Changelog

New capabilities in the Carepatron Public API, newest first. Each entry is dated the day it took effect. An entry that releases an API version names it and links its page; everything else applies at every supported version - see API versions.

20 October 2026 - IP allowlists for API keys

An App can confine its API keys to the source addresses you list. In the Developer Console, an App's Security section takes up to 32 IPv4 and IPv6 ranges in CIDR notation. Once the list is non-empty, a request with any of the App's keys from an address outside it is refused with 403 ip_not_allowed. An empty list allows every address. Callers that reach the API over IPv6 need their IPv6 range listed.

19 October 2026 - Contacts

Read, create and change a workspace's contacts. A contact's email addresses, phone numbers and postal addresses are each a collection whose members are addressed by their own id, and its custom field values are addressed by the field's key.

• GET /providers/{providerId}/contacts - list contacts
• POST /providers/{providerId}/contacts - create a contact
• GET /providers/{providerId}/contacts/{contactId} - get a contact
• GET /providers/{providerId}/contacts/{contactId}/personal-details - get a contact's personal details
• PUT /providers/{providerId}/contacts/{contactId}/personal-details - replace a contact's personal details
• PUT /providers/{providerId}/contacts/{contactId}/archive - archive a contact
• PUT /providers/{providerId}/contacts/{contactId}/unarchive - unarchive a contact
• PUT /providers/{providerId}/contacts/{contactId}/trash - trash a contact
• PUT /providers/{providerId}/contacts/{contactId}/convert-to-client - convert a contact to a client

Email addresses:

• GET /providers/{providerId}/contacts/{contactId}/emails - list a contact's email addresses
• POST /providers/{providerId}/contacts/{contactId}/emails - add an email address to a contact
• GET /providers/{providerId}/contacts/{contactId}/emails/{contactEmailId} - get one of a contact's email addresses
• PUT /providers/{providerId}/contacts/{contactId}/emails/{contactEmailId} - replace one of a contact's email addresses
• DELETE /providers/{providerId}/contacts/{contactId}/emails/{contactEmailId} - remove one of a contact's email addresses
• PUT /providers/{providerId}/contacts/{contactId}/emails/{contactEmailId}/primary - make an email address the contact's primary one

Phone numbers:

• GET /providers/{providerId}/contacts/{contactId}/phone-numbers - list a contact's phone numbers
• POST /providers/{providerId}/contacts/{contactId}/phone-numbers - add a phone number to a contact
• GET /providers/{providerId}/contacts/{contactId}/phone-numbers/{contactPhoneId} - get one of a contact's phone numbers
• PUT /providers/{providerId}/contacts/{contactId}/phone-numbers/{contactPhoneId} - replace one of a contact's phone numbers
• DELETE /providers/{providerId}/contacts/{contactId}/phone-numbers/{contactPhoneId} - remove one of a contact's phone numbers
• PUT /providers/{providerId}/contacts/{contactId}/phone-numbers/{contactPhoneId}/primary - make a phone number the contact's primary one

Postal addresses:

• GET /providers/{providerId}/contacts/{contactId}/addresses - list a contact's postal addresses
• POST /providers/{providerId}/contacts/{contactId}/addresses - add a postal address to a contact
• GET /providers/{providerId}/contacts/{contactId}/addresses/{contactAddressId} - get one of a contact's postal addresses
• PUT /providers/{providerId}/contacts/{contactId}/addresses/{contactAddressId} - replace one of a contact's postal addresses
• DELETE /providers/{providerId}/contacts/{contactId}/addresses/{contactAddressId} - remove one of a contact's postal addresses
• PUT /providers/{providerId}/contacts/{contactId}/addresses/{contactAddressId}/primary - make a postal address the contact's primary one

Custom fields:

• GET /providers/{providerId}/contacts/custom-fields - list the contact custom field definitions
• GET /providers/{providerId}/contacts/custom-fields/{key} - get one contact custom field definition
• GET /providers/{providerId}/contacts/{contactId}/custom-fields - get a contact's custom field values
• PUT /providers/{providerId}/contacts/{contactId}/custom-fields - replace a contact's custom field values
• GET /providers/{providerId}/contacts/{contactId}/custom-fields/{key} - get one of a contact's custom field values
• PUT /providers/{providerId}/contacts/{contactId}/custom-fields/{key} - set one of a contact's custom field values

The reads need an API key with the contacts:read scope and the writes one with contacts:write, and the Developer Console offers both when you create a key. See Contacts, Email addresses, Phone numbers, Addresses and Custom fields in the API reference.

12 October 2026 - OpenAPI documents declare OpenAPI 3.2.1

The published OpenAPI documents, at every API version, now declare OpenAPI 3.2.1 where they declared 3.1.1. No request or response changed; a client generator has to support OpenAPI 3.2 to read them.

2 October 2026 - API version 2026-10-02

API version 2026-10-02 is released, with two breaking changes to what a contacts export's result takes in. Each applies to a result fetched at 2026-10-02:

• the result takes in the workspace's archived contacts as well as its active ones, each record flagged by its archived member, and archived contacts count toward the export's limit of 10,000 records;
• the result of a workspace whose custom fields exceed a bound this API publishes is refused with 409 and the code unsupported_resource_state, where 2026-05-01 serves its records with customFields: [].

API version 2026-05-01 is deprecated, and served until 2 October 2028. API versions says how to move.

2 October 2026 - Contacts export: dates stored as text arrive as stored

A custom field of type date can hold text that is not an ISO 8601 date and time, such as 07/09/2024, written by an import or another system. At every API version, an export record now carries such a value as the text it is stored as:

• a value this API used to read as a date, reading 07/09/2024 as the ninth of July, now arrives as its stored text rather than as an instant;
• a value nothing could read, which the export used to leave out of the record, now appears as its stored text.

A date stored as an ISO 8601 date and time still arrives as an instant. POST /providers/{providerId}/contacts/export is unchanged.

2 October 2026 - Contacts export: primary phone, archived state and custom fields

Each record in an export's result carries four more members:

• phone - the contact's primary phone number as stored, or null
• archived - whether the contact is archived
• isClient - whether the contact is one of the workspace's clients
• customFields - the contact's custom fields that hold a value, [] when none do and on every record of a workspace whose custom fields exceed a bound this API publishes: more than 50 served fields, a key over 256 characters or a choice field with more than 5,000 options

POST /providers/{providerId}/contacts/export is unchanged, and an export takes in active contacts, which are neither archived nor trashed.

A record's schema is closed, so a consumer validating export records against the previous contract refuses one carrying the new members. Validate against the current contract before reading an export.

21 July 2026 - Contacts export

Export a provider's contacts. Start a job, poll it until it succeeds or fails, then fetch the export from the URL a succeeded job returns.

• POST /providers/{providerId}/contacts/export - start an export job
• GET /providers/{providerId}/contacts/export/jobs/{jobId} - poll its status
• DELETE /providers/{providerId}/contacts/export/jobs/{jobId} - cancel a job that has not finished

Needs an API key with the contacts:export scope. See Contacts in the API reference.