Administration and compliance

API, MCP and integrations

Connect other systems: API keys with read or Q Agent task scopes, the read-only REST API with its OpenAPI description, the MCP server for AI assistants, and tool connectors Q Intelligence can call.

In the portal: /app/account/api

API keys

  1. Step 1: Open API & integrations (super administrators).
  2. Step 2: Name the key (e.g. the system it serves) and choose its access: Read (records, alerts and the regulatory library) or Read + Q Agent tasks (every action still waits for approval).
  3. Step 3: Choose the expiry (90 days recommended; up to 2 years or never). Copy the key: it is shown once and only its hash is stored.
  4. Step 4: Rotate a key with a grace period (the old key works for 1 hour to 7 days) or revoke it at once. The creator is emailed 7 days before expiry.

Tip: A key stops working when its creator is no longer a super administrator. Up to 20 active keys.

REST API and MCP

  • REST API at /api/v1: products, records (list, search, by ID or reference, with the audit trail), alerts, guidance search, Q Agent tasks and the audit trail. The OpenAPI description is at /api/v1/openapi.json for Power Automate, Zapier, Workato, MuleSoft or Postman. Records are read-only through the API.
  • MCP server at /api/mcp (streamable HTTP) for AI assistants and internal agents: list, search and read records, search and read guidance, list alerts, and start Q Agent tasks with the tasks scope.
  • Tool connectors: super administrators add MCP servers (up to 10) that Q Intelligence can call for everyone in the organization; tokens are stored encrypted.