Developers
API reference
The whole REST API: every endpoint, parameter and response, with ready-to-run samples in nine languages. The samples read your key from the TODIX_TOKEN environment variable.
Sample language
The language you pick is used in every sample on the page and remembered on this device.
Every request carries a personal access token: Authorization: Bearer tdx_…. Create one in Todix under Integrations → API.
- Each key belongs to one person and one workspace and works with that person’s permissions in the app. The API never shows a task you can’t see in the app.
- Scopes limit what a key can touch; they never grant permissions. Pick only what you need.
- A missing, malformed, expired or revoked key always gets the same answer:
401 invalid_token. - Keep keys out of your code, in the
TODIX_TOKENenvironment variable like the samples. A key can revoke itself withDELETE /api/v1/token. - Browsers can’t call the API from other sites (CORS is closed). Send requests from your own server.
Scopes
| Scope | What it allows |
|---|---|
| tasks:read | Read tasks · Tasks, comments, labels and members |
| tasks:write | Write tasks · Create, update, complete, trash, assign, label |
| projects:read | Read projects · Projects and their sections |
| projects:write | Write projects · Create and update projects and sections |
| comments:write | Write comments · Post comments in a task’s chat |
| webhooks:manage | Manage webhooks · Works for admins only |
| mcp | Assistant connection (MCP) · For assistants like Claude and ChatGPT |
| hooks | Instant triggers · Get notified at your URL when something happens (Zapier, Make) |
Your first task in three steps: create a key, put it in an environment variable, send the request.
- In Todix, create a key with the tasks:write scope under Integrations → API.
- Put it in the TODIX_TOKEN environment variable: export TODIX_TOKEN=tdx_…
- Send the request next to this. The response has the new task’s number and URL.
Every failed request comes back the same way: { "error": { "code", "message" } }. code is for machines and never changes; message is a short hint for developers.
HTTP status codes
| Status | Meaning |
|---|---|
| 400 | Bad request: the body or query doesn’t match the schema, or a filter or cursor is invalid. |
| 401 | The key is missing, malformed, expired or revoked. |
| 403 | The key’s scope or your permission in the app doesn’t allow this. |
| 404 | The record doesn’t exist or you can’t see it, or there is no such path. |
| 405 | This path doesn’t support the method (see the Allow header). |
| 409 | Conflict: a request with this Idempotency-Key is still running, or the record already exists. |
| 413 | The body is larger than 64 KB. |
| 415 | The body isn’t JSON: send Content-Type: application/json. |
| 422 | This Idempotency-Key was used with a different body. |
| 429 | Rate limit reached; wait Retry-After seconds. |
| 5xx | A temporary problem on our side; try again shortly. |
Common codes
| Code | Meaning |
|---|---|
| invalid_token | Missing, malformed, expired or revoked API token. |
| insufficient_scope | The token doesn’t have the scope this endpoint needs. |
| rate_limited | Too many requests. Wait until X-RateLimit-Reset. |
| not_found | Not found. |
| route_not_found | No such endpoint. |
| method_not_allowed | This endpoint doesn’t support this method. |
| bad_request | The request is malformed. |
| invalid_body | The JSON body is missing or doesn’t match the schema. |
| invalid_query | A query parameter is invalid. |
| invalid_filter | The smart filter expression couldn’t be parsed. |
| invalid_cursor | The cursor is invalid. Start again without it. |
| idempotency_key_invalid | Idempotency-Key must be 1–100 characters of A–Z, a–z, 0–9 and _ . : - |
| idempotency_key_reused | This Idempotency-Key was used with a different request. |
| idempotency_in_progress | A request with this Idempotency-Key is still running. |
| payload_too_large | The body is too large (64 KB at most). |
| unsupported_media_type | Send JSON (Content-Type: application/json). |
| unavailable | The service is temporarily unavailable. Try again shortly. |
| unknown | The request couldn’t be completed. |
| not_a_member | You’re not a member of this workspace. |
| admin_required | Only workspace admins can do this. |
| task_not_found | Task not found, or you can’t see it. |
| assign_not_allowed | You can’t assign tasks to this person. |
| forbidden | You can’t do this. |
| webhook_url_invalid | Webhook URLs must be HTTPS and point at a public host name. |
| webhook_address_blocked | The webhook host resolves to a private or reserved address. |
| webhook_events_invalid | Unknown webhook event. |
| webhook_limit | A workspace can have at most 20 webhooks. |
| webhook_not_found | Webhook not found. |
| webhook_disabled | The webhook is switched off. Turn it on first. |
| project_not_found | Project not found, or you can’t see it. |
| hook_not_found | Hook not found; it may already be removed. |
| hook_event_invalid | A hook can’t be set up for this event. |
| hook_limit | You can have at most 100 active hooks in a workspace. |
| hook_needs_api | Hooks are set up only with an API key or a Zapier / Make connection. |
Lists come in pages: { "data": [...], "next_cursor": "…" }. For the next page, send next_cursor back as ?cursor=; null means you’ve reached the end.
