Skip to content
Updates

Changelog

Release notes and updates for the xCures API and Portal.

October 29, 2026

What's New

The xCures® API adds an optional facilities list to subjects. It records where a patient has been treated. This change is not breaking, and there is no new API version.

  • A subject has an optional facilities list of up to 10 entries. Each entry has a required name and an optional city, state, and zipCode.
  • Create Subject V2 and Create Subjects (batch) accept facilities. Both return it when the request sent it.
  • Update Subject accepts facilities. Leave it out to keep the current list. Send an empty list to remove every facility. A facility sent again unchanged keeps its network matching.
  • Get Subject returns facilities, or an empty list when the subject has none. Each returned facility carries an id, created, and updated.
  • state is a two-letter code for a US state, DC, or a territory, in any case. zipCode is 12345 or 12345-6789.
  • A bad state or zipCode, a blank name, or more than 10 facilities is rejected with an error that names the field.
  • New schemas: SubjectDetail, SubjectFacility, CreateSubjectFacility, and UpdateSubjectFacility. Get Subject, Update Subject, and Create Subject V2 now return SubjectDetail, which adds facilities to the existing subject fields.

Why It Matters

  • You can tell xCures where a patient has been treated, and read it back, without a manual step.
  • Search Subjects, checklists, webhooks, and the v3 API are unchanged.
  • If you generate a client from the API spec, it gains a new response type for these three operations. Regenerate it to read facilities.

What You Need to Do

Nothing. Existing integrations keep working, and you can start sending facilities when ready.

October 28, 2026

What's New

The AI Agents page is updated. The API itself does not change.

  • The create-subject example sets options.initiateEhrQuery to false, and dispatching the query is its own step that the agent asks about first.
  • The page names the four checklist operations with method and path, and the two checklist fields removed on October 23, 2026.
  • The page lists each limit an agent works to, says which have no documented limit, and says what to do when one is reached. The concurrency ceiling is 10 requests in flight.
  • The token step shows the response fields and the content types the token endpoint accepts.
  • The page carries a last-reviewed date and the API version it was checked against, and lists this changelog as a source.

What You Need to Do

Nothing. Agents that read the page get the updated rules.

October 27, 2026

What's New

The xCures® API adds an endpoint that returns a checklist together with the questions of each of its items.

  • New endpoint returns a checklist with each item's questions: GET /api/v1/patient-registry/checklist/{checklistId}. The questions are the properties of the item definition version that an evaluation of the item uses now. The response isChecklistWithQuestions.
  • New schemas: ChecklistWithQuestions, ChecklistItemWithQuestions, and ChecklistItemProperty. Each question carries its key, name, type, sort order, whether it is grouped, and the values it is limited to, if any.

Why It Matters

  • You can read an evaluation's result by question name, type, and order instead of working them out yourself.
  • An evaluation answers the item definition version it was evaluated with. When that differs from the version the checklist now uses, read the checklist again.

What You Need to Do

This change is additive. Existing integrations keep working, and you can adopt the new endpoint when ready.

October 23, 2026

What's New

The xCures® API adds Care Team endpoints, an optional middle name on patient and application records, and removes two fields from checklist evaluation results.

  • New endpoint lists the care team members found in a patient's records, one entry per distinct provider: GET /api/v1/patient-registry/clinical-concepts/care_team. It supports paging, sorting, and filters for search term, date range, code, and code system. The response is ClinicalConceptCareTeamPaginationDto.
  • New endpoint returns a single care team member by ID: GET /api/v1/patient-registry/clinical-concepts/care_team/{id}. The response is ClinicalConceptCareTeamDto.
  • New schemas for Care Team: ClinicalConceptCareTeamDto, ClinicalConceptCareTeamCodeDto, and ClinicalConceptCareTeamPaginationDto.
  • Optional middleName field on Subject, CreateSubject, CreateSubjectV2, CreateSubjectResult, UpdateSubject, Application, CreateApplication, and CreateApplicationResponse.
  • Optional middle field on SubjectAdditionalName.
  • Removed eligibilitySatisfied from ChecklistEvaluationResult.
  • Removed meetsCriteria from ChecklistItemEvaluationResult.

Why It Matters

  • Care Team data gives integrators the providers involved in a patient's care without parsing source documents.
  • A middle name helps match patients more accurately and keeps names complete when you send them to xCures.
  • Checklist results no longer carry the two removed fields.

What You Need to Do

Care Team and middle name are additive. Existing integrations keep working, and you can adopt them when ready. Both middle name fields are optional, so you do not need to send them.

If your code reads eligibilitySatisfied from a checklist evaluation result or meetsCriteria from a checklist item result, stop reading them. Both fields are no longer returned.

August 19, 2026

What's New

The xCures API now publishes Agent Skills for AI coding agents. Each skill is a short, step-by-step guide to one workflow. An agent can follow the steps directly instead of inferring them from the OpenAPI reference.

  • New discovery endpoint returns the list of available skills: https://docs.xcures.com/.well-known/agent-skills/index.json
  • Five skills are available at launch:
    • Standard Treatment Workflow: register a new patient and retrieve their existing records from connected health information networks.
    • Bring Your Own Data (BYOD) Ingestion: upload records you already hold so xCures normalizes them into FHIR and Clinical Concepts.
    • Retrieval Only: retrieve raw documents from health information networks with no xCures processing.
    • Existing Patient / Requery: check whether a registered patient needs a fresh query, and dispatch one if so.
    • Bulk Patient Onboarding: register and query a large roster of patients at once, safely and with per-patient failure isolation.
  • Skills are public. No authentication is required to fetch them.

