Changelog

What Shipped, And What It Fixed.

Every release of @clinikapi/sdk and @clinikapi/react, and the API changes behind them. Breaking changes and security fixes are called out, not buried.

API

Request handling hardened.

  • Security

    Method-override headers are rejected

    A request carrying X-HTTP-Method-Override (or X-HTTP-Method / X-Method-Override) was executed as the overridden method, so a read could perform a write. These headers are now refused with 400 and METHOD_OVERRIDE_REJECTED. Send the method you mean — the SDK never sent these headers, so no SDK caller is affected.

  • Fixed

    A body that is not JSON returns 400, not 500

    A truncated payload, an XML body or a form-encoded post produced a 500, telling you the server had failed when the request was simply malformed. These now return 400 with INVALID_JSON.

  • Fixed

    Page size is enforced instead of forwarded

    count is now clamped to the documented range (default 20, max 100) and a non-numeric cursor starts from the beginning, rather than being passed through and rejected further down.

  • Changed

    Error messages no longer carry internal detail

    Upstream errors were surfaced verbatim, which exposed infrastructure naming in ordinary 400 responses. Messages are now sanitized at the boundary — the part that tells you what to fix is kept, the rest stays in our logs.

v0.3.1

Every widget writes, every resource updates.

  • @clinikapi/react
  • @clinikapi/sdk
  • Fixed

    Five widgets could not save at all

    AllergyRecorder and CarePlanBuilder sent category as a string where the API takes an array; ConsentManager omitted the policy every FHIR Consent requires; AppointmentScheduler sent a start with no end; PrescriptionWidget wrote to the medication catalog instead of prescribing. All five now write correctly.

  • Fixed

    Two widgets silently dropped what you typed

    VitalsWidget collected heart rate and blood pressure and then stored an observation with no values. GoalSetter dropped the target due date. Both now persist everything the form captures.

  • Fixed

    Searching by patientId now filters correctly

    Allergy, immunization, consent and appointment searches ignored the patientId filter and returned results beyond the patient you asked for. They are now correctly scoped — re-run any query whose results you relied on.

  • Fixed

    Updates work on every resource type

    Updating a field that had not been set when the record was created failed. Update now succeeds across all 62 resource types.

  • Fixed

    Reading a deleted record returns 404

    A deleted record returned a 410 with an unhelpful message. It now returns a clean 404, the same as a record that never existed.

  • Changed

    Eligibility responses require requestId

    CoverageEligibilityResponse.request is mandatory in FHIR, so a create without requestId was always rejected. It is now required by the API schema and the SDK type, so the mistake surfaces at compile time.

  • Added

    Every resource type verified before release

    Create, read, update, search, delete and read-after-delete are now exercised end to end across all 62 resource types ahead of each release.

v0.3.0

Widgets rebuilt on shadcn/ui, tenant isolation hardened.

  • @clinikapi/react
  • @clinikapi/sdk
  • Security

    Tenant isolation hardened across every access path

    Ownership is now verified on every read, update and delete, including records pulled in alongside a request. A resource belonging to another tenant is indistinguishable from one that does not exist.

  • Changed

    All 14 widgets rebuilt on shadcn/ui

    The component library ships a stylesheet you import once. Themes are light, dark, glassmorphism, or inherit from your own design tokens. This is a breaking visual change from 0.2.x.

  • Fixed

    Patient names no longer dropped, SDK types made honest

    Name text and middle names were discarded, so patient lists rendered "Unnamed". The SDK types also described a different shape from what the API returns.

  • Fixed

    Bulk export download links are signed

    Export links were returned unsigned and could not be used to retrieve a file.

  • Fixed

    CapabilityStatement declares all 62 resource types

    The published FHIR capability document listed 14 of the 62 types the API actually serves.

v0.2.2

The SDK works outside a bundler.

  • @clinikapi/react
  • @clinikapi/sdk
  • Fixed

    Response envelope and packaging

    Every call returned the raw body instead of unwrapping the response envelope, so data.id was undefined and lists nested one level too deep. The package also shipped bundler-only, failing on a plain Node import or require. Both packages now ship dual ESM and CommonJS builds.

Staying current

Both packages follow semantic versioning. API changes are additive unless listed as breaking here — new fields may appear on responses, so parse defensively rather than pinning to an exact shape.

npm install @clinikapi/sdk@latest @clinikapi/react@latest

Ready To Transform Healthcare?

Join 500+ developers building the future of clinical workflows on ClinikAPI. Get your production keys in seconds.

Create Free Account View On GitHub