Qualitum API and agent integration.

Start here

Machine-readable entry points

Everything below is served from the Qualitum production domain, unauthenticated, with permissive CORS.

Reference

Public endpoints

Base URL: https://qualitum.ai/api/v1. No authentication. Requests are rate limited per IP. Every response, success or failure, is JSON.

curl -s https://qualitum.ai/api/v1/health

curl -sX POST https://qualitum.ai/api/v1/gamp-category-check \
  -H 'Content-Type: application/json' \
  -d '{"description":"A LIMS configured with our sample workflows, user roles and business rules. No custom code."}'

{
  "category": 4,
  "categoryLabel": "Configured product",
  "confidence": "high",
  "ambiguous": false,
  "reasoning": "Signals of configuration - workflows, business rules, roles, parameters - place this in Category 4. ...",
  "matchedSignals": { "category3": 1, "category4": 4, "category5": 1 },
  "standard": "GAMP 5 (2nd Edition)",
  "disclaimer": "Indicative only - the production agent classifies against your full URS and SOP library, ..."
}

Request schema

Contract

JSON errors

Errors never return HTML. Every non-2xx response uses one envelope, with a stable machine-readable code, a human-readable message, an optional offending field, and a resolution telling the caller what to do next.

{
  "error": {
    "code": "invalid_request",
    "message": "Field 'description' is required and must be a string of at least 12 characters.",
    "field": "description",
    "resolution": "Describe the system: vendor product or in-house build, used as supplied, configured, or custom-developed.",
    "documentation": "https://qualitum.ai/docs/api"
  }
}

LLM tool use

Function calling

Each operation carries a unique operationId, a description written for a caller with no prior context, and typed request and response schemas with additionalProperties: false. That maps directly onto OpenAI, Anthropic and MCP tool definitions without hand editing.

{
  "name": "classifyGampCategory",
  "description": "Propose a GAMP 5 software category (3, 4 or 5) for a computerised system used in a GxP process, with confidence and reasoning.",
  "input_schema": {
    "type": "object",
    "properties": {
      "description": { "type": "string", "minLength": 12, "maxLength": 8000 }
    },
    "required": ["description"]
  }
}

Markdown content negotiation

Qualitum follows the acceptmarkdown.com convention. Send Accept: text/markdown to any page URL and the response body is markdown with Content-Type: text/markdown; charset=utf-8 and Vary: Accept, Accept-Encoding, so a CDN can never hand an agent the HTML variant by accident.

curl -sH 'Accept: text/markdown' https://qualitum.ai/platform/overview

404 behaviour

Nonexistent paths return a real HTTP 404 - never a 200 with an app shell - and the body carries a short markdown recovery block pointing at the sitemap, llms.txt and this page.

curl -s -o /dev/null -w "%{http_code}\n" https://qualitum.ai/no-such-path   # 404

Tenant APIs

Inside a deployment

The validation lifecycle APIs - requirements, protocols, executions, electronic signatures, deviations and the audit trail - run inside each customer's private single-tenant deployment, behind the customer's own perimeter and identity provider. They are not on the public internet by design: no customer GxP data leaves the tenant.

• Tenant OpenAPI specification and auth model: request from support@qualitum.ai.
• Integration surface and boundaries: integrations and technology.
• Platform validation evidence: documentation index.
• Security disclosure: security@qualitum.ai.