Why It Matters

AI coding agents increasingly help developers integrate with third-party APIs. Agent Skills give those agents a direct, accurate path for xCures' most common workflows. This reduces the guesswork and errors that come from inferring a multi-step process from reference documentation alone.

What You Need to Do

No action is required to use existing endpoints. To try it, point an AI coding agent at the discovery endpoint above, or read a skill directly from the API Introduction page.

May 13, 2026

What's New

The xCures Public API now supports direct PDF downloads for patient documents. A new endpoint returns a signed URL to download the PDF version of any document stored in the platform:

  • New GET /api/v1/patient-registry/document/{documentId}/pdf endpoint returns a fileName and a time-limited signedUrl for downloading the PDF version of a document.
  • Signed URLs are valid for 15 minutes from the time of the request.
  • The endpoint requires a valid ProjectId header and a Bearer token, consistent with all other document endpoints.

Why It Matters

Previously, retrieving a rendered PDF required navigating the document detail response and constructing download logic on the client side. This endpoint provides a direct, purpose-built path to a downloadable PDF, simplifying workflows that surface documents to end users, generate audit artifacts, or integrate with external document management systems.

What You Need to Do

No changes are required to existing integrations. To use the new endpoint, call GET /api/v1/patient-registry/document/{documentId}/pdf with your project credentials. Retrieve and use the signedUrl from the response within 15 minutes, as the URL expires after that window.

May 8, 2026

What's New

The xCures Public API is being updated to decouple Subject (Patient) Creation from Network Querying. Previously, a single call to POST /api/v1/patient-registry/subject or POST /api/v2/patient-registry/subject automatically triggered a network query. As an interim step toward full decoupling, both subject creation endpoints now accept an optional flag that lets you opt out of the implicit query.

Why It Matters

  • Greater flexibility: Patient creation and query timing can now be managed independently, providing better support for batch processing and other context-driven workflows.
  • Full auditability: Every action on a patient record is now an intentional, logged API call. Your audit trail shows exactly when a subject was created and when a query was initiated.
  • Improved error handling: Independent error reporting for each endpoint eliminates silent failures, making it straightforward to distinguish between subject creation and query issues.

What You Need to Do

No immediate action is required. Because options.initiateEhrQuery defaults to true, your existing integration will continue to behave as before without any changes.

To opt out of the automatic EHR query on subject creation (for example, in batch processing scenarios), pass options.initiateEhrQuery: false in your request body:

{
  "firstName": "David",
  "lastName": "Mann",
  "birthDate": "1965-03-12",
  "gender": "M",
  "email": "david.mann@example.com",
  "phoneNumber": "123-456-7890",
  "addressLine1": "123 Main St.",
  "addressLine2": "Apt 4B",
  "addressCity": "Minneapolis",
  "addressState": "MN",
  "addressPostalCode": "55401",
  "options": {
    "initiateEhrQuery": false
  }
}

The same options.initiateEhrQuery flag is also available on POST /api/v1/patient-registry/subject.

March 25, 2026

What's New

Checklists now include Thumbs Up / Thumbs Down rating and a Report message option directly on each result and justification response.

  • Thumbs Up / Thumbs Down: indicate whether a checklist response was accurate and helpful
  • Report a response: flag a result for high-stakes clinical review by the xCures team

Why It Matters

Checklists are only as useful as they are accurate. These controls give users a direct way to flag a result when something is off, whether the cause is missing clinical context, an incorrect qualification, or a justification that does not match the response.

Every piece of feedback feeds back into result quality, making checklists more reliable for the workflows that depend on them.

Questions or assistance: contact the xCures support team at help@xcures.com.

February 20, 2026

What's New

This release expands the public xCures API to make the platform easier to integrate with. The following capabilities are now supported, based on customer feedback:

  • New timestamp parameters on the Search Queries endpoint: createdFrom and createdTo
  • A Document Update endpoint that updates a limited set of properties on existing documents (document date, document location, and document name)
  • OpenAPI specification updates for the Document Search endpoint, in support of the next-generation Document Classifications release:
    • informationTypes was previously typed as an array of strings
    • It is now typed as Document Classifications (still an array of strings)

Why It Matters

This release consolidates API references, full request and response examples, user guides, and real-world use-case examples on a single site. The new documentation serves both technical and operational audiences. It reduces onboarding friction, clarifies workflow automation, and broadens adoption across healthcare applications.

For more information, contact your Customer Success Manager.

December 18, 2025

What's New

This release launches the public xCures API documentation site at https://docs.xcures.com. Legacy documentation now routes to the new site automatically.

Why It Matters

The new site consolidates API references, full request and response examples, user guides, and real-world use-case examples in one place. It serves both technical and operational audiences, reduces onboarding friction, and supports broader adoption across healthcare applications. Contact your Customer Success Manager for more information.

December 4, 2025

What's New

xCures now supports self-service API credential and token management for connected client applications.

Why It Matters

  • The new API credential management lets xCures customers self-manage API credentials and tokens for their connected client applications through the UI, in a more secure way
  • Existing customer credentials remain active for now, but the previous OAuth endpoint is no longer in public documentation. Existing credentials continue to work only with the previous OAuth endpoint
  • New credentials created with this release work only with the new /oauth/token endpoint. Provision new credentials with the self-service tool by following the steps below before January 2026. All pre-existing credentials are deactivated after that date.