# Approve Suite API and MCP server

_Last updated: 2026-10-09. For people: https://approvesuite.com/developers. OpenAPI: https://app.approvesuite.com/api/v1/openapi.json. Site overview: https://approvesuite.com/llms.txt_

Approve Suite collects FDA actions, SEC filings and ClinicalTrials.gov records for life-science companies, normalises them into one event shape, links each to a canonical company, and classifies it (severity, GxP area, product type, modality, stage, a one-line summary and why it matters). The API serves that data. Informational only; not regulatory, legal, medical or investment advice. Every record links to its public source. Independent of the FDA, the SEC and the NLM.

## Why this and not openFDA

The records are free. What costs weeks is the wiring: six openFDA endpoints, the FDA Data Dashboard behind an issued key, four FDA HTML tables with no feed, the Federal Register, the eCFR versioner, EDGAR full-text search plus XBRL frames plus the Form D data sets, the ClinicalTrials.gov API, a Purple Book CSV, a DECRS zip and a device-registration bulk export, each on its own schedule and its own idea of a company name. Approve Suite polls all of it, puts every record in one shape, resolves the company once (FDA name, SEC filer, trial sponsor, FEI numbers), classifies it, maps every CFR citation to its GxP area, and says when each source was last read.

- Supplier and site vetting in your own system: one call for a CDMO or CRO returns every registered site, inspection outcome, 483, letter, recall and import alert, with the agency's record linked.
- Sales triggers: a nightly job over an account list returns who was just inspected, cited, funded or cleared.
- Research by an agent: "which of these forty companies has an OAI inspection, a CRL or a clinical hold since January, and what did FDA cite?" is one conversation with the MCP server.
- Diligence and screening: trials, runway, raises, licensed products and the compliance record on one company id.

Records, links and classification, never a verdict.

## Keys

- Create a key on the profile page of any account: https://app.approvesuite.com/profile (free plan included, no card). Up to five keys per account.
- Send it as `Authorization: Bearer as_live_…` on every request. One key works for REST and MCP.

## MCP server

- URL: `https://app.approvesuite.com/api/mcp` (Streamable HTTP, stateless, JSON responses).
- Claude Code: `claude mcp add --transport http approvesuite https://app.approvesuite.com/api/mcp --header "Authorization: Bearer $APPROVE_SUITE_KEY"`
- Claude Desktop, ChatGPT, Cursor: add the URL as a custom connector / MCP server with the same Authorization header.
- Tools: search_events, get_event, count_events*, find_company, resolve_company, company_detail, explore_companies*, search_trials, analytics_rollup*, search_facilities, taxonomy, sources. (* Pro and API plans.)
- Start with resolve_company or find_company to get a company id; then company_detail, search_events (company_ids) or search_facilities (company_id).

### Setting it up (for an agent asked to "help me set up the Approve Suite MCP server")

1. Ask the user for their API key. If they have none, send them to https://app.approvesuite.com/profile (section "API & MCP", button "Create a key"; any account, free plan included). Never invent a key; it starts with `as_live_`.
2. Keep the key out of files that get committed or shared: prefer an environment variable (`APPROVE_SUITE_KEY`) or the client's own secret storage.
3. Add the server to the client the user is working in:
   - Claude Code: run the `claude mcp add` command above.
   - Cursor, VS Code and other clients with an MCP settings file: add `{"mcpServers": {"approvesuite": {"url": "https://app.approvesuite.com/api/mcp", "headers": {"Authorization": "Bearer <key>"}}}}`.
   - Claude Desktop, claude.ai, ChatGPT and other clients that add a remote server as a custom connector: use the URL above with the header `Authorization: Bearer <key>`. Where the client has no field for a header, the key can go in the URL instead: `https://app.approvesuite.com/api/mcp?api_key=<key>` (treat that URL as a secret).
4. Check it works: list the tools (twelve, or nine on a free key), then call `sources`, which needs no arguments and shows when each source was last read. A `401` means the key is wrong or revoked; a `402` on count_events, analytics_rollup or explore_companies means a free key.
5. Tell the user what they can now ask, for example: "Which of my suppliers had an FDA inspection, Form 483 or warning letter in the last 90 days?"

