Skip to content

API & AI-tool access (MCP)

QStack has a REST API and an MCP endpoint so scripts and AI assistants — Claude Code, Claude Desktop, and any other MCP-capable tool — can search, read, and drive quality workflows on your behalf.

Both use the same access token and both are scoped the way the web app is: a token sees exactly what its owner sees, in its owner's organisation only.

The token acts as you

Anything done with your token is recorded in the audit trail under your name, exactly like actions in the browser. Treat the token like your password: don't share it, don't commit it to a repository, and ask your administrator to revoke it if it may have leaked. Reader-role accounts stay read-only through the API too.

Getting a token

Generate your own from the navbar: open your avatar menu and choose API token, then Generate token. The page shows the key to copy, and lets you Regenerate (the old key stops working immediately) or Revoke it at any time.

(Administrators can also mint tokens in the Django admin under Auth Token → Tokens, or from the server with manage.py drf_create_token <email>.)

The REST API

The API lives at /api/v1/ on your organisation's usual QStack address, and authenticates with a Bearer header:

curl -H "Authorization: Bearer $TOKEN" \
  "https://<your-org-address>/api/v1/documents/?status=effective&q=gowning"

Available resources: documents, records, deviations, capas, changes, complaints, vendors, audits, people, and training-requirements. Each supports listing (with ?status= and ?q= filters), detail by id, and — where the object has a lifecycle — a POST …/<id>/transition/ action that moves it through the same guarded workflow as the web UI.

Interactive API documentation

The full OpenAPI reference is served by the app itself (log in first, or send your Bearer token):

  • /api/v1/docs/ — browsable Swagger documentation of every endpoint, with request and response shapes and a try-it-out console.
  • /api/v1/schema/ — the raw OpenAPI schema, for code generators and AI tools.

Connecting an AI assistant (MCP)

The MCP endpoint is at /mcp. For Claude Code:

claude mcp add --transport http qstack \
  https://<your-org-address>/mcp \
  --header "Authorization: Bearer $TOKEN"

Your assistant then has these tools:

Tool What it does
search One search across all modules — the same cross-module search as the reporting page
list_objects List a resource with status/text filters
get_object Fetch one object with all its fields
transition_workflow Move an object through its lifecycle (e.g. send a draft document for review)
create_record_type Create a new internal-form record type from a description and publish its first version — the assistant writes the field schema for you

Tip

Ask things like "find every open deviation mentioning line 3" or "send the gowning SOP draft for review" — the assistant searches, reads, and transitions through the same role gates that apply to you in the browser.

What the API deliberately cannot do

Electronic signatures are never collected through the API. Signing always requires a fresh interactive ceremony in the browser (see Electronic signatures) — an automation or AI assistant can move a record to the point of signature, but a person must sign.