Changelog

Versioning policy

Within v1, changes are additive only: new endpoints, new optional request fields, new response fields. Build your client to ignore unknown fields.
Breaking changes (removing/renaming fields, changing types or semantics) ship as /api/public/v2 — never inside v1.
Deprecations are announced here at least 90 days before any removal, which can only happen in a new major version.
The canonical history lives in the repository at docs/public-api/CHANGELOG.md; this page mirrors it with every release.

Stricter phone validation on patient create / PATCH contact (bugfix, not a shape change): values that cannot be a phone number are now rejected with 422 validation_failed instead of being stored. Anything normalizable to E.164 (national 07xx…, spaces/punctuation, +/00 international) is still accepted, unchanged.

Initial release of /api/public/v1: locations, doctors, services, availability, patients (contact-only, masked reads), appointments (book/cancel/reschedule through the shared scheduling engine), invoices (issued, read-only).
API keys with granular scopes, per-key sliding-window rate limiting, rotation with 24h grace.
Signed webhooks (HMAC-SHA256, replay-protected) for appointment, patient, invoice and lab-order events, with retries, manual redelivery and auto-disable.
No clinical data in v1 — by design.