## REST API

Base URL `https://app.approvesuite.com/api/v1`. GET only. `GET /api/v1` (with a key) lists endpoints, your plan and quota.

| Endpoint | Returns |
|---|---|
| `GET /events` | events, newest first. Filters: `event_types`, `sources`, `severities` (1 FYI, 2 important, 3 critical), `gxp_areas`, `product_types`, `modalities`, `stages`, `company_ids`, `major` (true: final rules, final guidance, substantive CFR amendments), `q` (websearch syntax), `from`, `to` (YYYY-MM-DD), `limit` (≤100). Lists are comma-separated. |
| `GET /events/{id}` | one event: summary, why it matters, source text held for it, tags, CFR references with GxP area, confirmed companies, source url |
| `GET /events/facets` | counts by event type and severity; `by_company=true` adds the top 25 companies |
| `GET /companies` | screen companies: `areas`, `modalities`, `min_phase`/`max_phase` (2 phase 1, 4 phase 2, 6 phase 3), `stage_min`/`stage_max`, `hq` (US state or country), `listed`, `min_cash`, `runway_min`/`runway_max` (months), `raised_days`, `sort`, `limit` |
| `GET /companies/resolve?name=` | the canonical company for a name, with `basis` (name, alias) or candidates when no exact match |
| `GET /companies/search?name=` | companies whose name or alias contains the text |
| `GET /companies/{id}` | identity (CIK, ticker, HQ, FEI numbers), trials since 2021, latest financials and runway, raises, licensed biologics, recent events |
| `GET /companies/{id}/events`, `/trials`, `/facilities` | that company's records |
| `GET /trials` | ClinicalTrials.gov mirror (industry sponsors, updated since 2021): `company_id`, `q`, `status`, `min_phase`, `area`, `modality`, `started_after`, `updated_after`, `has_results` |
| `GET /facilities` | FDA-registered establishments: `fei`, `company_id`, `q`, `country`, `state`, `kind` (drug, device) |
| `GET /analytics/{slice}` | pre-aggregated counts; slices: events-over-time, inspections, warning-letters-by-cfr, trials, recalls; `group_by`, `from`, `to`, `by_period` |
| `GET /taxonomy` | every code the filters accept: event types by lens, GxP areas, product types, modalities, stages |
| `GET /sources` | each source's schedule, health and last successful read |

Example:

```
curl -H "Authorization: Bearer $APPROVE_SUITE_KEY" \
  "https://app.approvesuite.com/api/v1/events?event_types=warning_letter,inspection_classification&from=2026-10-01"
```

Responses are JSON with an `as_of` timestamp. Relative links in results are on https://app.approvesuite.com. Ids never change.

## Errors

RFC 9457 problem documents. `401` missing or invalid key. `402` monthly quota exhausted, a paid-plan tool on a free key, or an event outside the key's window. `429` rate limit (honour `Retry-After`). `400` invalid parameters (the detail names the field). Headers: `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`, `X-Quota-Limit`, `X-Quota-Used`, `X-Plan`.

## Plans

| Plan | Requests a month | Per minute | Window | Notes |
|---|---|---|---|---|
| Free key | 1,000 | 10 | last 7 days of events; the full company graph | any account, no card; core tools |
| Pro ($79 a month, $790 a year) | 10,000 | 60 | full archive | every tool; for one person's own agent |
| API plan ($99 a month, $990 a year) | 100,000 | 300 | full archive | everything in Pro plus the quota; for systems and products |

Only successful calls count: errors, refusals and rate-limited requests do not. Redistribution, bulk snapshots or an OEM licence: info@approvesuite.com.

## Licence

Use the data in your own products, systems and analyses; name the source and Approve Suite when you display it. Do not re-serve the dataset as such (download, feed, API, bulk), build a competing dataset from it, or train models on the summaries, classifications and company links without a written agreement. The public records are public; the licence covers what Approve Suite adds. Terms: https://approvesuite.com/terms

## What is in the data

- Events (30+ types across 15 sources): FDA warning letters with CFR sections cited, inspection classifications (NAI/VAI/OAI) and citations, posted Form 483s, recalls by class, drug shortages, MedWatch safety communications, OPDP untitled letters, debarments, import alerts, approvals, complete response letters, 510(k) clearances, PMA approvals, Federal Register rules, notices and guidance, eCFR Title 21 amendments mapped to GxP area and citing guidances, ClinicalTrials.gov trial changes, SEC 8-Ks tagged for clinical holds and CRLs.
- Companies: one id across sources with aliases, FEI numbers, CIK, ticker and HQ; about 69,000 trials and 11,400 sponsors; SEC cash, burn and runway for about 600 listed companies; Form D and public-offering raises; Purple Book biologics; FDA-registered establishments.
- Not in the API: candidate (unreviewed) company links, classifier internals, full source documents, anything a subscriber created.