Machine API and the MCP server: let your tools (and AI agents) talk to Veritome

Beyond the browser, Veritome speaks two machine dialects — a REST API for scripts and integrations, and an MCP server for AI assistants. Both authenticate with the same organisation-scoped API keys (see API keys and organisation data export for creating and revoking them; API access is a Growth-plan feature).

The REST API

The API is documented by a machine-readable OpenAPI 3.1 specification at /api/v1/openapi — point any client generator or API tool at it. The surface is deliberately compliance-shaped:

• Read endpoints for systems, incidents, evidence and risk items — enough to build dashboards or feed a GRC warehouse.
• Audit log reads with cursor pagination and a since parameter, built for SIEM ingestion — see Webhooks for the push-side counterpart.
• System intake: POST /api/v1/systems registers a system programmatically. Wire it to your procurement or architecture-review process and shadow AI gets a paper trail the moment someone requests a new tool.

Every request is authenticated, org-scoped and audit-logged like any user action.

The MCP server

The Model Context Protocol is the emerging standard for giving AI assistants controlled access to tools. Veritome's MCP server lives at POST /api/mcp and exposes a small, deliberate toolset: list systems, obligations, incidents, evidence and risk items, query the audit log, and register a system.

Connect it to an MCP-capable assistant (Claude, or anything else that speaks the protocol) with your API key, and you can ask questions like "which of our high-risk systems have overdue obligations?" or "file an intake for the new support chatbot" — answered from your live data, under your key's permissions, with every call landing in the audit log.

Two properties worth knowing before you wire an agent up:

• The server is stateless and org-scoped. The assistant sees exactly what the API key sees — one organisation, nothing else.
• Reads dominate. The only write tool is system intake — an agent can't complete obligations, change classifications or touch evidence on your behalf. Compliance decisions stay with people.

Which to use

Scripts, pipelines, SIEM: the REST API. Conversational access from an AI assistant your team already uses: MCP. They're the same data behind the same keys — pick per consumer, not per project.