Developers & integrations
Part 11 semantics,
enforced at the API.
Every API caller obeys the same rules as the UI: auth, tenant resolution, role checks, e-signature gates. Compliance you can't code around.
What you build against today
A REST API that treats the audit trail as a first-class citizen.
REST over JSON
Predictable resources under /api: list, read, create, plus explicit domain actions (POST /api/audits/:id/assign-auditors). Success envelope { data, meta } with page/limit/total pagination, filtering and sorting.
JWT authentication
Token issued at login, carried as httpOnly cookie or Authorization: Bearer. Tenant, role and scope claims enforced on every request: authenticate → resolve tenant → role check → e-signature gate.
E-signature as an API primitive
Regulated writes accept signature credentials and a reason-for-change inline, or a pre-signed signature ticket. Part 11 semantics are enforced at the API layer, not the UI.
Diagnostic error envelope
Every 4xx carries a machine-readable code (RBAC_DENIED, ESIG_REQUIRED, STATE_TRANSITION_INVALID…) and a human hint. No bare "Forbidden".
Rate limits that tell you
Per-user and per-IP limits with X-RateLimit-Limit / Remaining / Reset headers on every response.
AI endpoints, same rules
AskHawk chat, retrieval, knowledge-base ingest and the plan-then-execute wizard are ordinary authenticated endpoints — with the citation guarantee applied.
The e-signature primitive
Signing a regulated record over the API — meaning and reason required, hash returned.
POST /api/audits/9f2c.../report/sign
Authorization: Bearer <jwt>
{
"signaturePassword": "••••••••",
"signatureMeaning": "APPROVED",
"reasonForChange": "Final report reviewed against evidence set E-114."
}
→ 200 { "data": { "status": "SIGNED", "signedBy": "maria@…", "recordHash": "sha256:ab41…" } }
→ 403 { "code": "ESIG_REQUIRED",
"details": { "hint": "This endpoint commits a regulated record. Supply signature credentials or a pre-signed electronicSignatureId." } }Integrations
We label integration status the same way we label module maturity — shipped means shipped.
Shipped
- openFDA public inspection & recall data
- Zoom & Microsoft Teams (remote audit sessions)
- S3-compatible object storage
- SMTP email
- DigiLocker (India document vault)
- OIDC-based sign-in
Planned
- Webhooks (HMAC-signed, at-least-once)
- Public OpenAPI portal + sandbox tenant
- SAML 2.0 SSO (Okta, Azure AD)
- LIMS connectors (LabWare, STARLIMS)
- ERP (SAP S/4HANA Quality)
- Auto-generated TypeScript & Python SDKs
Building against SmartHawk before the public API portal ships? We partner directly with early integrators — contract-first, with our engineers. Tell us what you need.
Integrating LIMS, ERP or a data lake?
Talk to the engineers who own the API contract.