Changelog

Changes to the API that callers should know about.

2 November 2026

GET /v1/me now says whether the person has an authenticator app enrolled (user.authenticator), so a client can offer the right step-up method first.

Published the OpenAPI 3.1 document at /api/openapi.json, generated from the server's own schemas, and these developer pages.
Sign-up, emailed sign-in links, password reset and verification emails now need a Cloudflare Turnstile token in x-turnstile-token.
Added GET /api/public-config, which returns the Turnstile site key.
Added the week roster routes (assign and publish).
Added organisation API keys with scopes.
Added webhooks with deliveries signed in Elavinya-Signature, with retries.
The OpenAPI document now describes the API key security scheme and the webhook payload schemas.

First platform release: cases, visits, medicines (eMAR), safeguarding, bookings and records routes.
Simulated NHS services on preview.

First deployment: sign-in (passkeys, emailed links, passwords with authenticator codes), organisations, invitations, roles, delegations, emergency access with step-up, and rate limits.