API overview

Anything a connector does can be done through the API. It is used for custom equipment integration, corporate analytics feeds and pushing quality events into existing workflow tooling.

Updated July 2026 · 11 min read

Base URL, versioning and authentication

Each tenant has a regional base URL. The API is versioned in the path; a version stays supported for at least 24 months after its successor ships, and breaking changes never land inside a version.

Endpoint basics
Property	Value	Note
Base URL	https://{tenant}.{region}.trustqualityassurance.com/api/v2	Region is eu, us or apac; private deployments use your own host
Auth (service)	OAuth 2.0 client credentials	Service accounts for machine-to-machine integration
Auth (user)	OIDC bearer token from your identity provider	Scope follows the user's site and product permissions
Content type	application/json; UTF-8	Timestamps are RFC 3339 with explicit offset
Idempotency	Idempotency-Key header on writes	Safe retries for ingestion

Shell · obtain a token

curl -X POST https://acme.eu.trustqualityassurance.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$TQA_CLIENT_ID" \
  -d "client_secret=$TQA_CLIENT_SECRET" \
  -d "scope=measurements:write characteristics:read"

Core resources

Primary endpoints
Resource	Methods	Purpose
/assets	GET, POST, PATCH	Plant hierarchy: sites, areas, lines, cells, stations, gauges
/products, /operations	GET, POST, PATCH	What is produced and the routed steps performed
/characteristics	GET, POST, PATCH	Definitions, limits, sampling rules and rule sets
/measurements	POST, GET	Variable and attribute results, single or batched
/subgroups	GET	Formed subgroups with control state and rule verdicts
/deviations	GET, PATCH	Rule violations, anomalies and their lifecycle state
/ncr, /capa	GET, POST, PATCH	Nonconformance and corrective action records
/lots, /genealogy	GET	Lot identity and upstream/downstream traversal
/events	POST, GET	Downtime, changeover, alarm and operator events
/exports/evidence	POST	Generate a standard-mapped evidence pack

Submitting measurements

Batched submission is preferred: up to 5,000 readings per request. Reference characteristics by their stable key so integrations do not break when a display name changes.

Shell · batch measurement ingestion

curl -X POST https://acme.eu.trustqualityassurance.com/api/v2/measurements \
  -H "Authorization: Bearer $TQA_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: line3-2026-01-19T09:41:12Z-batch-118" \
  -d '{
    "site": "stuttgart-01",
    "asset": "line-3/station-40",
    "product": "BRK-7741",
    "operation": "OP-40-sealing",
    "records": [
      {
        "characteristic": "seal-width",
        "value": 4.19,
        "unit": "mm",
        "observedAt": "2026-01-19T09:41:12+01:00",
        "lot": "L-2026-0119-A",
        "serial": "SN-88431902",
        "gauge": "CAL-114",
        "operator": "op-2291"
      }
    ]
  }'

Response

JSON · 202 Accepted

{
  "accepted": 1,
  "rejected": 0,
  "subgroup": { "id": "sg_01HQ7...", "status": "closed", "size": 5 },
  "evaluation": {
    "specification": "in-tolerance",
    "control": "out-of-control",
    "rules": ["nelson-1"],
    "deviation": { "id": "dev_01HQ7...", "severity": "high" }
  }
}

Webhooks and streaming

Outbound events let you push quality signals into existing tooling. Payloads are signed with HMAC-SHA256; verify the signature before acting on a payload.

Event types
Event	Fired when	Common use
deviation.raised	A rule or specification breach is detected	Andon signal, Teams alert, MES hold
deviation.contained	Containment scope is confirmed	Block dispatch of affected lots
capa.created	A corrective action record is opened	Create a linked ticket in Jira or ServiceNow
capa.verified	Effectiveness verification completes	Close the linked ticket with evidence
supplier.lot.rejected	Incoming inspection rejects a lot	Notify procurement and block goods receipt
model.version.released	A model version is promoted	Record in change management

Node · verifying a webhook signature

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody: string, header: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const received = Buffer.from(header, "hex");
  const digest = Buffer.from(expected, "hex");
  return received.length === digest.length && timingSafeEqual(received, digest);
}

Pagination, rate limits and errors

Pagination is cursor-based: pass the returned nextCursor until it is null. Page size defaults to 200, maximum 1,000.
Rate limits are per tenant and per credential: 600 requests/minute for reads, 120 requests/minute for writes, with ingestion batched rather than rate-limited per reading.
429 responses include Retry-After. Clients should back off exponentially with jitter.
Errors return an RFC 7807 problem document with a machine-readable type and the offending field.

JSON · 422 problem document

{
  "type": "https://docs.trustqualityassurance.com/errors/characteristic-unknown",
  "title": "Unknown characteristic key",
  "status": 422,
  "detail": "No characteristic 'seal_width' exists for operation OP-40-sealing.",
  "instance": "/api/v2/measurements",
  "field": "records[0].characteristic"
}

Need something this page does not cover?

Solution architects answer technical questions directly — no ticket triage for pre-sales evaluation.

Ask an engineer