limitis 1–200, 50 by default.- Tasks are sorted by task number, newest first; pages don’t shift when new tasks arrive in between.
- With a smart filter a page may hold fewer than
limittasks, or none. Follownext_cursor, not the page size. - Cursors are opaque: don’t decode them, send them back as they are.
120 requests a minute per key. Every response tells you what’s left.
X-RateLimit-Limit: requests per minute ·X-RateLimit-Remaining: what’s left ·X-RateLimit-Reset: unix time the window resets.- Over the limit you get
429 rate_limitedandRetry-After(seconds); wait that long and try again. - Requests with invalid keys are limited to 30 a minute per IP address.
- The MCP connection shares the same counter.
Every POST accepts an Idempotency-Key header. If the network drops, send the same request with the same key again: the work is never done twice.
- Keys are 1–100 characters of A–Z, a–z, 0–9 and
_ . : -. Make a new value (a UUID, say) for every new piece of work. - Same key, same body: you get the first response again, with
Idempotent-Replayed: true. - Same key, different body:
422 idempotency_key_reused. While the first request is running:409 idempotency_in_progress. - Keys are kept for 24 hours. A
5xxresponse frees the key so you can retry.
The filter parameter of GET /tasks takes the app’s smart filter expression. Turkish or English keywords; case and accents don’t matter.
Expressions
| Expression | Meaning |
|---|---|
| p1 · p2 · p3 | High, medium, low priority (also !high, !yüksek) |
| today · tomorrow · overdue | By due date (bugün, yarın, gecikmiş) |
| this week · next week · this month · 7 days · no date | Date ranges |
| start:this week · deadline:tomorrow | Start date or deadline |
| @ersin · @me | Assignee (@ben) |
| assigner:@burak · creator:@me | Assigned by or created by |
| #"Kasım kampanyası" · #none | Project, or no project |
| label:urgent | Label (etiket:acil) |
| stage:doing | Stage: todo, doing, waiting, done |
| estimate>2h · estimate<=30m | Time estimate |
| "shipping" | Text in the title or description |
| & | ! ( ) | and, or, not, grouping (a space also means “and”) |
The filter combines with the other parameters with AND. An expression that can’t be parsed returns 400 invalid_filter.
Webhooks sign every request: Todix-Signature: t=<time>, v1=<signature>. The signature is the HMAC-SHA256 (hex) of “time.body” with the webhook’s signing secret.
- Compute it over the raw body (don’t parse and re-serialize the JSON) and compare in constant time.
- Reject requests whose time is more than 5 minutes old: that stops replays.
- While a secret is being rotated a header may carry several
v1values; one match is enough. - A
2xxanswer means delivered. Failures are retried after 1 min, 5 min, 30 min, 2 h and 8 h; after 15 failures in a row the webhook switches off. - Other headers:
Todix-Event(the event type) andTodix-Delivery(the delivery id). A retried delivery sends the same body.
Events
| Event | Meaning |
|---|---|
| task.created | Task created |
| task.updated | Task updated |
| task.completed | Task completed |
| task.deleted | Task moved to trash |
| comment.created | Comment posted |
| project.created | Project created |
The Todix remote MCP server connects AI assistants such as Claude, ChatGPT, Claude Code, Cursor and VS Code to your tasks.
Server URLhttps://todix.com.tr/api/mcp
- Claude and ChatGPT connect with OAuth: add the URL as a custom connector, pick the workspace in Todix and approve. No key to copy.
