Release 10 – November 1, 2026

SSH Key Authentication for SFTP Destinations

The CAS API now supports SSH keys when creating subscriptions that deliver data and documents to an SFTP destination. This enhancement provides a more secure way to connect to your SFTP server.

To use SSH key authentication, include the following properties in your POST Subscription request:

• sftpUser: the username used to connect to your SFTP server.
• sftpSshPrivateKey: the new property for providing the SSH private key.

Your SFTP server must be configured with the corresponding public key. For additional setup details, see the CAS API Swagger page.

Duplicate Prevention for Supporting Information

The CAS API's POST SupportingInfo "Jumpstart" endpoint now has uniqueness validation, checking for duplicates when adding achievements, experiences, and languages to an application. This enhancement helps prevent duplicate or inconsistent supporting information from being saved in CAS. The relevant section must be enabled in the application in order to post data. Note the following fields used to identify duplicate records:

• Achievements: records cannot have the same values for Type and Achievement Name.
• Experiences: records cannot have the same values for Type, Org Name, Job Title, and Start Date.
• Languages: records cannot have the same values for Native/ First Language.

See the CAS API Swagger page for more details.

Honoring Application Status at the Time of Subscription Events

Since an application's status can change between the time an event occurs and the time its data is delivered, the CAS API now includes two new fields that show the application and program status when a subscription event was triggered. These fields help you distinguish the status that triggered the event from the current status delivered through the API.

• applicationStatusOnEventTrigger: the application's status when the event was triggered.
• statusOnEventTrigger: the selected program's status when the event was triggered.

As the delay between event trigger and application delivery is typically between 0.5 seconds and 10 minutes, these new properties will help avoid potential confusion due to unexpected statuses.

Export Codes Now Supported to Populate Custom Question Answers

The CAS API's POST QuestionAnswers "Jumpstart" endpoint now supports export codes to identify answer options when populating custom question answers. This enhancement provides a more reliable way to select the intended answers through your integration.

The new "answerExportCodes" property accepts:

• Single values (e.g., ["currentApp"])
• Multi-select (e.g., ["AMEM","EMFM","EMPEDS","OBGYN"])

Export codes are available in the CAS API Data Dictionary. Use the Data Dictionary as your source for the values to include in your requests.

See the CAS API Swagger page for more details.

Replay Subscription Events Across Your CAS Instance

The CAS API now supports instance-level Replay, which allows you to request the resending of business events generated via instance-level subscriptions. The new instance-level endpoint will appear under the "Replay" resource on the CAS API Swagger page. Note the following limitations:

• The maximum date range is 10 days. This is the time between the fromDate and toDate query parameters.
• The maximum replayable events are 20,000. If your request exceeds this limit, the API returns an error asking you to reduce the range.

See the CAS API Swagger page for more details.