Norvya DevelopersChangelog
What changed in the Partner API, newest first. v1 only gets additive changes; anything that changes what an existing call returns or accepts is flagged Behaviour change. Breaking changes ship as /v2 with notice (versioning).
Care-site calls from an organisation that runs no sites Behaviour change
/v1/care-sites/* called by an organisation that is neither a pharmacy nor a care-facility operator now answers 409 not_a_care_site_operator (it answered not_a_pharmacy). /v1/pharmacy/* still answers not_a_pharmacy. The care-site endpoints and the care_site.* webhooks moved to their own reference page, Care sites, from Pharmacy; paths, scopes and payloads are unchanged.
Care facilities run their own sites through the API Added
A care-facility operator (a nursing home, assisted living or group home organisation that runs its own sites in Norvya) can now hold every care_sites.* scope: GET /v1/care-sites and the census with each nursing-home resident's short_stay / long_stay, the MAR, rounds, medication incidents, incident and change-of-condition reports, care plans, emergency preparedness, admissions and family access, for the sites it owns only. The MAR and medication incidents need the resident's medicines shared with the facility; events, rounds, the care plan and family access do not, as in the app. Admissions and family invitations can be attested by the facility's admin or provider or by the site's own manager (GET /v1/care-sites/{site_ref}/attesting-staff). The care_site.* webhooks reach the facility for its own sites. pharmacy.* stays pharmacy-only, and a pharmacy named as a facility site's dispenser still does not reach that site through its API. The facility's own BAA is required (409 care_facility_baa_required). New sandbox kind care_facility: a nursing home (snf_nf, 120 beds as recorded) with short- and long-stay residents. No MDS 3.0 assessment, PDPM coding or CMS submission.
Hospice agencies Added
A hospice agency can read its census, one patient's hospice record (levels of care, the benefit period and the recertification and face-to-face dates computed from the dates its staff recorded), the IDG plan-of-care reviews due and planned versus completed visits by discipline (hospice.read / hospice.visits.read; hospice agencies only, BAA on file). A visit is missed only when it was recorded not done. Never a prognosis or an eligibility statement. Webhook hospice.idg_review_due, about the agency (no member_ref), once a UTC day.
Nursing homes as a care-site type Added
A pharmacy's sites can now be nursing homes: GET /v1/care-sites returns site_type nursing_home alongside assisted_living and group_home (site_types lists all three) and, for a nursing home, licensure_kind (snf | nf | snf_nf) and licensed_beds as the operator recorded them (null elsewhere; Norvya verifies neither). The census and an admission's answer carry each resident's stay_type (short_stay | long_stay, null when not recorded), and POST /v1/care-sites/{site_ref}/residents accepts an optional stay_type at a nursing home (422 not_a_nursing_home elsewhere). Same endpoints and scopes; no MDS assessment, PDPM coding or CMS submission.
GET /v1/panel/worklist now applies staff triage Behaviour change
Items your staff (or your system) dismissed, snoozed or marked done are hidden by default; pass include_triaged=true to get them back with their triage state.
Medical travel inquiry desk and the journey thread Added
Travel desks can run the pre-journey inquiry desk from their own CRM: create an inquiry by your own external_id, edit it and link a patient on your roster, issue or revise its quote (each an immutable Good Faith Estimate version), move it through the desk's statuses and convert an accepted inquiry to a care journey that waits for the patient's acceptance (travel.inquiries.read / travel.inquiries.write; convert also needs travel.journeys.write). The journey's in-app thread with the patient and the caregiver they approved can be read and posted in as your system, never as a person (travel.messages.read / travel.messages.write; posts are refused until the patient accepts). Webhooks travel.inquiry_updated and travel.journey_message_posted, PHI-free.
Wound logs no longer carry measurements Behaviour change
Breaking: fields removed. GET /v1/patients/{member_ref}/wounds and GET /v1/patients/{member_ref}/derm-wounds no longer return area_reduction_pct on a wound or measurements (length_cm, width_cm, depth_cm, area_cm2, perimeter_cm) on an assessment: they are the wound tracker's image-based estimates, not a clinician's measurement. Each wound keeps its reference, body location, case type, first and last assessment, the assessment count and series, which now lists each assessment's date (assessed_at) only.
Wound logs no longer carry the wound model's classification Behaviour change
Breaking: fields removed. GET /v1/patients/{member_ref}/wounds and GET /v1/patients/{member_ref}/derm-wounds no longer return wound_type, latest_stage or latest_trajectory on a wound, or pressure_ulcer_stage, severity_level, healing_trajectory or tissue (tissue percentages) on an assessment: the wound classifier is not validated. Each wound keeps its reference, body location, case type, assessment dates and count, the measurement series (length, width, depth, area, perimeter) and area_reduction_pct.
Browser calls to /v1 need a sandbox token Behaviour change
/v1 no longer answers cross-origin browser requests in general. Only https://norvya.health may call it from a browser, and only with a sandbox token; a browser call from there with any other token is refused with 403 cors_sandbox_token_required before it runs. Server-to-server calls (no Origin header) are unchanged.
Try it from the reference, and a status page Added
Operations with no body or a JSON body have a "Try it" panel that calls the API from your browser with a sandbox token (kept in that tab only). The status page checks the public health endpoints from your browser; it is not an SLA.