- Cursor and VS Code connect with a key that has the
mcpscope. Integrations → MCP in Todix gives you the ready configuration with your key in it. - Tools: workspaces, my day, search, get, create, update and complete tasks, comment, projects, members. A read-only connection doesn’t list the write tools.
- MCP works with your permissions too and shares the REST API’s per-minute limit.
The key’s person, workspace and scopes.
Fields
userobjectThe key’s person.
Show 4 child fields
iduuidId (uuid).
namestringName.
emailemailEmail address.
localeenumThe person’s interface language.
tren
workspaceobjectThe workspace the key is bound to.
Show 6 child fields
iduuidId (uuid).
namestringName.
slugstringThe workspace’s short name in URLs.
timezonestringThe workspace’s time zone.
todaydateToday’s date in the workspace’s time zone.
roleenumnullableRole: admin or member.
adminmember
tokenobjectThe key used.
Show 2 child fields
iduuidId (uuid).
scopesenum[]The key’s scopes.
tasks:readtasks:writeprojects:readprojects:writecomments:writewebhooks:managemcphooks
With its time zone and today’s date.
Fields
iduuidId (uuid).
namestringName.
slugstringThe workspace’s short name in URLs.
timezonestringThe workspace’s time zone.
todaydateToday’s date in the workspace’s time zone.
roleenumnullableRole: admin or member.
adminmember
/api/v1/meReturns the person and workspace the key belongs to (with the time zone and today’s date) and its scopes. The easiest way to test a connection.
Responses
- 200
OK
Returns: The me object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/workspacesWorkspaces the key can reach. A key is bound to one workspace, so the list holds one entry.
Responses
- 200
OK
Returns a page of: The workspace object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
9 endpoints
Create, read, update and complete tasks; manage assignees and labels. {ref} in a path is the task number (42) or id.
The same fields in lists and for one task; lists shorten the description.
Fields
iduuidId (uuid).
numberintegerTask number in the workspace (#42).
titlestringThe task’s title.
descriptionstringThe task’s description. Lists carry the first 280 characters; a single task the full text.
statusenumopen or done.
opendonestageenumnullableStage: todo, doing or waiting.
tododoingwaitingpriorityenumPriority: high, medium or low.
highmediumlowdue_datedatenullableDue date (YYYY-MM-DD).
due_timestringnullableDue time (HH:MM), in the workspace’s time zone.
start_datedatenullableStart date.
deadlinedatenullableDeadline: the hard limit behind the due date.
estimate_minutesintegernullableTime estimate, in minutes.
recurrencestringnullableRepeat rule (null when it doesn’t repeat).
is_overduebooleanPast its due date and still open.
projectobjectnullableThe task’s project.
Show 3 child fields
iduuidId (uuid).
namestringnullableName.
colorstringnullableColor, #RRGGBB.
section_iduuidnullableSection inside the project.
parent_iduuidnullableParent task (for a subtask).
assigneesobject[]Assignees; the first is the primary one.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
labelsobject[]Labels.
Show 3 child fields
iduuidId (uuid).
namestringName.
colorstringnullableColor, #RRGGBB.
created_byobjectWho created it.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
assigned_byobjectnullableWho assigned it.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
completed_atdate-timenullableWhen it was completed.
completed_byobjectnullableWho completed it.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
comment_countintegerNumber of comments.
attachment_countintegerNumber of files.
checklistobjectChecklist summary.
Show 2 child fields
totalintegerNumber of items.
doneintegerNumber of checked items.
created_atdate-timeWhen it was created (ISO 8601).
updated_atdate-timeWhen it last changed (ISO 8601).
urluriThe task’s address in Todix.
List tasks
/api/v1/tasksNewest task number first. Filters combine with AND; filter takes the app’s smart filter expression. A page may hold fewer than limit tasks: keep going until next_cursor is null.
Query parameters
statusenumWhich tasks: open (default), done, or any.
opendoneanyDefault: open
assigneeuuid | "me"Assignee: a person’s id, or me for yourself.
projectuuid | "none"Project id; none for tasks without a project.
sectionuuidSection id.
labeluuidLabel id.
priorityenumPriority.
highmediumlowstageenumStage.
tododoingwaitingdueenumDue date: today, week (this week), later, none.
todayweeklaternoneoverdueenumtrue: overdue tasks only.
