12:00:00 +0000

/v1/care-sites/* called by an organisation that is neither a pharmacy nor a care-facility operator now answers 409 not_a_care_site_operator (it answered not_a_pharmacy). /v1/pharmacy/* still answers not_a_pharmacy. The care-site endpoints and the care_site.* webhooks moved to their own reference page, Care sites, from Pharmacy; paths, scopes and payloads are unchanged.

Care facilities run their own sites through the API (Added)

Sat, 17 Oct 2026 12:00:00 +0000

A care-facility operator (a nursing home, assisted living or group home organisation that runs its own sites in Norvya) can now hold every care_sites.* scope: GET /v1/care-sites and the census with each nursing-home resident's short_stay / long_stay, the MAR, rounds, medication incidents, incident and change-of-condition reports, care plans, emergency preparedness, admissions and family access, for the sites it owns only. The MAR and medication incidents need the resident's medicines shared with the facility; events, rounds, the care plan and family access do not, as in the app. Admissions and family invitations can be attested by the facility's admin or provider or by the site's own manager (GET /v1/care-sites/{site_ref}/attesting-staff). The care_site.* webhooks reach the facility for its own sites. pharmacy.* stays pharmacy-only, and a pharmacy named as a facility site's dispenser still does not reach that site through its API. The facility's own BAA is required (409 care_facility_baa_required). New sandbox kind care_facility: a nursing home (snf_nf, 120 beds as recorded) with short- and long-stay residents. No MDS 3.0 assessment, PDPM coding or CMS submission.

Hospice agencies (Added)

Sat, 17 Oct 2026 12:00:00 +0000

A hospice agency can read its census, one patient's hospice record (levels of care, the benefit period and the recertification and face-to-face dates computed from the dates its staff recorded), the IDG plan-of-care reviews due and planned versus completed visits by discipline (hospice.read / hospice.visits.read; hospice agencies only, BAA on file). A visit is missed only when it was recorded not done. Never a prognosis or an eligibility statement. Webhook hospice.idg_review_due, about the agency (no member_ref), once a UTC day.

Nursing homes as a care-site type (Added)

Sat, 17 Oct 2026 12:00:00 +0000

A pharmacy's sites can now be nursing homes: GET /v1/care-sites returns site_type nursing_home alongside assisted_living and group_home (site_types lists all three) and, for a nursing home, licensure_kind (snf | nf | snf_nf) and licensed_beds as the operator recorded them (null elsewhere; Norvya verifies neither). The census and an admission's answer carry each resident's stay_type (short_stay | long_stay, null when not recorded), and POST /v1/care-sites/{site_ref}/residents accepts an optional stay_type at a nursing home (422 not_a_nursing_home elsewhere). Same endpoints and scopes; no MDS assessment, PDPM coding or CMS submission.

GET /v1/panel/worklist now applies staff triage (Behaviour change)

Fri, 16 Oct 2026 12:00:00 +0000

Items your staff (or your system) dismissed, snoozed or marked done are hidden by default; pass include_triaged=true to get them back with their triage state.

Medical travel inquiry desk and the journey thread (Added)

Fri, 16 Oct 2026 12:00:00 +0000

Travel desks can run the pre-journey inquiry desk from their own CRM: create an inquiry by your own external_id, edit it and link a patient on your roster, issue or revise its quote (each an immutable Good Faith Estimate version), move it through the desk's statuses and convert an accepted inquiry to a care journey that waits for the patient's acceptance (travel.inquiries.read / travel.inquiries.write; convert also needs travel.journeys.write). The journey's in-app thread with the patient and the caregiver they approved can be read and posted in as your system, never as a person (travel.messages.read / travel.messages.write; posts are refused until the patient accepts). Webhooks travel.inquiry_updated and travel.journey_message_posted, PHI-free.

Wound logs no longer carry measurements (Behaviour change)

Fri, 16 Oct 2026 12:00:00 +0000

Breaking: fields removed. GET /v1/patients/{member_ref}/wounds and GET /v1/patients/{member_ref}/derm-wounds no longer return area_reduction_pct on a wound or measurements (length_cm, width_cm, depth_cm, area_cm2, perimeter_cm) on an assessment: they are the wound tracker's image-based estimates, not a clinician's measurement. Each wound keeps its reference, body location, case type, first and last assessment, the assessment count and series, which now lists each assessment's date (assessed_at) only.

Wound logs no longer carry the wound model's classification (Behaviour change)

Fri, 16 Oct 2026 12:00:00 +0000

Breaking: fields removed. GET /v1/patients/{member_ref}/wounds and GET /v1/patients/{member_ref}/derm-wounds no longer return wound_type, latest_stage or latest_trajectory on a wound, or pressure_ulcer_stage, severity_level, healing_trajectory or tissue (tissue percentages) on an assessment: the wound classifier is not validated. Each wound keeps its reference, body location, case type, assessment dates and count, the measurement series (length, width, depth, area, perimeter) and area_reduction_pct.

Browser calls to /v1 need a sandbox token (Behaviour change)

Fri, 16 Oct 2026 12:00:00 +0000

/v1 no longer answers cross-origin browser requests in general. Only https://norvya.health may call it from a browser, and only with a sandbox token; a browser call from there with any other token is refused with 403 cors_sandbox_token_required before it runs. Server-to-server calls (no Origin header) are unchanged.

Try it from the reference, and a status page (Added)

Fri, 16 Oct 2026 12:00:00 +0000

Operations with no body or a JSON body have a "Try it" panel that calls the API from your browser with a sandbox token (kept in that tab only). The status page checks the public health endpoints from your browser; it is not an SLA.

Code samples, more guides, Postman collection (Added)

Fri, 16 Oct 2026 12:00:00 +0000

Every operation has curl, Python and JavaScript samples generated from the spec. New guides on pagination, idempotency and time zones, HL7 v2, FHIR and Bulk Data, SMART and CDS Hooks, standards and terminologies, and going live. New pages: this changelog (with an RSS feed), trust, a Postman collection and llms.txt.

The developer site becomes a multi-page portal (Changed)

Fri, 16 Oct 2026 12:00:00 +0000

One page per product family, one per market and a set of guides, with search and redirects from the old single page. The OpenAPI spec gains its webhooks section, x-norvya-status and x-tagGroups.

Dermatology classifier audit row (Fixed)

Fri, 16 Oct 2026 12:00:00 +0000

The classifier's audit row would have failed if the classifier were ever switched on. It is still off.

Rehab, nutrition, behavioral health, oncology and dermatology (Added)