Code samples, more guides, Postman collection Added
Every operation has curl, Python and JavaScript samples generated from the spec. New guides on pagination, idempotency and time zones, HL7 v2, FHIR and Bulk Data, SMART and CDS Hooks, standards and terminologies, and going live. New pages: this changelog (with an RSS feed), trust, a Postman collection and llms.txt.
The developer site becomes a multi-page portal Changed
One page per product family, one per market and a set of guides, with search and redirects from the old single page. The OpenAPI spec gains its webhooks section, x-norvya-status and x-tagGroups.
Dermatology classifier audit row Fixed
The classifier's audit row would have failed if the classifier were ever switched on. It is still off.
Rehab, nutrition, behavioral health, oncology and dermatology Added
Rehab episodes and goals, dietitian caseloads and MNT, measurement-based behavioral care and Collaborative Care, oncology treatment summaries, and dermatology lesion tracking and assessments. The skin classifier is built but switched off: it answers 409 skin_classifier_not_enabled everywhere.
Rehab (PT / OT / speech), Nutrition (dietitians), Behavioral health, Oncology, Dermatology, Skin AI (switched off)
Rosters, older adults, life stages, employers and med spas Added
POST /v1/rosters for bulk enrolment (with a decline link in every invitation); older adults (falls tier, care dyads) and life stages; employer programmes and occupational health; med-spa clearances, treatments and aftercare. Webhooks roster.enrolment_summary, older_adults.falls_tier_raised, employer.challenge_completed, occupational.exam_due and medspa.adverse_event_reported.
Enrolment roster, Older adults, Life stages, Employers & occupational health, Med spas
Practice operations, hospital at home, pharmacy, medical travel and the patient record Added
Concierge reports, the morning brief, outreach drafts and specialty checks; fitness retention and trainer notes; hospital at home (NEWS2), days at home and wound metadata; pharmacy and care sites; medical travel; and GET /v1/patients/{member_ref}/record (a FHIR R4 Bundle), documents and questionnaire batches.
Practice operations & reports, Specialty care, Hospital at home, days at home & wounds, Pharmacy, Medical travel, Records & documents
Member data in, questionnaires, enrolment and messaging, claims in Added
Observations and workouts in (and retraction), the questionnaire registry with instrument requests and scores, invitations, join codes and in-app messages, and staged CCLF and plan claims imports. Webhooks instrument.completed, member.joined, message.received and claims.import_completed.
Member data in: observations and workouts, Clinical intelligence, Enrolment & messaging, Claims in
Worklist and loop write-back Added
Scopes clinical.panel.write and clinical.loops.write: worklist triage, results acknowledge / inform / action / close, referral status, Good Faith Estimate reissue and cancel, and the worklist.item_triaged webhook.
Practice management and billing Added
Appointments in both directions (PUT /v1/appointments/ext/{external_id}), care-management and billing candidates, and No Surprises Act Good Faith Estimates. Webhooks billing.threshold_met, appointment.booked and appointment.cancelled. Norvya sends no reminders for appointments that come from your system unless you ask.
Public-health reporting (built, gated) Added
Immunization registry submissions and queries, electronic case reporting and syndromic surveillance, with six public_health.* scopes. Sandboxes simulate every transmission; production needs the per-state agreements and onboarding described on the family page.
Care transitions Added
POST /v1/transitions/adt (HL7 v2 ADT over HTTPS), post-discharge episodes with a worklist and outcomes, and encounters with their Transitional Care Management windows. Webhooks patient.admitted, patient.discharged, patient.ed_visit, transition.episode_enrolled and transition.red_flag. Hospital sandbox.
Sandboxes Added
Synthetic-only sandbox organisations (practice, gym, EMR vendor), isolated from live data in both directions, with nvy_sbx_ client ids, their own lower rate limit, no billing and a 60-day expiry.
Population Added
Population summary with small-cell suppression, measures (marked certified false), QRDA Category III and asynchronous FHIR Bulk exports (identified with a BAA, or Safe Harbor de-identified), with the population.export_completed webhook.
EMR vendor tokens Added
One vendor credential across every practice that approves it in Norvya, with immediate revocation. GET /v1/practices, patient match, CDS Hooks-style cards and the brief as a FHIR DocumentReference.
Platform, EHR embedding: cards and chart documents, Clinical intelligence
Trainer guidance returns fewer fields Behaviour change
Guidance items now carry only rank, severity, title, detail and based_on, so drug-class codes are no longer exposed to fitness organisations.
Fitness intelligence Added
GET /v1/members/at-risk, POST /v1/members/{member_ref}/nudge (one nudge per member per 14 days) and the member.at_risk webhook; gyms can now hold webhooks.manage.
Practice workflow and the first webhooks Added
Panel worklist and runs, care gaps, between-visit signals and panel import (dry run, then commit or discard). Signed webhooks (Norvya-Signature, HMAC-SHA256) start with worklist.run_completed, patient.attention_needed, import.completed and import.failed.
The internal API map is no longer public Behaviour change
Production /docs, /redoc and /openapi.json are switched off. The public contract is this site and openapi-v1.json, generated from the /v1 router only.
Partner API v1 Added
OAuth 2.0 client credentials (one client per organisation, tokens of about 15 minutes, revocation checked on every call). First scopes members.read, fitness.guidance.read and clinical.brief.read (treating practices only), with GET /v1/members, member guidance, the pre-visit brief and GET /v1/usage. Members are addressed by an opaque member_ref or ext:<your id>. Every call is audited (refused with 503 if the audit log is down), metered and rate limited (429 with Retry-After).