01truefalseparentuuidSubtasks of this task.
top_levelenumtrue: leave out subtasks.
01truefalseqstringText in the title or description.
1–200 characters
filterstringSmart filter expression, e.g. p1 & today & @me (see Smart filter).
1–600 characters
numberintegerTask number in the workspace (#42).
Between 1 and 9,999,999,999
sortenumOrder: number newest task first (default), updated last changed first, completed last completed first (only done tasks unless status=any).
numberupdatedcompletedDefault: number
created_sincedate-timeOnly tasks created at or after this time (ISO 8601).
updated_sincedate-timeOnly tasks changed at or after this time (ISO 8601).
completed_sincedate-timeOnly tasks completed at or after this time (ISO 8601).
limitintegerMost records on a page.
Default: 50 · Between 1 and 200
cursorstringnext_cursor from the previous response.
Up to 200 characters
Responses
- 200
OK
Returns a page of: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Create a task
/api/v1/tasksWithout assignees the task is yours. Your assign permissions apply exactly as in the app: the API can’t assign anyone you couldn’t assign there.
Request body
titlestringrequiredThe task’s title.
1–500 characters
descriptionstringDescription (plain text).
Up to 20,000 characters
assignee_idsuuid[]Assignees; the first is the primary one. Empty means you.
Up to 20 items
priorityenumPriority: high, medium or low.
highmediumlowdue_datedateDue date (YYYY-MM-DD).
due_timestringDue time (HH:MM), in the workspace’s time zone.
start_datedateStart date.
deadlinedateDeadline: the hard limit behind the due date.
estimate_minutesintegerTime estimate, in minutes.
Between 1 and 100,000
project_iduuidProject id; null takes the task out of its project.
section_iduuidSection inside the project.
label_idsuuid[]Label ids.
Up to 30 items
Responses
- 201
Created
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Get a task
/api/v1/tasks/{ref}By number (42) or id. Only this endpoint returns the full description and created_at.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Responses
- 200
OK
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Update a task
/api/v1/tasks/{ref}Send only the fields you want to change. Send null to clear a date.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Request body
titlestringThe task’s title.
1–500 characters
descriptionstringDescription (plain text).
Up to 20,000 characters
priorityenumPriority: high, medium or low.
highmediumlowstageenumStage: todo, doing or waiting.
tododoingwaitingdue_datedatenullableDue date (YYYY-MM-DD).
due_timestringnullableDue time (HH:MM), in the workspace’s time zone.
start_datedatenullableStart date.
deadlinedatenullableDeadline: the hard limit behind the due date.
estimate_minutesintegernullableTime estimate, in minutes.
Between 1 and 100,000
project_iduuidnullableProject id; null takes the task out of its project.
section_iduuidSection inside the project.
Responses
- 200
OK
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Move a task to the trash
/api/v1/tasks/{ref}The task goes to the trash and can be restored in the app for 30 days.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Responses
- 200
OK
The response body looks like the example.
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Complete a task
/api/v1/tasks/{ref}/completeMarks the task done; its people are notified as in the app.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Responses
- 200
OK
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Reopen a task
/api/v1/tasks/{ref}/reopenReopens a completed task.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Responses
- 200
OK
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/tasks/{ref}/assigneesReplaces the whole list; the first person is the primary assignee.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Request body
user_idsuuid[]requiredThe new assignees; the first is the primary one.
1–20 items
Responses
- 200
OK
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/tasks/{ref}/labelsReplaces the task’s labels with the list you send. An empty list removes them all.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Request body
label_idsuuid[]requiredLabel ids.
Up to 30 items
Responses
- 200
OK
Returns: The task object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
3 endpoints
The task’s chat: comments are the app’s chat messages, with the same notifications.
One message in a task’s chat.
Fields
iduuidId (uuid).
task_iduuidThe comment’s task.
bodystringThe message text.
authorobjectWho wrote it.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
reply_touuidnullableThe comment it replies to.
internalbooleantrue: an internal note — guests never see it.
created_atdate-timeWhen it was created (ISO 8601).
edited_atdate-timenullableWhen it was last edited.
