REST API

Base URL https://iqvgather.com/api/v1. Send the key as Authorization: Bearer vg_…. The full OpenAPI 3.1 description is at /openapi.json.

curl -s https://iqvgather.com/api/v1/questions \
  -H "Authorization: Bearer vg_…" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": "…",
    "title": "What is the expected monthly volume?",
    "kind": "number",
    "assignees": {"emails": ["pat@customer.example"],
                  "channels": ["email", "slack"]}
  }'

Then poll GET /api/v1/questions?status=answered, or register a webhook for question.answered (payloads are signed with X-Gather-Signature).

MCP server

The MCP endpoint is https://iqvgather.com/mcp (Streamable HTTP, stateless). Tools include ask_question, ask_questions, assign_question, list_questions, get_question, record_answer, accept_question, invite_respondent, upload_document, get_document, and get_credential.

Sign in through the browser (recommended for people). Add the server and let the client log you in; it registers itself, opens this site for consent, and acts with your own role. Tokens renew for 30 days and show under Your profile → Connected apps.

claude mcp add --transport http iqv-gather https://iqvgather.com/mcp
# then in Claude Code: /mcp → iqv-gather → Authenticate

Claude Code on a remote server (SSH)? Its callback listener is on that server, so your laptop's browser cannot reach it. Use the prompt flow instead: run claude mcp login iqv-gather --no-browser, open the printed URL on your laptop, sign in, choose Allow and show me the code to paste, and paste the callback URL back into Claude Code.

API key (for unattended agents). Create a key under Admin → API keys and send it as a bearer token:

claude mcp add --transport http iqv-gather https://iqvgather.com/mcp --header "Authorization: Bearer vg_…"

{
  "mcpServers": {
    "iqv-gather": {
      "type": "http",
      "url": "https://iqvgather.com/mcp",
      "headers": { "Authorization": "Bearer vg_…" }
    }
  }
}

OAuth discovery: /.well-known/oauth-protected-resource, /.well-known/oauth-authorization-server, dynamic registration at /oauth/register, PKCE S256, public clients only.

Scopes

Keys carry scopes such as questions:write, answers:read, documents:write, credentials:read. A write scope implies the matching read scope. Every reveal and download is written to the audit log with the key's label.