DataGrail MCP Server
for AI Agents

Uploads a document to an assessment. The document is attributed to one of your active users, identified by uploader_email — not to the API key that made the request — so the upload is credited to a person. By default the document is attached to the assessment as a whole; supply tags to attach it to specific questions instead. Send the request as multipart/form-data. The assessment must be in an editable status; uploads to an approved or cancelled assessment are rejected.

Upload files to the integration

Create Detected Objects

Download a completed assessment as a PDF document. Only available for assessments in approved status.

Get a list of privacy request policies

Returns login and permission-decision audit log entries for the current customer. With no pagination parameter, up to 1000 records are returned unpaginated; supplying page_size, after, before, or include_total enables pagination (default page size 50). Requires the Login Activity feature.

Sync remote files to the integration

Atomically submits one or more answers for an assessment. All answers are validated before any are persisted — if any answer is invalid, the entire batch is rejected. Requires a last_updated token for optimistic concurrency control.

Sets the assessment approver from an email, so a procurement system driving assessments over the API can route sign-off without a user assigning the approver in the app. The email must match an existing active user who is eligible to approve this assessment — one holding an approver role, or a contributor or member of the assessment; otherwise the request is rejected. This only routes approval to the named person — it does not approve the assessment. It cannot be used once the assessment is approved or cancelled.

Approves an assessment, so a procurement system driving assessments over the API can sign off without a user opening the app. This performs the same status transition as approving in the app: every required question must be answered first, and the same downstream effects fire. This endpoint is a service-level call, and its authorization differs from approving in the app. In the app, the approval is gated on the signed-in user's own permission to approve. Over the API, the gate is the API token's write access — the token is what is authorized to approve. The approved_by_email you supply is used only for attribution: it records who the approval is credited to, both as the sign-off name and as the actor of the change-history entry (which is marked as API-originated). It can name any active user in your account, including one who would not be permitted to approve the assessment in the app. Any caller holding a write-enabled token can therefore approve on behalf of any active user, so treat the token as the trust boundary. The email must still match exactly one active user in your account, or the request is rejected and nothing is approved. It cannot be used once the assessment is approved or cancelled. Supply the optional last_updated token for optimistic concurrency; omitting it skips the concurrency check and approves the latest assessment state at request time.