A comment plus the number, title and URL of the task it was written on.
Fields
iduuidId (uuid).
task_iduuidThe comment’s task.
bodystringThe message text.
authorobjectWho wrote it.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
reply_touuidnullableThe comment it replies to.
internalbooleantrue: an internal note — guests never see it.
created_atdate-timeWhen it was created (ISO 8601).
edited_atdate-timenullableWhen it was last edited.
taskobjectThe task the comment was written on.
Show 4 child fields
iduuidId (uuid).
numberintegerTask number in the workspace (#42).
titlestringThe task’s title.
urluriURL.
/api/v1/tasks/{ref}/commentsThe task’s chat messages, newest first.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Query parameters
limitintegerMost records on a page.
Default: 50 · Between 1 and 200
cursorstringnext_cursor from the previous response.
Up to 200 characters
Responses
- 200
OK
Returns a page of: The comment object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Post a comment
/api/v1/tasks/{ref}/commentsPosts a message to the task’s chat; its people are notified like for a chat message.
Path parameters
refstringrequiredTask number (42) or task id (uuid).
Request body
bodystringrequiredThe message text.
1–10,000 characters
reply_touuidThe comment it replies to.
internalbooleantrue: an internal note — guests never see it.
Responses
- 201
Created
Returns: The comment object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
A project with its counts and progress.
Fields
iduuidId (uuid).
namestringName.
descriptionstringnullableDescription (plain text).
colorstringnullableColor, #RRGGBB.
iconstringnullableIcon name (lowercase letters, digits, dashes).
statusstringThe project’s status.
ownerobjectnullableProject owner.
Show 2 child fields
iduuidId (uuid).
namestringnullableName.
parent_iduuidnullableParent project.
folder_iduuidnullableThe project’s folder.
start_datedatenullableStart date.
end_datedatenullableEnd date.
archived_atdate-timenullableWhen it was archived (null when it isn’t).
countsobjectTask counts.
Show 4 child fields
openintegerOpen tasks.
doneintegerCompleted tasks.
overdueintegerOverdue tasks.
totalintegerAll tasks.
progressintegerProgress, percent (0–100).
created_atdate-timeWhen it was created (ISO 8601).
updated_atdate-timeWhen it last changed (ISO 8601).
A section inside a project.
Fields
iduuidId (uuid).
namestringName.
positionintegerIts place in the project.
/api/v1/projectsArchived projects only with archived=true.
Query parameters
archivedenumtrue: include archived projects.
01truefalseqstringText in the title or description.
1–120 characters
Responses
- 200
OK
Returns a page of: The project object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Create a project
/api/v1/projectsOpens a new project. Your permission to create projects is the same as in the app.
Request body
namestringrequiredName.
1–120 characters
descriptionstringDescription (plain text).
Up to 5,000 characters
colorstringColor, #RRGGBB.
iconstringIcon name (lowercase letters, digits, dashes).
owner_iduuidThe project owner’s id.
start_datedateStart date.
end_datedateEnd date.
Responses
- 201
Created
Returns: The project object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/projects/{id}A project with its counts and progress.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 200
OK
Returns: The project object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Update a project
/api/v1/projects/{id}Send only the fields you want to change; null clears the description, the owner or a date.
Path parameters
iduuidrequiredThe record’s id (uuid).
Request body
namestringName.
1–120 characters
descriptionstringnullableDescription (plain text).
Up to 5,000 characters
colorstringColor, #RRGGBB.
iconstringIcon name (lowercase letters, digits, dashes).
owner_iduuidnullableThe project owner’s id.
start_datedatenullableStart date.
end_datedatenullableEnd date.
Responses
- 200
OK
Returns: The project object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/projects/{id}/sectionsThe project’s sections, in order.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 200
OK
Returns a page of: The section object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Add a section
/api/v1/projects/{id}/sectionsAdds a new section at the end of the project.
Path parameters
iduuidrequiredThe record’s id (uuid).
Request body
namestringrequiredName.
1–80 characters
Responses
- 201
Created
Returns: The section object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
A label with its name and color.
Fields
iduuidId (uuid).
namestringName.
colorstringnullableColor, #RRGGBB.
