Skip to content
Board Planner

REST API

Everything the interface does goes through this API, and so can you.

Authenticating

Section titled “Authenticating”

Every request needs one of:

  • Bearer token — Authorization: Bearer cp_... for a token created in the app, or cpat_... for one issued through the OAuth connector flow.
  • Basic auth — Authorization: Basic base64(username:password).

A token never exceeds its owner’s access, and a scoped token is further limited to its chosen projects. The check happens centrally, so REST and MCP behave identically.

Endpoints

Section titled “Endpoints”
Group Endpoint Methods
Auth /api/auth/me GET
Users /api/users, /api/users/[id], /api/users/me GET, POST, PUT, DELETE
Tokens /api/tokens GET, POST, DELETE
Projects /api/projects, /api/projects/[id] GET, POST, PUT, DELETE
Members /api/projects/[id]/members GET, POST, DELETE
Columns /api/projects/[id]/columns GET, PUT
Categories /api/projects/[id]/categories GET, PUT
Custom fields /api/projects/[id]/custom-fields, …/[fieldId] GET, POST, PUT, DELETE
Templates /api/projects/[id]/templates POST, PUT, DELETE
Tasks /api/projects/[id]/tasks, …/tasks/[taskId] GET, POST, PUT, DELETE
Task actions …/tasks/[taskId]/status, /checklist, /watch, /links, /activity GET, POST, PUT, DELETE
Comments …/tasks/[taskId]/comments, …/comments/[commentId] GET, POST, PUT, DELETE
Sprints /api/projects/[id]/sprints, …/sprints/[sprintId] GET, POST, PUT, DELETE
Stats /api/projects/[id]/stats GET
Audit /api/projects/[id]/audit GET
Webhooks /api/projects/[id]/webhooks POST, PUT, DELETE
Channels /api/projects/[id]/notifications POST, PUT, DELETE
Git /api/projects/[id]/github/sync, …/gitlab/sync POST
AI /api/projects/[id]/ai/generate-task POST
PM agent /api/projects/[id]/pm/chat, …/pm/messages, …/pm/interrupt GET, POST
Notifications /api/notifications, …/read, …/unread-count GET, POST
Search /api/search GET
My tasks /api/tasks/mine GET
Uploads /api/uploads, /api/uploads/[fileId] GET, POST
Workers /api/workers/register, /api/workers/[id], …/heartbeat, …/command, …/events GET, POST
Admin /api/admin/agents, /api/admin/workers, /api/settings GET, PUT
MCP /api/mcp POST

Conventions

Section titled “Conventions”
  • Task keys are KEY-NUMBER (ORB-14). Numbers are per project and allocated atomically, so concurrent creates never collide.
  • Custom field values are keyed by field id. Ask the project endpoint which fields exist rather than assuming names.
  • Activity logging is fire-and-forget: it never blocks or fails a request.
  • OAuth discovery lives at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, with registration at /oauth/register and the flow at /oauth/authorize and /oauth/token.