Qualio Design Controls API
The Design Controls API from Qualio — 8 operation(s) for design controls.
OpenAPI Specification
openapi: 3.1.0
info:
title: Qualio Developer Design Controls API
version: '0.1'
description: "Whether you're streamlining document control, automating quality event management, integrating training records, or syncing supplier data across systems, the Qualio API provides secure and scalable solutions. Getting started is easy: generate an API key, authenticate your requests, explore example code, and start building. Follow the steps below to integrate with Qualio quickly and efficiently.\n\n This portal includes everything you need to build with confidence:\n- Secure, token-based authentication\n- Full reference documentation for each endpoint\n- Example code in multiple programming languages\n- \"Try it out\" functionality to test requests live\n- Fair usage rate limits to ensure system stability\n \n\n #### Generate Your API Key \n To access the API, you’ll need an API key:\n\n- Log in to the [Qualio admin panel](https://app.qualio.com/user-management/admin).\n\n- Navigate to Admin Settings > [Developer API tokens](https://app.qualio.com/user-management/admin/dev-api).\n\n- Click Create token and save the key securely.\n\n- Only users with administrative privileges can generate API keys. \n\n\n\nIf you don’t have admin access, please ask your Qualio administrator to create a key for you.\n \n\n #### Authenticate Your Requests\n\nQualio uses API key authentication using the X-Api-Key header. Add your API key in the authentication panel to the right to see examples of how to use it in a language of your choice.\n \n\n #### Make Your First API Call\n\nHere is an easy place to get started: [fetching all your effective documents](#tag/documents/GET/v1/documents/query)\n \n\n #### Respect Rate Limits\n\nTo ensure fair use and maintain performance, API requests are subject to rate limits:\n\n- Each API key has a request threshold of maximum 200 requests per minute\n- If you exceed this limit, you'll receive an HTTP 429 (Too Many Requests) response.\n- We recommend implementing retry logic in your client applications, if this is a concern for you.\n\n \n\n #### Explore and Build\nUse the navigation panel to browse available API endpoints, such as:\n- Documents — Create, query, and manage your controlled documents\n- User Management — Invite users, update roles, or sync user data\n- Audit Trail — Retrieve historical changes for compliance reporting\n- You’ll find example code in Python, JavaScript, C#, Ruby, PHP, Go, and Shell for each endpoint. Click “Try it out” to test requests directly from the browser.\n \n\n #### How is this API versioned? \n We prefix each URL with the major version of the API. Within this major version, we promise to not make any breaking changes, which are:\n - Changes to the datatype of request or response payload attribute. \n - Removal of an attribute or parameter. \n - Changes to a URL. \n\n We do not consider the following to be breaking changes: \n - Additional attributes on return payloads \n - Additional optional attributes on request payloads \n\n \n#### Where can I get an OpenApi spec for this? \n You can [find it here](/download-openapi), but bear in mind that this API is updated regularly, so be sure to fetch it afresh for the latest features\n"
servers:
- url: https://api.qualio.com
security:
- api_key: []
tags:
- name: Design Controls
paths:
/v1/design-controls/products:
get:
summary: List products
description: 'Lists the design control products in your Qualio instance. Design Controls (also called Product Development) is Qualio''s module for medical-device design control and traceability: each product groups the requirements, test cases, and risks that demonstrate it is properly designed, verified, and risk-managed (per FDA / ISO 14971). A product is identified by a UUID; use that id with the requirements, test-case, risk, and test-result endpoints. Returns each product''s id, name, and tag ids.'
operationId: listDesignControlProducts
tags:
- Design Controls
security:
- api_key: []
responses:
'200':
description: Successful design controls products retrieval
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
name:
type: string
tag_ids:
type: array
items:
type: number
required:
- id
- name
- tag_ids
additionalProperties: false
total:
type: number
required:
- items
- total
additionalProperties: false
description: A list of design control products
example:
items:
- id: 123e4567-e89b-12d3-a456-426614174000
name: Cardio pump
tag_ids:
- 12
- 21
- 31
total: 1
'403':
description: This API key is not allowed to perform this action, or the API key is incorrect
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/genericForbiddenResponse'
'429':
description: This API key has exceeded the fair usage policy in Qualio, and has it its requests restricted. This request has not been processed
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/throttledResponse'
options:
description: 'Lists the design control products in your Qualio instance. Design Controls (also called Product Development) is Qualio''s module for medical-device design control and traceability: each product groups the requirements, test cases, and risks that demonstrate it is properly designed, verified, and risk-managed (per FDA / ISO 14971). A product is identified by a UUID; use that id with the requirements, test-case, risk, and test-result endpoints. Returns each product''s id, name, and tag ids.'
operationId: listDesignControlProductsOptions
tags:
- Design Controls
x-scalar-ignore: true
responses:
'200':
description: Options 200
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
/v1/design-controls/products/{productId}/test-cases:
get:
summary: List test cases
description: Lists the test cases for a design control product, identified by its UUID. A test case documents a verification procedure that proves one or more requirements are satisfied. Each item includes its id, auto-generated code (e.g. TC-1), title, type, change-control status, source, the traceability issues flagged by design-control policy (e.g. a failing or outdated test result), and its latest recorded test result.
operationId: listProductTestCases
tags:
- Design Controls
security:
- api_key: []
parameters:
- in: path
name: productId
schema:
$ref: '#/components/schemas/dcProductId'
required: true
description: A design control product id
responses:
'200':
description: Successful design controls test cases retrieval
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
title:
type: string
code:
type: string
minLength: 1
maxLength: 255
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
type:
type: string
enum:
- testCase1
- testCase2
- testCase3
changeControlStatus:
type: string
enum:
- unstaged
- staged
- approved
- not_approved
source:
type: string
minLength: 1
source_url:
type: string
format: uri
issues:
type: object
propertyNames:
type: string
enum:
- REQUIRES_PARENT
- UNMITIGATED
- REQUIRES_CHILD
- UNTESTED_REQUIREMENT
- FAILING_TEST
- OUTDATED_TESTRESULT
additionalProperties:
type: boolean
required:
- REQUIRES_PARENT
- UNMITIGATED
- REQUIRES_CHILD
- UNTESTED_REQUIREMENT
- FAILING_TEST
- OUTDATED_TESTRESULT
testResult:
type: object
properties:
result:
type: string
enum:
- passed
- failed
- blocked
date:
type: string
format: date-time
comment:
type: string
maxLength: 255
tester:
type: string
minLength: 1
maxLength: 255
url:
type: string
source:
type: string
required:
- result
- date
- tester
additionalProperties: false
description:
description: An optional description of the item. Accepts plain text up to 150,000 characters.
type: string
maxLength: 150000
required:
- id
- title
- code
- created_at
- updated_at
- type
- changeControlStatus
- source
- issues
additionalProperties: false
total:
type: number
required:
- items
- total
additionalProperties: false
description: A list of design control test cases
example:
items:
- id: 123e4567-e89b-12d3-a456-426614174000
title: Test case 1
code: TC-1
created_at: '2021-01-01T00:00:00.000Z'
updated_at: '2021-01-01T00:00:00.000Z'
type: testCase1
changeControlStatus: unstaged
source: Source 1
testResult:
result: passed
date: '2021-01-01T00:00:00.000Z'
comment: Test case 1 passed
tester: Tester 1
source: developer-api
issues:
REQUIRES_PARENT: false
UNMITIGATED: false
REQUIRES_CHILD: false
UNTESTED_REQUIREMENT: false
FAILING_TEST: false
OUTDATED_TESTRESULT: false
total: 1
ref: testCase
'400':
description: The request has malformed path parameters
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/genericBadRequest400PathResponse'
'403':
description: This API key is not allowed to perform this action, or the API key is incorrect
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/genericForbiddenResponse'
'404':
description: Product not found
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/generic404'
'429':
description: This API key has exceeded the fair usage policy in Qualio, and has it its requests restricted. This request has not been processed
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/throttledResponse'
options:
description: Lists the test cases for a design control product, identified by its UUID. A test case documents a verification procedure that proves one or more requirements are satisfied. Each item includes its id, auto-generated code (e.g. TC-1), title, type, change-control status, source, the traceability issues flagged by design-control policy (e.g. a failing or outdated test result), and its latest recorded test result.
operationId: listProductTestCasesOptions
tags:
- Design Controls
x-scalar-ignore: true
parameters:
- in: path
name: productId
schema:
$ref: '#/components/schemas/dcProductId'
required: true
description: A design control product id
responses:
'200':
description: Options 200
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
post:
summary: Create a test case
description: 'Create a test case in a design control product. A test case documents a verification procedure used to confirm that one or more product requirements are satisfied. The type field identifies which test case template slot to use: testCase1, testCase2, and testCase3 map to the first, second, and third configured templates respectively. A code is generated automatically when none is supplied. Use the links or requirements fields to add traceability connections to existing quality items by providing their codes or UUIDs. Type-matching is enforced: testCase1 can only link to req1 requirements, testCase2 to req2, and testCase3 to req3. Mismatched types return 400. Codes or UUIDs not found in the product are stored as unresolved links and resolved automatically when the target item is created. Providing an id that already exists in the product returns 409 Conflict.'
operationId: createProductTestCase
tags:
- Design Controls
security:
- api_key: []
parameters:
- in: path
name: productId
schema:
$ref: '#/components/schemas/dcProductId'
required: true
description: A design control product id
requestBody:
content:
application/json:
schema:
type: object
properties:
title:
type: string
minLength: 1
maxLength: 255
description: The title of the item, displayed in the Qualio UI. Must be between 1 and 255 characters.
description:
description: An optional description of the item. Accepts plain text up to 150,000 characters.