List labels
/api/v1/labelsThe workspace’s labels.
Responses
- 200
OK
Returns a page of: The label object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Create a label
/api/v1/labelsAdds a new label to the workspace.
Request body
namestringrequiredName.
1–40 characters
colorstringColor, #RRGGBB.
Responses
- 201
Created
Returns: The label object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
A person in the workspace.
Fields
user_iduuidThe person’s id.
namestringName.
emailemailEmail address.
titlestringnullableThe person’s job title.
roleenumRole: admin or member.
adminmemberstatusenumactive or disabled.
activedisabledcan_assignbooleanWhether you can assign tasks to this person.
List members
/api/v1/membersThe workspace’s members. can_assign tells you whether you can assign them tasks.
Query parameters
emailemailEmail address.
Up to 200 characters
qstringText in the title or description.
1–120 characters
Responses
- 200
OK
Returns a page of: The member object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
8 endpoints
Signed requests to your URL when something happens in the workspace. Admins only; the key needs the webhooks:manage scope.
Its URL, events and latest delivery status.
Fields
iduuidId (uuid).
urluriThe HTTPS URL requests go to.
descriptionstringnullableDescription (plain text).
eventsenum[]The events it listens to.
task.createdtask.updatedtask.completedtask.deletedcomment.createdproject.createdenabledbooleanWhether it’s on; true resets the failure counter.
failure_countintegerFailed deliveries in a row.
disabled_reason"failing"nullablefailing: switched off after failures in a row.
last_delivery_atdate-timenullableLatest delivery attempt.
last_success_atdate-timenullableLatest successful delivery.
secret_hintstringLast 4 characters of the signing secret.
created_atdate-timeWhen it was created (ISO 8601).
Returned when you create a webhook or rotate its secret: only these responses carry secret.
Fields
iduuidId (uuid).
urluriThe HTTPS URL requests go to.
descriptionstringnullableDescription (plain text).
eventsenum[]The events it listens to.
task.createdtask.updatedtask.completedtask.deletedcomment.createdproject.createdenabledbooleanWhether it’s on; true resets the failure counter.
failure_countintegerFailed deliveries in a row.
disabled_reason"failing"nullablefailing: switched off after failures in a row.
last_delivery_atdate-timenullableLatest delivery attempt.
last_success_atdate-timenullableLatest successful delivery.
secret_hintstringLast 4 characters of the signing secret.
created_atdate-timeWhen it was created (ISO 8601).
secretstringThe signing secret (whsec_…); only in this response, once.
One webhook request and its outcome.
Fields
iduuidId (uuid).
eventstringEvent type.
statusenumpending, sending, delivered, failed or canceled.
pendingsendingdeliveredfailedcanceledattemptsintegerNumber of attempts.
response_statusintegernullableThe receiver’s HTTP status code.
errorstringnullableWhy it failed (null on success).
duration_msintegernullableDuration, in milliseconds.
created_atdate-timeWhen it was created (ISO 8601).
last_attempt_atdate-timenullableLatest attempt.
delivered_atdate-timenullableWhen it was delivered.
next_attempt_atdate-timenullableNext attempt.
/api/v1/webhooksThe workspace’s webhooks. Admins only.
Responses
- 200
OK
Returns a page of: The webhook object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Create a webhook
/api/v1/webhooksThe signing secret is returned once, in this response only; save it right away. The URL must be a public HTTPS address.
Request body
urlurirequiredThe public HTTPS URL to send requests to.
Up to 500 characters
eventsenum[]requiredThe events it listens to.
task.createdtask.updatedtask.completedtask.deletedcomment.createdproject.created1–6 items
descriptionstringDescription (plain text).
Up to 200 characters
Responses
- 201
Created
Returns: Webhook with its secret
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/webhooks/{id}The webhook’s settings and latest delivery status.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 200
OK
Returns: The webhook object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Update a webhook
/api/v1/webhooks/{id}enabled: true resets the failure counter and turns a switched-off webhook back on.
Path parameters
iduuidrequiredThe record’s id (uuid).
Request body
urluriThe new HTTPS URL.
Up to 500 characters
eventsenum[]The events it listens to.
task.createdtask.updatedtask.completedtask.deletedcomment.createdproject.created1–6 items
descriptionstringnullableDescription (plain text).
Up to 200 characters
enabledbooleanWhether it’s on; true resets the failure counter.
Responses
- 200
OK
Returns: The webhook object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Delete a webhook
/api/v1/webhooks/{id}Deletes the webhook and its delivery history. Returns 204 with no body.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 204
No content
No body on success.
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/webhooks/{id}/testQueues a ping delivery right away (202). Test deliveries aren’t retried.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 202
Accepted
The response body looks like the example.
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/webhooks/{id}/rotate-secretThe new secret is returned once; the old one stops working at once.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 200
OK
The response body looks like the example.
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/webhooks/{id}/deliveriesThe webhook’s last 50 deliveries, with status and timing.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 200
OK
Returns a page of: The delivery object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
3 endpoints
Signed event notifications to your own URL the moment something happens; Zapier and Make use them. Any member can set one up and only receives what they can see. The key needs the hooks scope.
A subscription with its event, target URL, filters and last delivery.
Fields
iduuidId (uuid).
eventenumEvent type.
task.createdtask.updatedtask.completedtask.assignedcomment.createdproject.createdtarget_urluriThe HTTPS URL events are sent to.
project_iduuidnullableOnly tasks and comments of this project.
assigned_to_mebooleantrue: only tasks assigned to you (task.assigned always is).
enabledbooleanWhether it’s on; true resets the failure counter.
failure_countintegerFailed deliveries in a row.
disabled_reason"failing"nullablefailing: switched off after failures in a row.
last_delivery_atdate-timenullableLatest delivery attempt.
last_success_atdate-timenullableLatest successful delivery.
created_atdate-timeWhen it was created (ISO 8601).
The hook returned when you create it: the secret appears only in this response.
Fields
iduuidId (uuid).
eventenumEvent type.
task.createdtask.updatedtask.completedtask.assignedcomment.createdproject.createdtarget_urluriThe HTTPS URL events are sent to.
project_iduuidnullableProject id; null takes the task out of its project.
assigned_to_mebooleantrue: only tasks assigned to you (task.assigned always is).
enabledbooleanWhether it’s on; true resets the failure counter.
failure_countintegerFailed deliveries in a row.
disabled_reason"failing"nullablefailing: switched off after failures in a row.
last_delivery_atdate-timenullableLatest delivery attempt.
last_success_atdate-timenullableLatest successful delivery.
created_atdate-timeWhen it was created (ISO 8601).
secretstringThe signing secret (whsec_…); only in this response, once.
List hooks
/api/v1/hooksThe hooks this key or connection has set up.
Responses
- 200
OK
Returns a page of: The hook object
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Create a hook
/api/v1/hooksSubscribes a URL to an event; the signing secret is returned once, in this response only. You only receive what you can see in the app. task.* and comment.created need tasks:read, project.created needs projects:read. At most 100 hooks per person and workspace; a 410 Gone answer deletes the hook.
Request body
eventenumrequiredEvent type.
task.createdtask.updatedtask.completedtask.assignedcomment.createdproject.createdtarget_urlurirequiredThe HTTPS URL events are sent to.
Up to 500 characters
project_iduuidOnly tasks and comments of this project.
assigned_to_mebooleantrue: only tasks assigned to you (task.assigned always is).
Responses
- 201
Created
Returns: Hook with signing secret
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
Delete a hook
/api/v1/hooks/{id}Removes the subscription; no more requests from now on.
Path parameters
iduuidrequiredThe record’s id (uuid).
Responses
- 204
No content
No body on success.
- 4xx
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
List recent comments
/api/v1/commentsThe latest comments you can see in the workspace, newest first, each with its task. Built for “new comment” triggers: since returns only newer ones, project and task narrow the list.
Query parameters
projectuuidProject id; none for tasks without a project.
taskstringTask number (42) or task id.
Up to 64 characters
sincedate-timeOnly comments written at or after this time (ISO 8601).
limitintegerMost records on a page.
Default: 50 · Between 1 and 200
cursorstringnext_cursor from the previous response.
Up to 200 characters
Responses
OK
Returns a page of: Comment with its task
Failed requests return the one error object. Errors
400 · 401 · 403 · 404 · 429
/api/v1/comments