Skip to content

API & AI-tool access (MCP)

QStack has a REST API and an MCP endpoint so scripts and AI assistants — Claude Code, Claude Desktop, and any other MCP-capable tool — can search, read, and drive quality workflows on your behalf.

Both use the same access token and both are scoped the way the web app is: a token sees exactly what its owner sees, in its owner's organisation only.

Both are switched off until your organisation turns them on

An administrator enables the REST API and AI assistant access separately, in Organisation settings. Until then every request is refused, whatever token it carries. They are separate switches because they carry different risks — see What leaves the system.

The token acts as you

Anything done with your token is recorded in the audit trail under your name, marked as having come through the API rather than from you at a keyboard. Treat the token like your password: don't share it, don't commit it to a repository, and revoke it if it may have leaked. Reader-role accounts stay read-only through the API too.

A token can never sign anything

Approving a document or a record needs a signature from you, in person, every time. No script and no assistant can approve on your behalf — the system refuses it, whatever the token is allowed to do.

Getting a token

Generate your own from the navbar: open your avatar menu and choose API token, then Generate token. The page shows the key to copy, and lets you Regenerate (the old key stops working immediately) or Revoke it at any time.

A few things worth knowing:

  • Tokens expire. The page shows the expiry date; generate a new one when it passes.
  • Tokens are read-only by default. Tick Allow this token to change records when generating if your script or assistant needs to move things through a workflow. Leave it off for anything that only reads.
  • Your account must be linked to a person record. Everything a token does is attributed to the person behind it, so there are no service accounts — a shared or unattended identity cannot hold a token. If your account is not linked, ask an administrator.
  • The page shows when the token was last used. A token you do not recognise having been used is worth revoking.

What leaves the system

The API and MCP return the structured fields of a record: numbers, titles, statuses, dates, owners, classifications and file hashes. They deliberately do not return record bodies, extracted or OCR'd document text, complaint narratives, investigation summaries, or direct links to stored files.

That matters most for MCP. When an assistant reads your data, what it reads reaches whichever model provider is behind that assistant — so an administrator should treat that provider as a sub-processor under their own data-protection arrangements before enabling it.

If you need the full text of a document or record, open it in QStack. Files are served through the application so their integrity is verified on the way out; the API does not hand out storage links that would skip that check.

The REST API

The API lives at /api/v1/ on your organisation's usual QStack address, and authenticates with a Bearer header:

curl -H "Authorization: Bearer $TOKEN" \
  "https://<your-org-address>/api/v1/documents/?status=effective&q=gowning"

Available resources: documents, records, deviations, capas, changes, complaints, vendors, audits, people, and training-requirements. Each supports listing (with ?status= and ?q= filters), detail by id, and — where the object has a lifecycle — a POST …/<id>/transition/ action that moves it through the same guarded workflow as the web UI.

Interactive API documentation

The full OpenAPI reference is served by the app itself (log in first, or send your Bearer token):

  • /api/v1/docs/ — browsable Swagger documentation of every endpoint, with request and response shapes and a try-it-out console.
  • /api/v1/schema/ — the raw OpenAPI schema, for code generators and AI tools.

Connecting an AI assistant (MCP)

The MCP endpoint is at /mcp. For Claude Code:

claude mcp add --transport http qstack \
  https://<your-org-address>/mcp \
  --header "Authorization: Bearer $TOKEN"

Your assistant then has these tools:

Tool What it does
search One search across all modules — the same cross-module search as the reporting page
list_objects List a resource with status/text filters
get_object Fetch one object with all its fields
transition_workflow Move an object through its lifecycle (e.g. send a draft document for review)
create_record_type Create a new internal-form record type from a description and publish its first version — the assistant writes the field schema for you

Tip

Ask things like "find every open deviation mentioning line 3" or "send the gowning SOP draft for review" — the assistant searches, reads, and transitions through the same role gates that apply to you in the browser.

What the API deliberately cannot do

Electronic signatures are never collected through the API. Signing always requires a fresh interactive ceremony in the browser (see Electronic signatures) — an automation or AI assistant can move a record to the point of signature, but a person must sign.