type: string
maxLength: 150000
links:
description: 'An array of quality item codes or UUIDs to establish as trace links. You may supply codes (such as REQ-1 or TC-5) or UUIDs. If a supplied value is not found in the product, it is stored as an unresolved link and resolved automatically when the target item is created later. Type-matching rules apply: see the notes on test_cases for requirements and on the type field for test cases.'
type: array
items:
type: string
requirements:
description: An array of requirement codes or UUIDs to link for traceability coverage. Entries are combined with links and test_cases and processed together. The same type-matching rules apply.
type: array
items:
type: string
type:
type: string
enum:
- testCase1
- testCase2
- testCase3
description: 'The test case template slot to use for this item. Qualio products support up to three test case templates; testCase1, testCase2, and testCase3 correspond to the first, second, and third configured templates. Check your product configuration in Qualio to determine which value to supply. The type also governs which requirements this test case can be linked to: testCase1 can only be linked to req1 requirements, testCase2 to req2, and testCase3 to req3. Attempting to link a test case to a requirement of a different template number returns 400.'
required:
- title
- type
description: A request body to create a new test case in a design control product. Supply a title and a type to identify the test case template slot to use. An optional id may be provided to assign a specific identifier; when omitted the server generates one automatically. A short code is always auto-generated by the server from the product type configuration counter. Use links and requirements to establish traceability connections to existing quality items by supplying their codes or UUIDs. Supplying an id that already belongs to an existing test case in this product returns 409 Conflict.
example:
title: Verify pump pressure under maximum load
type: testCase1
description: Apply maximum rated load to the pump for 30 minutes and confirm that pressure remains within the specified safety range throughout the test.
links:
- REQ-1
- REQ-5
ref: createTestCase
responses:
'201':
description: Test case created successfully.
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
description: The unique identifier of the created item.
title:
type: string
description: The title of the item.
code:
description: The short identifier visible in the Qualio UI.
type: string
description:
description: The content of the object
type: string
source:
type: string
description: The system associated with this item. Set at creation time from the source field in the request, defaulting to developer-api. This value is immutable after creation.
source_url:
description: The URL linking back to the corresponding entry in the source system. Reflects the url field from the request.
type: string
format: uri
created_at:
type: string
format: date-time
description: An ISO 8601 timestamp recording when the item was created.
updated_at:
type: string
format: date-time
description: An ISO 8601 timestamp recording when the item was last modified.
issues:
type: object
propertyNames:
type: string
additionalProperties:
type: boolean
description: A map of policy violation flags. Keys are policy statement identifiers such as REQUIRES_CHILD, UNTESTED_REQUIREMENT, or FAILING_TEST. Newly created items have no active violations and this object is empty.
type:
type: string
enum:
- testCase1
- testCase2
- testCase3
description: The quality item category. Can be testCase1, testCase2, or testCase3
required:
- id
- title
- source
- created_at
- updated_at
- issues
- type
additionalProperties: false
description: The test case that was created.
example:
id: 9d8c7b6a-5e4f-4321-8c0b-7a6d5e4f3c2b
title: Verify pump pressure under maximum load
code: TC-42
type: testCase1
source: jira
source_url: https://your-company.atlassian.net/browse/TC-42
created_at: '2025-05-21T10:00:00.000Z'
updated_at: '2025-05-21T10:00:00.000Z'
issues: {}
ref: createdTestCase
'400':
description: The request has malformed body or parameters
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/genericBadRequestResponse'
'403':
description: This API key is not allowed to perform this action, or the API key is incorrect
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/genericForbiddenResponse'
'404':
description: Product not found
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/generic404'
'409':
description: A test case with the provided id already exists in this product.
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/testCaseConflictResponse'
'429':
description: This API key has exceeded the fair usage policy in Qualio, and has it its requests restricted. This request has not been processed
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/throttledResponse'
/v1/design-controls/products/{productId}/requirements:
get:
summary: List requirements
description: "Lists the requirements for a design control product, identified by its UUID. A requirement describes a condition or capability the product must satisfy, organised into levels (req1â\x80\x93req4). Each item includes its id, auto-generated code (e.g. REQ-1), title, type, change-control status, source, and the traceability issues flagged by design-control policy (e.g. a requirement with no test case, or a child requirement missing its parent)."
operationId: listProductRequirements
tags:
- Design Controls
security:
- api_key: []
parameters:
- in: path
name: productId
schema:
$ref: '#/components/schemas/dcProductId'
required: true
description: A design control product id
responses:
'200':
description: Successful design controls requirements retrieval
headers:
Access-Control-Allow-Origin:
schema:
type: string
Access-Control-Allow-Headers:
schema:
type: string
Access-Control-Allow-Methods:
schema:
type: string
Content-Type:
schema:
type: string
Content-Disposition:
schema:
type: string
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
ty
# --- truncated at 32 KB (138 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/qualio/refs/heads/main/openapi/qualio-design-controls-api-openapi.yml