Obtain a session ID by POST to https://{vault_domain}/api/{version}/auth with username and password form parameters; the response returns sessionId in the JSON body
Include the sessionId in the Authorization header (value: sessionId {token}) on all subsequent requests; Veeva Vault releases three API versions per year (YY.1, YY.2, YY.3)
Query document metadata via GET /api/{version}/objects/documents using VQL (Vault Query Language) syntax in a query parameter, e.g., SELECT id, name__v, study__v, status__v FROM documents WHERE type__v = 'Trial Master File'
Retrieve a document's properties via GET /api/{version}/objects/documents/{docId} and its version history via GET /api/{version}/objects/documents/{docId}/versions
To download a document file, call GET /api/{version}/objects/documents/{docId}/file; to retrieve only rendition (PDF), use /rendition/viewable_rendition__v
For bulk metadata export supporting eTMF archiving workflows, use the Document Extract API (/api/{version}/objects/documents/batch) which supports up to 500 document IDs per request
Known gotchas
Vault sessions expire after 30 minutes of inactivity; implement token refresh or re-authentication on 401 responses rather than caching the session ID indefinitely
VQL field names include the __v suffix for system fields and __c for custom fields; omitting the suffix causes a query parse error with a non-obvious message
The API version in the URL path must match a version supported by the specific Vault instance; calling a version newer than the Vault's current release returns a 400 error
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp