Every route

Every route the server registers that is not documented in full above, with every optional module switched on. internal routes are not for integrations; every /api/v1 route is one unless the meta file says otherwise. undocumented routes have no description here yet; nothing about them is promised.

The Auth column is the guard the route sits behind. Session or token routes accept the web app's session or an API token. Session routes refuse a token. Instance admin routes are for the person who runs the server. No login guard routes are sign-in and sign-up, pages opened by a secret link, and endpoints that check a credential of their own, such as /mcp and /scim/v2. A handler can refuse more than its guard does.

Version 2

Method	Path	Auth	Status	Summary
GET	/api/v2/agent-sessions	Session or token	internal	Lists the outside agent sessions of a task.
POST	/api/v2/agent-sessions	Session or token	internal	Hands a task to an outside agent.
GET	/api/v2/agent-sessions/endpoints	Session or token	internal	Reads where outside agents are reached.
PUT	/api/v2/agent-sessions/endpoints	Session or token	internal	Changes where outside agents are reached.
POST	/api/v2/agents	Session or token	undocumented	Creates an agent.
PUT	/api/v2/agents/:id	Session or token	undocumented	Changes an agent.
DELETE	/api/v2/agents/:id	Session or token	undocumented	Deletes an agent.
POST	/api/v2/agents/:id/pause	Session or token	undocumented	Pauses an agent.
POST	/api/v2/agents/:id/resume	Session or token	undocumented	Resumes an agent.
GET	/api/v2/agents/:id/revisions	Session or token	undocumented	Lists an agent's revisions.
POST	/api/v2/agents/:id/revisions	Session or token	undocumented	Creates a revision of an agent.
GET	/api/v2/agents/:id/revisions/:n	Session or token	undocumented	Reads one revision.
POST	/api/v2/agents/:id/revisions/:n/promote	Session or token	undocumented	Makes a revision the live one.
POST	/api/v2/agents/:id/revisions/:n/rollback	Session or token	undocumented	Copies an older revision forward and makes it live.
GET	/api/v2/agents/:id/schedules	Session or token	undocumented	Lists an agent's schedules.
POST	/api/v2/agents/:id/schedules	Session or token	undocumented	Creates a schedule for an agent.
PUT	/api/v2/agents/:id/schedules/:scheduleId	Session or token	undocumented	Changes a schedule.
DELETE	/api/v2/agents/:id/schedules/:scheduleId	Session or token	undocumented	Deletes a schedule.
GET	/api/v2/agents/account	Session or token	undocumented	Reads the caller's linked AI account.
PUT	/api/v2/agents/account	Session or token	undocumented	Links the caller's AI account.
DELETE	/api/v2/agents/account	Session or token	undocumented	Unlinks the caller's AI account.
GET	/api/v2/agents/alerts	Session or token	undocumented	Open agent incidents and recently resolved ones.
POST	/api/v2/agents/alerts/evaluate	Session or token	undocumented	Runs the alert check now.
GET	/api/v2/agents/budget	Session or token	undocumented	This month's agent spend against the budget.
GET	/api/v2/agents/changes	Session	undocumented	What the caller's own connected agent just changed, for the audit ids in ids (at most 50), with whether each can still be undone. For a signed-in person.
POST	/api/v2/agents/chat/direct	Session or token	undocumented	Opens the caller's conversation with an agent.
GET	/api/v2/agents/chat/usable	Session or token	undocumented	The agents the caller may mention in a conversation.
GET	/api/v2/agents/connected	Session	undocumented	Each member's connected AI, for a signed-in member. With taskId, only the caller's own AI, and only where the caller may hand that task to it.
POST	/api/v2/agents/draft	Session or token	undocumented	Drafts a new agent; nothing is stored.
GET	/api/v2/agents/manifest	Session or token	undocumented	What workflows and rules bind an agent by.
PUT	/api/v2/agents/memory/:id	Session or token	undocumented	Changes a remembered item.
GET	/api/v2/agents/memory/project/:projectId	Session or token	undocumented	Reads what agents remember about a project.
POST	/api/v2/agents/memory/project/:projectId	Session or token	undocumented	Adds something for agents to remember about a project.
GET	/api/v2/agents/metrics	Session or token	undocumented	Agent run metrics over a window.
GET	/api/v2/agents/models	Session or token	undocumented	The models an agent may be pinned to.
POST	/api/v2/agents/pause-all	Session or token	undocumented	Pauses every agent.
GET	/api/v2/agents/pipeline	Session or token	undocumented	Tasks an agent has worked on.
GET	/api/v2/agents/policy	Session or token	undocumented	Reads the workspace's agent policy.
PUT	/api/v2/agents/policy	Session or token	undocumented	Changes the workspace's agent policy.
GET	/api/v2/agents/preferences	Session or token	undocumented	Reads the caller's own agent preferences.
PUT	/api/v2/agents/preferences	Session or token	undocumented	Changes the caller's own agent preferences.
GET	/api/v2/agents/project-limits/:projectId	Session or token	undocumented	Reads a project's limits for agents: how many may work at once (atOnce) and whether agents are paused there (paused), with the defaults and the allowed range.
PUT	/api/v2/agents/project-limits/:projectId	Session	undocumented	Changes a project's limits for agents. Send atOnce, paused or both. Pausing takes held work-queue items back and stops the project's running agent runs. For an owner or admin who is signed in.
GET	/api/v2/agents/project-manager/:projectId	Session or token	undocumented	Reads whether a project's manager is on, and the findings from its daily look that the caller may open.
PUT	/api/v2/agents/project-manager/:projectId	Session	undocumented	Turns a project's manager on or off (on). Turning it on looks at the project once straight away. For an owner or admin who is signed in.
GET	/api/v2/agents/project-policy/:projectId	Session or token	undocumented	Reads a project's policy for agents: whether an agent may close a task (done) and how far a connected agent may go on its own (connected), with the workspace defaults and the policy in force.
PUT	/api/v2/agents/project-policy/:projectId	Session	undocumented	Changes a project's policy for agents. Send done, connected or both. For an owner or admin who is signed in.
POST	/api/v2/agents/proposals	Session or token	undocumented	Files a proposal. Only an agent does, in its own name.
POST	/api/v2/agents/proposals/:id/approve	Session or token	undocumented	Approves a proposal.
POST	/api/v2/agents/proposals/:id/decline	Session or token	undocumented	Declines a proposal.
POST	/api/v2/agents/proposals/:id/undo	Session or token	undocumented	Undoes an approved proposal.
GET	/api/v2/agents/registry	Session or token	undocumented	The actions an agent may take.
GET	/api/v2/agents/release	Session or token	undocumented	The release candidate agents have prepared.
GET	/api/v2/agents/reports	Session or token	undocumented	The reports delivered to the caller, newest first.
GET	/api/v2/agents/reports/:id	Session or token	undocumented	Reads one report.
GET	/api/v2/agents/roles	Session or token	undocumented
PUT	/api/v2/agents/roles/:blueprint/:slug/playbook	Session or token	undocumented
DELETE	/api/v2/agents/roles/:blueprint/:slug/playbook	Session or token	undocumented
GET	/api/v2/agents/roles/:blueprint/:slug/skill	Session or token	undocumented
GET	/api/v2/agents/routable	Session or token	undocumented	Open tasks the caller can see, for routing to an agent.
GET	/api/v2/agents/routing-policy	Session or token	undocumented	Reads which model each kind of task prefers.
PUT	/api/v2/agents/routing-policy	Session or token	undocumented	Changes which model each kind of task prefers.
GET	/api/v2/agents/runnable	Session or token	undocumented	The agents the caller may start on a task.
POST	/api/v2/agents/runs	Session or token	undocumented	Starts an agent on a task.
GET	/api/v2/agents/runs/:id/replay	Session or token	undocumented	The prompts and raw responses of a run, for owners and admins.
POST	/api/v2/agents/runs/:id/revert	Session or token	undocumented	Undoes what a run changed.
POST	/api/v2/agents/runs/:id/stop	Session or token	undocumented	Stops a run.
GET	/api/v2/agents/runs/summary	Session or token	undocumented	The open runs and counts by status.
GET	/api/v2/agents/settings	Session or token	undocumented	Reads the workspace's agent settings.
PUT	/api/v2/agents/settings	Session or token	undocumented	Changes the workspace's agent settings.
GET	/api/v2/agents/skills	Session or token	undocumented	Lists skills.
POST	/api/v2/agents/skills	Session or token	undocumented	Creates a skill.
GET	/api/v2/agents/skills/:key	Session or token	undocumented	Reads a skill.
PUT	/api/v2/agents/skills/:key	Session or token	undocumented	Changes a skill.
DELETE	/api/v2/agents/skills/:key	Session or token	undocumented	Retires a skill.
POST	/api/v2/agents/skills/:key/dry-run	Session or token	undocumented	Shows what a skill would read and do, without doing it.
GET	/api/v2/agents/skills/catalogues	Session or token	undocumented	The skill catalogues.
GET	/api/v2/agents/skills/egress-check	Session	undocumented	Whether a host is on the workspace's allowed list.
GET	/api/v2/agents/spend	Session or token	undocumented	What each agent spent in a month.
GET	/api/v2/agents/standing-approvals/:projectId	Session	undocumented	The standing approvals ("Always do this") of a project: every one for an owner or admin, the caller's own for a member. For a signed-in person.
DELETE	/api/v2/agents/standing-approvals/:projectId/:id	Session	undocumented	Removes a standing approval. Its maker, an owner or an admin may remove it. For a signed-in person.
GET	/api/v2/agents/team/standup	Session or token	undocumented	The caller's own standup, from their activity.
POST	/api/v2/agents/work-queue/:itemId/take-back	Session	undocumented	Takes a work-queue item back from the agent that holds it.
GET	/api/v2/agents/work-queue/held	Session or token	undocumented	The tasks an agent holds from the work queue right now, among the tasks the caller can open: the task, its project, the agent's name and since when.
GET	/api/v2/agents/work-queue/task/:taskId	Session or token	undocumented	What the work queue holds about a task: its items, which connected agent has claimed one, and whether the caller may hand the task over.
POST	/api/v2/agents/work-queue/task/:taskId/hand-over	Session	undocumented	Puts a task in the work queue for a connected agent to pick up, in a project whose manager is on.
POST	/api/v2/agents/workspace-guide	Session or token	undocumented
GET	/api/v2/ai-switch	Session or token	internal	Whether AI is on for the workspace.
PUT	/api/v2/ai-switch	Session	internal	Turns AI on or off for the workspace.
GET	/api/v2/api-tokens	Session	internal	Any signed-in member of the workspace may call it, and it lists only that person's own tokens. Answers with data (each token's name, prefix, scopes, state and dates, never the secret) and policy.
POST	/api/v2/api-tokens	Session	internal	Any signed-in member of the workspace may call it, for the caller's own token. Reads name (string), scopes (list from the scopes the server offers) and expiresInDays (number) from the body. Answers with data: the token with its secret, shown once.
PUT	/api/v2/api-tokens/:id	Session	internal	Only the person who owns the token. Reads name (string) and active (boolean) from the body and changes the ones sent; a body with neither answers Nothing to update.. Answers with data: the token.
DELETE	/api/v2/api-tokens/:id	Session	internal	Only the person who owns the token; any other id answers Token not found.. Removes the token and its activity log. Answers with statusText Token deleted. and no data.
GET	/api/v2/api-tokens/:id/logs	Session	internal	Only the person who owns the token; any other id answers Token not found.. Answers with data: the latest 50 calls made with the token, newest first.
POST	/api/v2/api-tokens/:id/renew	Session	internal	Only the person who owns the token, and not with an API token (403). A token that was revoked cannot be renewed. Answers with data: the token with a new secret, shown once, and a new end date.
GET	/api/v2/api-tokens/ai-connection	Session	internal	Whether the signed-in person's own AI app has connected to this workspace, when it last called, and which groups of tools this server offers it. Never a token or an app's name.
POST	/api/v2/api-tokens/mcp	Session	internal	Any signed-in member of the workspace, and not with an API token (403). Reads name (string), mode and provider (strings), projectIds (id list), expiresInDays (number), label (string), scopes and grants (lists) from the body; the account mode must be one the workspace allows. Answers with data: the token, shown once, and the address of the MCP server.
GET	/api/v2/api-tokens/needing-expiry	Session	internal	Owners and admins only, and not with an API token (403). Answers with data: tokens in the workspace that have no expiry date, and the token policy; an empty list while the strict token policy is off.
GET	/api/v2/api-tokens/step-credentials	Session	internal	Any member of the workspace, and not with an API token (403). Answers with data: the live step credentials, owners and admins seeing all of them and others the ones they started, and policy; an empty list while step credentials are off.
GET	/api/v2/assignment-rules/dispatcher/company/flow-board	Session or token	undocumented
GET	/api/v2/assignment-rules/dispatcher/company/org-chart	Session or token	undocumented
GET	/api/v2/assignment-rules/dispatcher/project/:projectId	Session or token	undocumented
PUT	/api/v2/assignment-rules/dispatcher/project/:projectId	Session or token	undocumented
GET	/api/v2/assignment-rules/dispatcher/project/:projectId/needs-routing	Session or token	undocumented
POST	/api/v2/assignment-rules/dispatcher/project/:projectId/rules	Session or token	undocumented
GET	/api/v2/assignment-rules/dispatcher/task/:taskId	Session or token	undocumented
POST	/api/v2/assignment-rules/dispatcher/task/:taskId/decisions/:decisionId/accept	Session or token	undocumented
POST	/api/v2/assignment-rules/dispatcher/task/:taskId/decisions/:decisionId/dismiss	Session or token	undocumented
POST	/api/v2/assignment-rules/dispatcher/task/:taskId/decisions/:decisionId/route	Session or token	undocumented
GET	/api/v2/assignment-rules/dispatcher/team-packs	Session or token	undocumented
POST	/api/v2/assignment-rules/dispatcher/team-packs	Session or token	undocumented
GET	/api/v2/assignment-rules/project/:projectId	Session or token	undocumented	Needs a project the caller can open. Answers with data: rules (entries of person and sentence, fallbackUserId, mode, onCreate, onChange) and ai.state, whether AI is available.
PUT	/api/v2/assignment-rules/project/:projectId	Session or token	undocumented	Needs the permission to change the project's details. Reads entries (a list of at most 50 objects with userId and when, a sentence of at most 300 characters, one per person), fallbackUserId (id or empty), mode (suggest or apply, suggest when left out), onCreate (boolean, true when left out) and onChange (boolean, false when left out) from the body; each person must hold a seat and be able to open the project. Answers with data: the saved rules.
POST	/api/v2/assignment-rules/project/:projectId/draft	Session or token	undocumented	Needs the permission to change the project's details, and AI must be on with a model configured (409 otherwise). Reads userIds (a list of 1 to 10 ids) from the body. Answers with data.drafts: a suggested rule sentence for each person who can open the project, based on their recent tasks there.
GET	/api/v2/assignment-rules/task/:taskId	Session or token	undocumented	Needs a task the caller can open (404 otherwise). Answers with data: decision, the latest open suggestion for the task or null, and pending, whether one is still being worked out.
POST	/api/v2/assignment-rules/task/:taskId/decisions/:decisionId/accept	Session or token	undocumented	Needs the permission to change a task's assignee in the task's project. Assigns the suggested person to the task; 409 when the suggestion was already handled, the task already has an assignee, or the person can no longer open it. Answers with data: the decision.
POST	/api/v2/assignment-rules/task/:taskId/decisions/:decisionId/dismiss	Session or token	undocumented	Needs the permission to change a task's assignee in the task's project. Marks the suggestion dismissed. Answers with data: the decision.
POST	/api/v2/assignment-rules/task/:taskId/decisions/:decisionId/undo	Session or token	undocumented	Needs the permission to change a task's assignee in the task's project. Takes back an accepted suggestion. Answers with data: the decision.
POST	/api/v2/auth/2fa/disable	Session or token	internal	Turns two-factor sign-in off.
POST	/api/v2/auth/2fa/setup	Session or token	internal	Starts two-factor enrolment.
GET	/api/v2/auth/2fa/status	Session or token	internal	Whether two-factor sign-in is on for the signed-in person.
POST	/api/v2/auth/2fa/validate	No login guard	internal	The second step of a two-factor sign-in.
POST	/api/v2/auth/2fa/verify	Session or token	internal	Confirms a code and turns two-factor sign-in on.
PATCH	/api/v2/auth/:id/change-password	Session or token	internal	Changes the signed-in person's password.
POST	/api/v2/auth/activate	No login guard	undocumented
POST	/api/v2/auth/activation/verify	No login guard	undocumented
POST	/api/v2/auth/forgot-password	No login guard	internal	Starts a password reset.
POST	/api/v2/auth/invitation-accept	Session or token	internal	Accepts an invitation while signed in.
POST	/api/v2/auth/invitation-preview	No login guard	internal	Shows what an invitation link is for.
POST	/api/v2/auth/login	No login guard	internal	Signs in with an email and a password.
POST	/api/v2/auth/magic-link	No login guard	internal	Emails a sign-in link.
GET	/api/v2/auth/magic-link/verify	No login guard	internal	Signs in from an emailed link.
POST	/api/v2/auth/platform-login	No login guard	undocumented
POST	/api/v2/auth/reset-password	No login guard	internal	Sets a new password from a reset link.
POST	/api/v2/auth/token-verify-forgotpassword	No login guard	internal	Checks a password reset link.
POST	/api/v2/auth/tracker-code	Session or token	internal	Issues a sign-in code for the desktop time tracker.
GET	/api/v2/automations	Session or token	undocumented	Lists automations.
POST	/api/v2/automations	Session or token	undocumented	Creates an automation.
PUT	/api/v2/automations/:id	Session or token	undocumented	Changes an automation.
DELETE	/api/v2/automations/:id	Session or token	undocumented	Deletes an automation.
POST	/api/v2/automations/:id/dry-run	Session or token	undocumented	Shows what an automation would do on a task, without doing it.
PATCH	/api/v2/automations/:id/enabled	Session or token	undocumented	Switches an automation on or off.
GET	/api/v2/automations/:id/runs	Session or token	undocumented	Lists an automation's runs.
POST	/api/v2/automations/backtest	Session or token	undocumented	Shows what a rule would have done on past events.
POST	/api/v2/automations/compile	Session or token	undocumented	Turns a sentence or a rule into a checked automation.
POST	/api/v2/automations/draft	Session or token	undocumented	Drafts an automation from a sentence.
GET	/api/v2/automations/registry	Session or token	undocumented	The triggers and actions an automation can use.
GET	/api/v2/billing/client-view	Session or token	undocumented	What a project's client sees of its billing.
POST	/api/v2/billing/client-view/message	Session or token	undocumented	Sends a message from the client view.
GET	/api/v2/billing/contract	Session or token	undocumented	Reads a project's billing contract.
PUT	/api/v2/billing/contract	Session or token	undocumented	Changes a project's billing contract.
GET	/api/v2/billing/hourly	Session or token	undocumented	A month's billable hours for a project.
POST	/api/v2/billing/milestone	Session or token	undocumented	Adds a billing milestone.
PATCH	/api/v2/billing/milestone/:id	Session or token	undocumented	Changes a billing milestone.
GET	/api/v2/calls/ice-config	Session or token	internal	The connection settings for a call.
GET	/api/v2/calls/notes	Session or token	undocumented	Lists the caller's own call notes.
POST	/api/v2/calls/notes	Session or token	undocumented	Saves the notes of a call.
GET	/api/v2/calls/notes/:id	Session or token	undocumented	Reads one set of call notes.
PATCH	/api/v2/calls/notes/:id	Session or token	undocumented	Changes a set of call notes.
GET	/api/v2/changelog	No login guard	internal	The product changelog shown in the web app.
POST	/api/v2/checkPermission	No login guard	internal	Checks an invitation link.
POST	/api/v2/company/create	Session or token	internal	Creates a workspace.
POST	/api/v2/company/delete	Session	internal	Deletes a workspace.
DELETE	/api/v2/connectors/google/:connector	Session	internal	Ends the signed-in member's Google connection: revokes the grant with Google and clears the stored tokens.
POST	/api/v2/connectors/google/:connector/complete	Session	internal	Completes the connection the same session started: exchanges the code with the PKCE verifier and keeps the tokens in the secrets store.
POST	/api/v2/connectors/google/:connector/connect	Session	internal	Starts the signed-in member's Google connection and answers Google's consent address. The state is single-use, lasts ten minutes and belongs to this session.
DELETE	/api/v2/connectors/google/:connector/members/:userId	Session	internal	For an owner or admin: ends a member's Google connection.
GET	/api/v2/connectors/google/members	Session	internal	For an owner or admin: which members hold a Google connection, with its scopes, dates and state. Never the account or a token.
GET	/api/v2/connectors/google/mine	Session	internal	Shows the signed-in member's own Google connections: the account's email, the granted scopes, the dates and the state. Never a token or its handle.
GET	/api/v2/connectors/slack	Session	internal	Shows the workspace's Slack connector: whether each secret is set and since when, the channel list and, for each allowed channel, whether agents may read it or post to it. Never a secret.
PUT	/api/v2/connectors/slack/channels	Session	internal	Sets, for each allowed Slack channel, whether agents may read it, propose a message to it, or both.
POST	/api/v2/connectors/slack/channels/refresh	Session	internal	Reads the Slack channel list again.
PUT	/api/v2/connectors/slack/secrets	Session	internal	Stores the Slack bot token or signing secret in the secrets store, after checking the token with Slack.
DELETE	/api/v2/connectors/slack/secrets/:key	Session	internal	Removes a Slack connector secret.
POST	/api/v2/createUser	No login guard	internal	Signs up.
POST	/api/v2/csp-report	No login guard	internal	Receives a browser's content security policy report.
POST	/api/v2/custom-fields/:fieldId/ai/apply	Session or token	undocumented	Any signed-in member of the workspace who can edit that field on the task. Reads proposalIds (a list of up to 5 ids from a preview the same person made) from the body; an expired one is refused. Answers with data: applied (task ids) and refused (with a reason each).
POST	/api/v2/custom-fields/:fieldId/ai/jobs	Session or token	undocumented	Any signed-in member of the workspace who can edit that field on the tasks. Reads taskIds (a list of ids, up to the workspace's bulk limit) and proposalIds (a list of up to 5 ids) from the body. The fill runs in the background. Answers with data: the job.
POST	/api/v2/custom-fields/:fieldId/ai/preview	Session or token	undocumented	Any signed-in member of the workspace who can edit that field on the task; a task they cannot edit it on comes back with a reason instead. Reads taskIds (a list of 1 to 5 ids) from the body. Nothing is written. Answers with data.proposals: for each task, a proposalId, the proposed text and fieldValue.
POST	/api/v2/custom-fields/:fieldId/delete	Session or token	undocumented	Needs the same rights as the usage read; a connected agent is refused. Takes the field and every value of it away for good; archiving (the field update with isDelete) hides a field and keeps its values. A field that a rollup or a formula reads answers 409 with the code FIELD_IS_READ and the same readBy and readElsewhere. Answers with data.tasks: how many tasks the caller could open held a value.
GET	/api/v2/custom-fields/:fieldId/usage	Session or token	undocumented	Needs the permission to edit custom fields in the field's projects, and the field setting for a field of every project. Answers with data: tasks (how many tasks the caller can open hold a value), partial (true when the caller cannot open every task), readBy (the titles of the rollups and formulas that read this field) and readElsewhere (true when a field of a project the caller cannot open reads it). An unknown id answers 404.
GET	/api/v2/custom-fields/ai/jobs/:jobId	Session or token	undocumented	Any signed-in member of the workspace, and only for a job that person started; any other id answers 404 Job not found.. Answers with data: the job and its progress.
POST	/api/v2/custom-fields/compute	Session or token	undocumented	Needs the permission to change a task's custom field. Reads taskIds (a list of 1 to 200 ids) and scope (sprint or left out) from the body; only tasks the caller can open are computed. Answers with data: updated, the computed values and errors.
GET	/api/v2/custom-fields/formula/scope	Session or token	undocumented	Any signed-in member of the workspace may call it. Reads projectId (id) and taskId (id, used only when the caller can open the task) from the query. Answers with data: names a formula may use, with the task's values when a task is named, and the lists of functions and rollupFunctions.
POST	/api/v2/custom-fields/formula/validate	Session or token	undocumented	Any signed-in member of the workspace may call it. Reads expression (string, required), fieldId, fieldTitle, projectId (ids and string) and sample (an object of values to try it on) from the body. A formula that does not parse or that closes a cycle answers a failed status with a code. Answers with data: references, functions, preview and previewError.
POST	/api/v2/deleteManualLogtime	Session or token	undocumented	Deletes a manual time entry. Needs a task the caller can open. Reads timeSheetId, logTimeDate, dateFormat, startLogTime, endLogTime, projectId, ticketId, sprintId, taskName and projectName from the body, all required, plus timeDuration (minutes), userId and folderId. Deleting another person's entry needs the Everyone grant on the user timesheet and an open project, else 403. An entry in an approved, locked period is refused. Answers with statusText Logtime deleted successfully. It also writes task history and a notification.
GET	/api/v2/epics	Session or token	undocumented	Needs a project the caller can open, named by the query field projectId (id). Answers with data: the project's epics, oldest first, with taskCount and completedCount counted over the tasks the caller can open.
POST	/api/v2/epics	Session or token	undocumented	Needs the permission to create tasks in the project named by projectId. Reads name (string, required), projectId (id, required), description, color, priority, ownerUserId (strings), startDate and dueDate from the body; a failed check answers a failed status with the reason. Answers with data: the new epic.
PUT	/api/v2/epics/:id	Session or token	undocumented	Needs the permission to create tasks in the epic's project. Reads name, color, description, status, priority, ownerUserId, startDate and dueDate from the body and changes the ones sent; a body with none of them answers a failed status. Answers with data: the epic as it is now.
DELETE	/api/v2/epics/:id	Session or token	undocumented	Needs the permission to create tasks in the epic's project. The epic is marked deleted and its tasks are unlinked from it. Answers with statusText Epic deleted. and no data.
POST	/api/v2/epics/:id/recount	Session or token	undocumented	Needs the permission to create tasks in the epic's project. Counts the epic's tasks again and answers with data: the epic with taskCount and completedCount, counted for tasks the caller can open.
POST	/api/v2/epics/assign	Session or token	undocumented	Needs the permission to create tasks in the projects of both the task and the epic. Reads taskId (id) and epicId (id, or empty or null to take the task out) from the body; a task the caller cannot open, or an epic that does not exist, answers a failed status. Answers with data: taskId and epicId.
GET	/api/v2/exports	Session or token	undocumented	Any signed-in member of the workspace may call it, and it lists only the caller's own exports (a uid of someone else answers 403). Answers with data: up to 20 exports, newest first, each with type, format, status, fileName, total, processed, error and createdAt.
POST	/api/v2/exports	Session or token	undocumented	Any signed-in member of the workspace who can list the project's tasks (404 otherwise). Reads format (csv or xlsx), projectId (id), sprintId (id, optional) and projectName (string) from the body. The export runs in the background. Answers with data: the job.
GET	/api/v2/exports/:id/download	Session or token	undocumented	Any signed-in member of the workspace may call it, for an export the caller started; a workspace export also needs the owner or admin role. Answers with the file once the export has finished, and 404 Export not ready. before that.
POST	/api/v2/exports/workspace	Session or token	undocumented	Owners and admins only. Reads format (csv or xlsx, xlsx when left out) from the body. The export runs in the background. Answers with data: the job's _id, type, format, status, fileName and createdAt.
GET	/api/v2/forms	Session or token	undocumented	Needs a project the caller can open, named by the query field projectId (id); otherwise 404. Answers with data: the project's forms, newest first, each with title, description, sprintId, state and submissionCount.
POST	/api/v2/forms	Session or token	undocumented	Needs edit rights on the project named in the body (403 without them, 404 when it cannot be seen). Reads title (string, required), projectId (id, required), description (string) and sprintId (id) from the body. The form starts as a draft with no questions. Answers with data: the form.
GET	/api/v2/forms/:id	Session or token	undocumented	Needs a project the caller can open; otherwise 404 Form not found.. Answers with data: the form with its questions, and its public url while it is live.
PUT	/api/v2/forms/:id	Session or token	undocumented	Needs edit rights on the form's project. Reads title, description, successMessage (strings), sprintId (id), questions (list), defaults (object) and state from the body and changes the ones sent; a failed check answers a failed status with the reason. Answers with data: the form as it is now.
DELETE	/api/v2/forms/:id	Session or token	undocumented	Needs edit rights on the form's project. A form that is published answers a failed status, and must be taken offline first. The form is marked deleted and the tasks it filed are kept. Answers with statusText Form deleted. and no data.
POST	/api/v2/forms/:id/publish	Session or token	undocumented	Needs edit rights on the form's project (403 without them, 404 when the project cannot be seen). Reads publish (boolean, true when left out; false takes the form offline) from the body. A form that fails the checks for going live answers a failed status with the reason. Answers with data: state and, when live, token and url.
GET	/api/v2/forms/:id/submissions	Session or token	undocumented	Needs edit rights on the form's project, because submissions hold the submitters' answers. Reads q (string, up to 120 characters, matched against every answer), page and limit (numbers, 10 per page by default and at most 100) and all (1 returns up to 5000 rows for an export) from the query. Answers with data: submissions, total, page, pages and truncated.
GET	/api/v2/forms/fields	Session or token	undocumented	Any signed-in member of the workspace may call it. Answers with data: the questions a form can ask, as groups, the widgets, spans, gridColumns and the task fields a question can be mapped to.
POST	/api/v2/generateToken	No login guard	internal	Exchanges a refresh token for a new access token.
POST	/api/v2/github-signup	No login guard	internal	Signs in or up with GitHub.
POST	/api/v2/gitlab-signup	No login guard	internal	Signs in or up with GitLab.
USE	/api/v2/goals	Session or token	internal	Runs before every goal route: reads pass through, and a write (POST, PATCH, PUT or DELETE) made with an agent's token is judged by the rules that hold that agent.
POST	/api/v2/google-signup	No login guard	internal	Signs in or up with Google.
GET	/api/v2/imports	Session or token	undocumented	Lists imports.
POST	/api/v2/imports/asana	Session or token	undocumented	Imports from Asana.
POST	/api/v2/imports/clickup	Session or token	undocumented	Imports from ClickUp.
POST	/api/v2/imports/clickup/preview	Session or token	undocumented	Previews a ClickUp import.
POST	/api/v2/imports/clickup/project	Session or token	undocumented	Imports a ClickUp export as a new project.
POST	/api/v2/imports/csv	Session or token	undocumented	Imports tasks from a CSV file.
POST	/api/v2/imports/csv/preview	Session or token	undocumented	Previews a CSV import.
POST	/api/v2/imports/jira	Session or token	undocumented	Imports from Jira.
POST	/api/v2/imports/monday	Session or token	undocumented	Imports from Monday.
POST	/api/v2/imports/trello	Session or token	undocumented	Imports from Trello.
GET	/api/v2/instance/access	Instance admin	internal	Instance administration.
GET	/api/v2/instance/ai/providers	Instance admin	internal	Instance administration.
GET	/api/v2/instance/audit-export	Instance admin	internal	Instance administration.
POST	/api/v2/instance/audit/:companyId/redact-person	Instance admin	internal	Instance administration.
GET	/api/v2/instance/backups	Instance admin	internal	Instance administration.
POST	/api/v2/instance/backups	Instance admin	internal	Instance administration.
DELETE	/api/v2/instance/backups/:name	Instance admin	internal	Instance administration.
GET	/api/v2/instance/backups/:name/download	Instance admin	internal	Instance administration.
GET	/api/v2/instance/backups/:name/manifest	Instance admin	internal	Instance administration.
POST	/api/v2/instance/backups/:name/restore	Instance admin	internal	Instance administration.
GET	/api/v2/instance/companies	Instance admin	internal	Instance administration.
GET	/api/v2/instance/csp	Instance admin	internal	Instance administration.
GET	/api/v2/instance/egress	Instance admin	internal	Instance administration.
PUT	/api/v2/instance/egress/:companyId	Instance admin	internal	Instance administration.
GET	/api/v2/instance/enforcement	Instance admin	internal	Instance administration.
GET	/api/v2/instance/enforcement/:companyId/decisions	Instance admin	internal	Instance administration.
PUT	/api/v2/instance/enforcement/:companyId/mode	Instance admin	internal	Instance administration.
PUT	/api/v2/instance/enforcement/default	Instance admin	internal	Instance administration.
GET	/api/v2/instance/health	Instance admin	internal	Instance administration.
GET	/api/v2/instance/instruction-patterns	Instance admin	internal	Instance administration.
POST	/api/v2/instance/instruction-patterns	Instance admin	internal	Instance administration.
DELETE	/api/v2/instance/instruction-patterns/:id	Instance admin	internal	Instance administration.
GET	/api/v2/instance/knowledge	Instance admin	internal	Instance administration.
GET	/api/v2/instance/knowledge/:companyId	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/erase/document	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/erase/person	Instance admin	internal	Instance administration.
GET	/api/v2/instance/knowledge/:companyId/exclusions	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/exclusions/:exclusionId/remove	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/reembed	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/reindex	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/reindex/cancel	Instance admin	internal	Instance administration.
POST	/api/v2/instance/knowledge/:companyId/retry-files	Instance admin	internal	Instance administration.
GET	/api/v2/instance/logs	Instance admin	internal	Instance administration.
GET	/api/v2/instance/logs/download	Instance admin	internal	Instance administration.
GET	/api/v2/instance/logs/files	Instance admin	internal	Instance administration.
POST	/api/v2/instance/maintenance	Instance admin	internal	Instance administration.
GET	/api/v2/instance/metrics	Instance admin	internal	Instance administration.
POST	/api/v2/instance/migrations/run	Instance admin	internal	Instance administration.
GET	/api/v2/instance/orphan-databases	Instance admin	internal	Instance administration.
POST	/api/v2/instance/orphan-databases/:name/drop	Instance admin	internal	Instance administration.
GET	/api/v2/instance/public-config	No login guard	internal	What the sign-in page needs to know about the instance.
POST	/api/v2/instance/restart	Instance admin	undocumented
GET	/api/v2/instance/settings	Instance admin	internal	Instance administration.
PUT	/api/v2/instance/settings	Instance admin	internal	Instance administration.
POST	/api/v2/instance/settings/test	Instance admin	internal	Instance administration.
GET	/api/v2/instance/stats	Instance admin	internal	Instance administration.
GET	/api/v2/instance/support-access	Instance admin	undocumented
GET	/api/v2/instance/upgrade	Instance admin	internal	Instance administration.
GET	/api/v2/intake	Session or token	undocumented	Lists submissions waiting for review.
POST	/api/v2/intake/review	Session or token	undocumented	Accepts or rejects a submission.
GET	/api/v2/invoices	Session or token	undocumented	Lists a project's invoices.
GET	/api/v2/invoices/:id	Session or token	undocumented	Reads an invoice.
PUT	/api/v2/invoices/:id	Session or token	undocumented	Changes a draft invoice.
DELETE	/api/v2/invoices/:id	Session or token	undocumented	Deletes a draft invoice.
POST	/api/v2/invoices/:id/paid	Session or token	undocumented	Marks an invoice as paid.
POST	/api/v2/invoices/:id/send	Session or token	undocumented	Issues an invoice.
POST	/api/v2/invoices/draft-from-milestone	Session or token	undocumented	Drafts an invoice from a milestone.
POST	/api/v2/invoices/draft-from-month	Session or token	undocumented	Drafts an invoice from a month of logged time.
POST	/api/v2/logout	Session or token	internal	Signs out.
POST	/api/v2/manualLogtime	Session or token	undocumented	Adds a manual time entry to a task, or edits one. Needs a task the caller can open. Reads logTimeDate, description, startLogTime, endLogTime, timeDuration (a string like HH:MM), ticketId, projectId, isEdit (a boolean), dateFormat, taskName, projectName, sprintId and timeZone from the body, all required, plus timeSheetId and previousLoggedTime when isEdit is true. Optional: userId, billable, folderId, companyOwnerId. Logging for another person needs the Everyone grant on the user timesheet and the project must be open to the caller, else 403. The person must be a member (400). An entry in an approved, locked period is refused. Answers with statusText Logtime added successfully and data: the saved entry. It also writes task history and a notification.
GET	/api/v2/oauth-client-approvals	Session	internal	Lists OAuth clients waiting for approval.
POST	/api/v2/oauth-client-approvals/approve	Session	internal	Approves an OAuth client.
POST	/api/v2/oauth-client-approvals/deny	Session	internal	Denies an OAuth client.
POST	/api/v2/oauth-client-approvals/revoke	Session	internal	Revokes an approval.
GET	/api/v2/oauth-clients	Session	internal	Lists the workspace's OAuth clients.
POST	/api/v2/oauth-clients	Session	internal	Registers an OAuth client.
DELETE	/api/v2/oauth-clients/:clientId	Session	internal	Revokes an OAuth client.
GET	/api/v2/oauth-grants	Session	internal	Lists the caller's own OAuth grants.
DELETE	/api/v2/oauth-grants/:grantId	Session	internal	Revokes one of the caller's OAuth grants.
POST	/api/v2/oauth-grants/:grantId/withdraw	Session	internal	Withdraws some of the permissions the caller gave a connected app.
PUT	/api/v2/pages/:id/approve	Session or token	undocumented	Needs edit rights on the page, and a share by name as editor is not enough; a person must make the call. Only a page an agent drafted can be approved, else a failed status. Answers with data: the page.
GET	/api/v2/pages/:id/comments	Session or token	undocumented	Any signed-in member who may read the page. Answers with data: the page's comments, oldest first, up to 500, with limit and atLimit.
POST	/api/v2/pages/:id/comments	Session or token	undocumented	Any signed-in member who may read the page. Reads message (string), blockId (string), parentId (id of a comment to reply under) and an attached file as mediaURL, mediaOriginalName and mediaSize from the body. A page holds at most 500 comments (409). Answers with data: the comment.
PUT	/api/v2/pages/:id/comments/:commentId	Session or token	undocumented	Only the comment's author, who must be able to read the page (403 for anyone else). Reads message (string) from the body. Answers with data: the comment as it is now.
DELETE	/api/v2/pages/:id/comments/:commentId	Session or token	undocumented	The comment's author or an admin, who must be able to read the page. A thread is deleted with its replies. Answers with data._id: the id of the comment.
PUT	/api/v2/pages/:id/comments/:commentId/resolve	Session or token	undocumented	Any signed-in member who may read the page; a thread that has an assignee can be resolved only by the assignee, the person who assigned it or an admin, and a reply cannot be resolved (400). Reads resolved (boolean, true when left out; false reopens the thread) from the body. Answers with data: the comment.
POST	/api/v2/pages/:id/images	Session or token	undocumented	Needs edit rights on the page. Takes a multipart body with the image as file. Answers with data.key: the key to put in the page's image block.
PUT	/api/v2/pages/:id/review	Session or token	undocumented	Needs edit rights on the page, and a share by name as editor is not enough. Reads nextReviewDate (a date, three months ahead when left out) from the body, marks the page as a wiki page reviewed now by the caller, and answers with data: the page.
GET	/api/v2/pages/:id/shares	Session or token	undocumented	Only the page's author, or an owner or admin who can open it (403 for anyone else). Answers with data: people, each with userId, role, by, at and active, and limit.
PUT	/api/v2/pages/:id/shares/:userId	Session or token	undocumented	Only the page's author, or an owner or admin who can open it. Reads role (viewer or editor, viewer when left out) from the body; the person must be an active member of the workspace, and a page can be shared with a limited number of people (400 otherwise). Answers with data: the list of people the page is shared with.
DELETE	/api/v2/pages/:id/shares/:userId	Session or token	undocumented	Only the page's author, or an owner or admin who can open it. Answers with data: the list of people the page is still shared with.
POST	/api/v2/pages/ai	Session or token	undocumented	Any signed-in member of the workspace may call it. Reads action, title, instruction and currentText (strings) and pageId (id of a page the caller may read, whose title and text fill in what is left out) from the body. Answers with data: the composed text, or a failed status with the reason, and isNotAi when no AI is set up.
GET	/api/v2/pages/ai-status	Session or token	undocumented	Any signed-in member of the workspace may call it. Answers with data.configured: whether an AI provider is set up for writing pages.
GET	/api/v2/plan/usage	Session or token	undocumented
GET	/api/v2/plan/workspaces	Session or token	undocumented
PUT	/api/v2/platform/config	Platform key	undocumented
PUT	/api/v2/platform/entitlements	Platform key	undocumented
POST	/api/v2/platform/lifecycle	Platform key	undocumented
POST	/api/v2/platform/owner/activation-link	Platform key	undocumented
POST	/api/v2/platform/owner/login-link	Platform key	undocumented
POST	/api/v2/platform/owner/transfer	Platform key	undocumented
POST	/api/v2/platform/provision	Platform key	undocumented
POST	/api/v2/platform/rotate-key	Platform key	undocumented
GET	/api/v2/platform/status	Platform key	undocumented
POST	/api/v2/platform/support-session	Platform key	undocumented
DELETE	/api/v2/platform/support-session	Platform key	undocumented
GET	/api/v2/platform/usage	Platform key	undocumented
POST	/api/v2/prepare-notification-data	Session or token	internal	Prepares notification data for the web app.
GET	/api/v2/provider-keys	Session	internal	Lists the workspace's AI provider keys, by handle only.
PUT	/api/v2/provider-keys/:provider	Session	internal	Stores a workspace AI provider key.
DELETE	/api/v2/provider-keys/:provider	Session	internal	Removes a workspace AI provider key.
GET	/api/v2/public-shares	Session or token	undocumented	Lists the public links of something.
POST	/api/v2/public-shares	Session or token	undocumented	Creates a public link to a list, a report or a page.
PUT	/api/v2/public-shares/:id	Session or token	undocumented	Switches a public link on or off.
DELETE	/api/v2/public-shares/:id	Session or token	undocumented	Revokes a public link.
POST	/api/v2/reactions	Session or token	undocumented	Any signed-in member of the workspace who can read the target. Reads targetType (task or comment), targetId (id), emoji (string) and isProjectComment (boolean) from the body; the caller's own reaction is added, or removed if it is already there. A target the caller cannot read answers 404. Answers with data.reactions: the target's reactions.
GET	/api/v2/recent-visits	Session or token	internal	Any signed-in member of the workspace may call it, and it lists that person's own visits. Reads types (a comma list of task, project, sprint and doc, or all; tasks only when left out) and limit (a number) from the query. Visits to anything deleted or no longer open to the caller drop out. Answers with data: the newest visits first.
POST	/api/v2/recent-visits	Session or token	internal	Any signed-in member of the workspace may call it, and it records a visit for that person only. Reads entityType (task, project, sprint or doc) and entityId (id) from the body. Answers with statusText Visit recorded. and no data.
DELETE	/api/v2/sample-data	Session or token	internal	Removes the sample data a new workspace starts with.
GET	/api/v2/scim/config	Session or token	internal	Reads the workspace's SCIM settings.
PUT	/api/v2/scim/config	Session or token	internal	Changes the workspace's SCIM settings.
POST	/api/v2/scim/token	Session or token	internal	Issues a new SCIM token for the workspace.
POST	/api/v2/search	Session or token	undocumented	Any signed-in member of the workspace may call it. Reads query (string) from the body and matches it against task names and keys, project names, comment text and page titles, within the projects, lists and pages the caller can open. Answers with data: tasks, projects, comments and pages, each limited in number.
GET	/api/v2/secrets	Session	internal	Lists the workspace's secrets, by handle only.
POST	/api/v2/secrets	Session	internal	Stores a workspace secret.
POST	/api/v2/secrets/:handle/revoke	Session	internal	Revokes a workspace secret.
POST	/api/v2/secrets/:handle/rotate	Session	internal	Replaces a workspace secret.
POST	/api/v2/sendForgotPasswordEmail	No login guard	internal	Emails a password reset link.
POST	/api/v2/sendInvitationEmail	Session or token	internal	Invites people to the workspace.
POST	/api/v2/sendVerificationEmail	No login guard	internal	Emails a verification link.
DELETE	/api/v2/session/delete	Session or token	internal	Ends the person's sessions.
DELETE	/api/v2/session/delete/:id	Session or token	internal	Ends one session.
PUT	/api/v2/session/update	Session or token	internal	Updates the current session's record.
POST	/api/v2/setup/complete	No login guard	internal	Finishes the first-run setup.
GET	/api/v2/setup/events/:id	No login guard	internal	The progress stream of the first-run setup.
GET	/api/v2/setup/status	No login guard	internal	Whether the instance has been set up.
POST	/api/v2/sprints/backlog	Session or token	undocumented	Needs a project the caller can open. Reads projectId (id) from the body. Answers with data: the project's backlog list, which is made first if it does not exist.
POST	/api/v2/sprints/burndown	Session or token	undocumented	Needs a project the caller can open and a list the caller can see. Reads sprintId (id) from the body. Answers with data: the sprint's name, state, goal and dates, its totals of tasks, estimate and points, and a days series with the ideal line.
POST	/api/v2/sprints/complete	Session or token	undocumented	Needs write access to the list's project and the permission to create lists there; a person must make the call. Reads sprintId (id) and incompleteDestination (next, backlog or the id of an open sprint of the same project, next when left out) from the body. Unfinished tasks move to the destination. Answers with data: the completed sprint; a sprint already completed answers success and moves nothing.
GET	/api/v2/sprints/complete-preview	Session or token	undocumented	Needs a project the caller can open and a list the caller can see. Reads sprintId (id) from the query; a list that is not a sprint answers a failed status. Answers with data: the sprint's state, commitment, tasks added after the start, and the counts of finished work and of unfinished work with a list of it.
POST	/api/v2/sprints/hours	Session or token	undocumented	Needs a project the caller can open and a list the caller can see. Reads sprintId (id) from the body. Answers with data: plannedMinutes, loggedMinutes and overdueMinutes, the minutes the sprint is projected to run over its plan.
GET	/api/v2/sprints/report	Session or token	undocumented	Needs a project the caller can open and a list the caller can see. Reads sprintId (id) from the query; a list that is not a sprint answers a failed status. Answers with data: the sprint's state, goal and dates, and the totals of what was committed, completed and left unfinished, with the tasks added after the start and those moved out.
POST	/api/v2/sprints/scrum	Session or token	undocumented	Needs write access to the list's project and the permission to create lists there; a person must make the call. Reads sprintId (id), isScrum (boolean; false turns Scrum off), goal (string), startDate and endDate (dates, both or neither, the end after the start) from the body. A completed sprint cannot be edited, and a running one cannot have Scrum turned off. Answers with data: the sprint.
POST	/api/v2/sprints/start	Session or token	undocumented	Needs write access to the list's project and the permission to create lists there; a person must make the call. Reads sprintId (id) from the body. The list must be a sprint with a start and end date, and a project runs one sprint at a time; the tasks in it become the sprint's commitment. Answers with data: the started sprint, or a failed status with the reason.
GET	/api/v2/sso/config	Session or token	internal	Reads the workspace's single sign-on settings.
PUT	/api/v2/sso/config	Session or token	internal	Changes the workspace's single sign-on settings.
POST	/api/v2/sso/config/verify-domain	Session or token	internal	Checks the DNS record of a single sign-on domain.
GET	/api/v2/sso/discover	No login guard	internal	Finds the single sign-on workspace for an email's domain.
GET	/api/v2/sso/oidc/callback	No login guard	internal	Finishes an OpenID Connect sign-in.
GET	/api/v2/sso/oidc/initiate	No login guard	internal	Starts an OpenID Connect sign-in.
GET	/api/v2/sso/public	No login guard	internal	What the sign-in page needs to offer single sign-on.
POST	/api/v2/sso/saml/acs	No login guard	internal	Receives the SAML assertion.
GET	/api/v2/sso/saml/initiate	No login guard	internal	Starts a SAML sign-in.
GET	/api/v2/sso/saml/metadata	No login guard	internal	The SAML service provider metadata.
POST	/api/v2/support-mail	Session or token	internal	Sends a message to support from the web app.
GET	/api/v2/task-templates	Session or token	undocumented	Any signed-in member of the workspace may call it. Reads projectId (id, optional) from the query: with it, the workspace's templates and that project's, for a project the caller can open; without it, the workspace's templates and those of every project the caller can open. Answers with data, sorted by name, each with name, scope, projectId, isDefault, canManage and a count of what it carries.
POST	/api/v2/task-templates	Session or token	undocumented	Allowed for owners and admins when scope is workspace, and otherwise for those who can create tasks in the task's project. Reads name (string, required), scope (project or workspace, project when left out), taskId (id of the task to copy from, required) and include (an object of booleans, where false leaves a part out) from the body. Answers with data: the template.
PATCH	/api/v2/task-templates/:id	Session or token	undocumented	Allowed for owners and admins on a workspace template, and for those who can create tasks in the project on a project template. Reads name (string, required) from the body. Answers with statusText Template renamed. and no data.
DELETE	/api/v2/task-templates/:id	Session or token	undocumented	Allowed for owners and admins on a workspace template, and for those who can create tasks in the project on a project template. The template is marked deleted and is no longer any project's default. Answers with statusText Template deleted. and no data.
POST	/api/v2/task-templates/:id/apply	Session or token	undocumented	Needs the permission to create tasks in the task's project; fields the caller's role may not change are skipped and named. Reads taskId (id, required), overwrite and preview (booleans) from the body; with preview true nothing is written. Answers with data: applied, conflicts, skipped, checklistAdded and subtasksCreated.
PUT	/api/v2/task-templates/default	Session or token	undocumented	Needs the permission to change the project's details. Reads projectId (id, required) and templateId (id, or empty to clear the default) from the body; the template must be a workspace one or that project's. Answers with statusText saying whether a default was set or cleared.
POST	/api/v2/tasks/bulk	Session or token	undocumented	Runs one change on many tasks at once. The caller must be able to open every task in taskIds and hold the permission for the chosen action in their projects, for example task.task_status for bulkUpdateStatus, task.task_delete for bulkDelete, task.task_archive for bulkArchive, task.task_move for bulkMove. Reads action (string, must start with bulk and be a known bulk action such as bulkUpdateStatus, bulkUpdatePriority, bulkUpdateDueDate, bulkUpdateStartDate, bulkUpdateDates, bulkUpdateAssignee, bulkUpdateTags, bulkArchive, bulkRestore, bulkDelete, bulkTrash, bulkMove, bulkConvertToSubTask, bulkConvertToTask, bulkAddToList, bulkDuplicate) and taskIds (list of ids) from the body, plus the fields that action takes, such as newStatus, firebaseObj, DueDate, startDate, employeeId, tagId, sprintObj, projectData, parentTaskId. Answers with data: updated, skipped (task id and reason), errors, totals (counts of each), and statusText 'Bulk operation completed'. A bad or unknown action answers status false with 'Invalid bulk action' or 'Unknown bulk action'. A task or destination the caller cannot open answers 404, a missing permission answers 403.
POST	/api/v2/tasks/relations	Session or token	undocumented	Links two tasks, unlinks them, or lists a task's links. The caller must be able to open the task, with the task.task_list permission in its project. Reads action (string: add, remove, list or openBlockers) and companyId from the body, then taskId (id, required), and for add and remove also relatedTaskId (id); for add it also reads type (one of blocks, blocked_by, duplicates, duplicated_by, relates_to). Answers with the handler's own envelope: status, statusText and data. For add and remove, data holds taskId, relatedTaskId and relations (only the links the caller can open). For list, data is the linked tasks, each with taskId, type, label, createdBy, createdAt and a short task summary. For openBlockers, data is the blocked_by links whose blocking task is still open. Failures such as a missing task or two tasks already linked answer status false with the error text as statusText. An unknown action answers status false with 'Invalid relation action'.
POST	/api/v2/test	Session or token	internal	Used by the web app.
POST	/api/v2/timeTracker/start	Session or token	internal	Starts a tracker timer on a task. Any signed-in member of the workspace may call it. The caller can only start a timer for themselves; a userId naming someone else answers 403. Reads description, projectId and taskId from the body, all required. A start in an approved, locked period is refused. Answers with statusText: the id of the new time entry.
POST	/api/v2/timesheet-approval/:id/review	Session or token	undocumented	Approves, rejects or reopens a submitted timesheet period. Only an owner or admin may call it; others get status false. Reads id (the approval record id) from the path and action (approve, reject or reopen) and reason (string, needed to reject) from the body. The record must be in a state that allows the action. An owner or admin may approve their own week, and the record is marked as self approved. Answers with statusText like Timesheet approved. and data: the updated record.
POST	/api/v2/timesheet-approval/bulk-review	Session or token	undocumented	Approves or rejects several submitted timesheet periods at once. Only an owner or admin has any effect; for others every id is skipped as not_allowed. Reads ids (a list of record ids, 1 to 100) and action (approve or reject) from the body, both required, plus reason (required to reject). Bad input answers 400. Answers with data: results (one id and outcome each, skipped ones with a reason) and counts (approved, sent_back, skipped).
GET	/api/v2/timesheet-approval/mine	Session or token	undocumented	Lists a person's timesheet submissions, newest period first. Any signed-in member of the workspace may call it. Reads userId from the query. Only an owner or admin may read another person's list; for anyone else userId is ignored and their own is read. Answers with data: the approval records.
GET	/api/v2/timesheet-approval/pending	Session or token	undocumented	Lists submitted timesheet periods that wait for review. Only an owner or admin may call it; others get status false with statusText Only an owner or admin can review timesheets. Reads nothing. Answers with data: the submitted records, oldest first.
GET	/api/v2/timesheet-approval/queue	Session or token	undocumented	Lists submitted timesheet periods with the context a reviewer needs. Only an owner or admin may call it; others get status false. Reads hoursPerDay (a number, default 8) from the query. Answers with data: the submitted records, oldest first, each with userName, userAvatar, totalMinutes, entryCount, billableMinutes, nonBillableMinutes, capacityMinutes and overMinutes.
GET	/api/v2/timesheet-approval/status	Session or token	undocumented	Reads the approval record of one timesheet period. Any signed-in member of the workspace may call it. Reads periodStart and periodEnd (dates, required) and userId from the query. Only an owner or admin may read another person's record; for anyone else userId is ignored and their own is read. Answers with data: the approval record, or null when none exists.
POST	/api/v2/timesheet-approval/submit	Session or token	undocumented	Sends a timesheet period in for approval. Any signed-in member of the workspace may call it. A member submits their own sheet; an owner or admin may pass another member's userId, otherwise it is refused. Reads periodStart and periodEnd (dates, required), periodType (string, default week), note (string) and userId from the body. A period that is already approved is refused. It saves the period as submitted with the minutes and entry count logged in it. Answers with statusText Timesheet submitted for approval. and data: the approval record.
GET	/api/v2/timetracker/can-start	Session or token	internal	Tells whether the caller may start a timer now. Any signed-in member of the workspace may call it. Reads nothing. Answers with statusText OK when it may, or status false with code period_locked when today falls in an approved, locked timesheet period.
POST	/api/v2/timetracker/capture	Session or token	internal	Stores a tracker screenshot on a running timer and moves its end time forward. Any signed-in member of the workspace may call it. Reads file, path, companyId, timeSheetId, key, imageName, prevscreenShot, screenShotTime, memoName and strokes (a JSON string) from a form upload; all are required. companyId must match the company header, timeSheetId must be a timer of the caller that is still running, and path must lie in that timer's own capture folder, or it answers 403 (a path already stored answers 409). The image is read from file as a base64 string. Answers with statusText Data Update Succesfully.
POST	/api/v2/timetracker/end	Session or token	internal	Stops a tracker timer and saves the time. Any signed-in member of the workspace may call it. The timer must belong to the caller (403 otherwise, 404 if not found). Reads timeSheetId, sprintId, projectId, taskId, taskName, projectName, companyOwnerId, dateFormat, timeZone and strokes from the body, all required, plus considerActionTime and actionTime. A timer that began in an approved, locked period is refused. Answers with statusText Logtime added successfully. It also writes task history and a notification.
GET	/api/v2/timetracker/running	Session or token	internal	Lists the caller's open tracker timers. Any signed-in member of the workspace may call it. Reads timeZone (a zone name) from the query. Answers with data: up to 20 timers, newest first, each with timeSheetId, taskId, taskName, sprintId, projectId, projectName, projectColor, note, startedAt, recordedMinutes, elapsedSec, live, overnight and suggestedMinutes.
POST	/api/v2/timetracker/timelog	Session or token	internal	Lists the caller's own time entries created in a date range. Any signed-in member of the workspace may call it. Only the caller's own entries are returned; a userId naming someone else answers 403. Reads startDate and endDate (dates, default today) and type (the collection name, default the time entries) from the body. Answers with data: the matching entries.
POST	/api/v2/timetracker/trim	Session or token	internal	Closes an open timer at a set length. Any signed-in member of the workspace may call it. The timer must be the caller's own unless the caller is an owner or admin. Reads timeSheetId (id) and minutes (a whole number from 1 to 1440) from the body, both required. A timer in an approved, locked period is refused. Answers with statusText Timer trimmed. and data: the updated entry. Failures come back with status false and a statusText.
GET	/api/v2/tracker/desktop-app	Session or token	internal	The desktop tracker card on Settings > Time tracking. Any signed-in member of the workspace may call it. Reads nothing. Answers with data: enabled (the plan has the time tracker), seats (used and limit, empty for no limit), release (the newest stable tracker from the update feed with one download per system, or empty), screenshots (bytes stored, empty until the nightly count runs, and retention with enabled and maxAgeMonths), managed and portalUrl.
GET	/api/v2/tracker/handshake	No login guard	undocumented	What the desktop tracker reads before anyone signs in. Public. Answers with data: app (always alianhub), version (the server's), name and logoUrl (the ones the sign-in page shows), tracker with enabled (whether any workspace here has the time tracker in its plan) and minVersion (the oldest tracker this server accepts), and managed (whether AlianHub hosts this instance).
GET	/api/v2/trash	Session or token	undocumented	Any signed-in member of the workspace may call it. Reads kind (projects, folders, lists, tasks or docs, projects when left out) from the query. Lists only what the caller could open. Answers with data: the trashed items, each with a title, a code and a projectId.
PUT	/api/v2/trash/:kind/:id/restore	Session or token	undocumented	Needs what deleting that kind needed, in the project the item belongs to; a person must make the call; a doc is judged by the doc rules. The path kind is projects, folders, lists, tasks or docs, and id an id. Projects and lists come back together with their tasks. Answers with data: the kind and id.
GET	/api/v2/users/favourites	Session or token	internal	Reads the person's favourites.
PUT	/api/v2/users/favourites	Session or token	internal	Adds or removes a favourite.
PUT	/api/v2/users/favourites/order	Session or token	internal	Reorders the person's favourites.
PUT	/api/v2/users/home-cards	Session or token	internal	Stores the person's home page cards.
PUT	/api/v2/users/nav-preferences	Session or token	internal	Stores the person's navigation preferences.
PUT	/api/v2/users/onboarding	Session or token	internal	Stores the person's onboarding progress.
GET	/api/v2/users/sessions	Session or token	internal	Lists the person's sessions.
DELETE	/api/v2/users/sessions/:sessionId	Session or token	internal	Ends one of the person's sessions.
POST	/api/v2/verifyEmail	No login guard	internal	Verifies an email address from a link.
GET	/api/v2/view-templates	Session or token	undocumented	Any signed-in member of the workspace may call it. Answers with data, sorted by name, each template with name, viewType and canManage, which is true for owners and admins.
POST	/api/v2/view-templates	Session or token	undocumented	Needs the permission to change the project's views. Reads projectId (id), viewId (string) and name (string) from the body, and keeps the setup of that view as a template; a workspace holds a limited number. Answers with data: the template.
PATCH	/api/v2/view-templates/:id	Session or token	undocumented	Owners and admins only. Reads name (string, required) from the body. Answers with data: the renamed template.
DELETE	/api/v2/view-templates/:id	Session or token	undocumented	Owners and admins only. The template is marked deleted. Answers with statusText Template deleted. and no data.
GET	/api/v2/who-can-see/:kind/:id	Session or token	undocumented	Who can see a project, a list or a page.
GET	/api/v2/workflows/approvals	Session or token	undocumented	Lists workflow steps waiting for a decision.
GET	/api/v2/workflows/definitions	Session or token	undocumented	Lists workflow definitions.
POST	/api/v2/workflows/definitions	Session or token	undocumented	Creates a workflow definition.
PUT	/api/v2/workflows/definitions/:id	Session or token	undocumented	Changes a workflow definition.
DELETE	/api/v2/workflows/definitions/:id	Session or token	undocumented	Deletes a workflow definition.
PATCH	/api/v2/workflows/definitions/:id/enabled	Session or token	undocumented	Switches a workflow definition on or off.
POST	/api/v2/workflows/dry-run	Session or token	undocumented	Shows what a workflow would do, without doing it.
GET	/api/v2/workflows/runs	Session or token	undocumented	Lists workflow runs.
POST	/api/v2/workflows/runs	Session or token	undocumented	Starts a workflow run.
GET	/api/v2/workflows/runs/:id	Session or token	undocumented	Reads a workflow run and its steps.
POST	/api/v2/workflows/runs/:id/steps/:stepId/compensate	Session or token	undocumented	Undoes a step.
POST	/api/v2/workflows/runs/:id/steps/:stepId/decide	Session or token	undocumented	Approves or rejects a step.
POST	/api/v2/workflows/runs/:id/steps/:stepId/reassign	Session or token	undocumented	Hands a step's decision to someone else.
POST	/api/v2/workflows/runs/:id/steps/:stepId/resume	Session or token	undocumented	Resumes a step.
POST	/api/v2/workflows/runs/:id/steps/:stepId/retry	Session or token	undocumented	Retries a step.
POST	/api/v2/workflows/runs/:id/steps/:stepId/skip	Session or token	undocumented	Skips a step.
GET	/api/v2/workflows/step-types	Session or token	undocumented	The step types a workflow can use.
GET	/api/v2/workflows/templates	Session or token	undocumented
POST	/api/v2/workflows/templates/:key/install	Session or token	undocumented

Version 1 (the web app's own API)

Method	Path	Auth	Status	Summary
GET	/api/v1/activity-log	Session or token	internal
POST	/api/v1/addmilestone	Session or token	internal
POST	/api/v1/admin/checkSendInviatation	Session or token	internal
POST	/api/v1/admin/company	Session or token	internal
PUT	/api/v1/admin/company	Session or token	internal
POST	/api/v1/admin/company/find	Session or token	internal
GET	/api/v1/admin/plan-feature	Session or token	internal
GET	/api/v1/admin/plan-feature-display	Session or token	internal
POST	/api/v1/admin/wasabi/retriveObject	Session or token	internal
GET	/api/v1/advance/filter/:userId/:filterType	Session or token	internal
POST	/api/v1/advance/filter/create	Session or token	internal
DELETE	/api/v1/advance/filter/delete/:cid/:id	Session or token	internal
POST	/api/v1/advance/filter/search/comments	Session or token	internal
POST	/api/v1/advance/filter/search/files	Session or token	internal
POST	/api/v1/advance/filter/search/links	Session or token	internal
POST	/api/v1/advance/filter/search/projects	Session or token	internal
POST	/api/v1/advance/filter/search/tasks	Session or token	internal
PUT	/api/v1/advance/filter/update	Session or token	internal
GET	/api/v1/agile/burndown	Session or token	internal	Gives the burndown of one list (sprint): how much work is left each day against an ideal line. The caller must be able to open the sprint's project and the sprint itself (a private sprint is only for its people and the admins). Reads sprintId (id, required) from the query. Answers with data: sprintName, isScrum, state, goal, startDate, endDate, totalCount, totalEstimate, totalPoints and days (each with date, remainingCount, remainingEstimate, remainingPoints, ideal, idealPoints), and statusText 'Burndown computed.'. A list with no tasks answers data with an empty days. A bad id answers status false with 'companyId and a valid sprintId are required.', a missing sprint answers status false with 'Sprint not found.'.
GET	/api/v1/agile/cfd	Session or token	internal	Gives the cumulative flow of a project: how many tasks sit in each status group on each day. The caller must be able to open the project, and tasks in private sprints they cannot see are left out. Reads projectId (id, required), from and to (dates, optional, default is the last 30 days, at most 120 days) from the query. Answers with data: days, each with date and the counts open, inprogress, onhold, close, and statusText 'CFD computed.' or 'No tasks yet.'. A bad id answers status false with 'companyId and a valid projectId are required.'.
GET	/api/v1/agile/milestones	Session or token	internal	Lists the dated milestones of a project, or of every project the caller can open, with how each one is doing. The caller only sees projects they can open, and tasks in private sprints they cannot see are not counted. Reads projectId (id, optional) from the query; a value that is not an id answers status false. Answers with data: milestones (each with milestoneId, name, projectId, projectName, baseline, target, targetField, slipDays, tasks, doneTasks, overdueTasks, openTasks, signedOff, state of done, missed, at-risk or on-track, lastMove, moveCount) and totals (total, onTrack, atRisk, missed, done), and statusText 'Milestones computed.'. With no visible project it answers statusText 'No projects.' and empty lists.
GET	/api/v1/agile/provenance	Session or token	internal	Shows who finished the work in a list (sprint) or a project, people or AI agents, with a cost split. The caller must be able to open the project, and for a sprint also the sprint itself. Reads sprintId (id) or projectId (id) from the query, one of them is required. Answers with data: sprint (id and name, or null), projectId, the completion split fields, and margin (with currencySymbol), and statusText 'Provenance computed.'. A missing or bad id answers status false with 'companyId and a valid sprintId or projectId are required.', a missing sprint answers status false with 'Sprint not found.'.
GET	/api/v1/agile/sprint-insights	Session or token	internal	Gives extra facts for one list (sprint): which tasks are blocked and for how long, and which tasks were added after the sprint started. The caller must be able to open the sprint's project and the sprint itself. Reads sprintId (id, required) from the query. Answers with data: sprintId, sprintName, projectId, startDate, endDate, blockers (with blockedDays and since), scopeAdds (with action, by, at, done), tasks (each with done, blocked, committed) and hasCommitment, and statusText 'Sprint insights computed.'. A bad id answers status false with 'companyId and a valid sprintId are required.', a missing sprint answers status false with 'Sprint not found.'.
GET	/api/v1/agile/velocity	Session or token	internal	Gives the velocity of a project: points promised against points finished across its latest closed Scrum sprints, with a rolling average of three. The caller must be able to open the project, and private sprints they are not on are left out unless they are owner or admin. Reads projectId (id, required) and limit (a number, between 1 and 50, default 10) from the query. Answers with data: sprints (each with sprintId, name, startDate, endDate, committed, completed, completedHuman, completedAgent, unchecked, byPattern, rollingAvg) and skipped (closed sprints without a start snapshot), and statusText 'Velocity computed.' or 'No completed sprints yet.'. A bad id answers status false with 'companyId and a valid projectId are required.'.
GET	/api/v1/ai-progress/:jobId	No login guard	internal
POST	/api/v1/ai/ask	Session or token	internal
GET	/api/v1/ai/ask/build/:projectId	Session or token	internal
POST	/api/v1/ai/ask/create-tasks	Session or token	internal
POST	/api/v1/ai/ask/plan	Session or token	internal
POST	/api/v1/ai/ask/post	Session or token	internal
GET	/api/v1/ai/ask/post/targets	Session or token	internal
GET	/api/v1/ai/ask/sources	Session or token	internal
POST	/api/v1/ai/ask/stream	Session or token	internal
GET	/api/v1/ai/ask/threads	Session or token	internal
GET	/api/v1/ai/ask/threads/:id	Session or token	internal
PUT	/api/v1/ai/ask/threads/:id	Session or token	internal
DELETE	/api/v1/ai/ask/threads/:id	Session or token	internal
POST	/api/v1/ai/chat-ask	Session or token	internal
POST	/api/v1/ai/chat-ask/post	Session or token	internal
POST	/api/v1/ai/chat-summary	Session or token	internal
POST	/api/v1/ai/description	Session or token	internal
PUT	/api/v1/ai/feedback	Session or token	internal
DELETE	/api/v1/ai/feedback/:id	Session or token	internal
GET	/api/v1/ai/feedback/mine	Session or token	internal
POST	/api/v1/ai/meeting-notes	Session or token	internal
GET	/api/v1/ai/memory	Session or token	internal
PUT	/api/v1/ai/memory	Session or token	internal
DELETE	/api/v1/ai/memory	Session or token	internal
POST	/api/v1/ai/memory/import/confirm	Session or token	internal
POST	/api/v1/ai/memory/import/preview	Session or token	internal
POST	/api/v1/ai/notes-to-tasks	Session or token	internal
POST	/api/v1/ai/notes-to-tasks/propose	Session or token	internal
POST	/api/v1/ai/notes-to-tasks/undo	Session or token	internal
POST	/api/v1/ai/project/:projectId/tasks/execute	Session or token	internal
POST	/api/v1/ai/project/:projectId/tasks/plan	Session or token	internal
POST	/api/v1/ai/project/brief	Session or token	internal
POST	/api/v1/ai/project/clarify	Session or token	internal
POST	/api/v1/ai/project/execute	Session or token	internal
POST	/api/v1/ai/project/guide	Session or token	internal
POST	/api/v1/ai/project/plan	Session or token	internal
POST	/api/v1/ai/project/upload-brief	Session or token	internal
GET	/api/v1/ai/quality	Session or token	internal
POST	/api/v1/ai/quality/held-out	Session or token	internal
POST	/api/v1/ai/selection/improve	Session or token	internal
POST	/api/v1/ai/selection/tasks	Session or token	internal
GET	/api/v1/ai/task-assist	Session or token	internal
POST	/api/v1/ai/task-category	Session or token	internal
POST	/api/v1/ai/task-next-steps	Session or token	internal
POST	/api/v1/ai/task-research	Session or token	internal
POST	/api/v1/ai/task-summary	Session or token	internal
POST	/api/v1/ai/task-values	Session or token	internal
POST	/api/v1/ai/transcribe	Session or token	internal
PUT	/api/v1/app-notification/mark-all-read	Session or token	internal
PUT	/api/v1/app-notification/mark-read	Session or token	internal
DELETE	/api/v1/app-notification/mark-read/:key/:id	Session or token	internal
GET	/api/v1/app-notification/mentions	Session or token	internal
GET	/api/v1/app-notification/notification	Session or token	internal
GET	/api/v1/audit-logs	Session or token	internal
POST	/api/v1/audit-logs/:id/undo	Session or token	internal
GET	/api/v1/audit-logs/export	Session or token	internal
POST	/api/v1/auth/loginAuthTracker	No login guard	internal
GET	/api/v1/automations	Session or token	internal
POST	/api/v1/automations	Session or token	internal
PUT	/api/v1/automations/:id	Session or token	internal
DELETE	/api/v1/automations/:id	Session or token	internal
POST	/api/v1/automations/:id/apply	Session or token	internal
POST	/api/v1/automations/preview	Session or token	internal
GET	/api/v1/calendar/feeds	Session or token	internal
POST	/api/v1/calendar/feeds	Session or token	internal
DELETE	/api/v1/calendar/feeds/:id	Session or token	internal
POST	/api/v1/calendar/feeds/:id/regenerate	Session or token	internal
GET	/api/v1/calendar/ics/:token	No login guard	internal
POST	/api/v1/cancelmilestonestatus	Session or token	internal
GET	/api/v1/cardcomponent	Session or token	internal
POST	/api/v1/checkSendInviatation	Session or token	internal
POST	/api/v1/clearmilestonestatus	Session or token	internal
GET	/api/v1/clips	Session or token	internal
POST	/api/v1/clips	Session or token	internal
PATCH	/api/v1/clips/:id	Session or token	internal
DELETE	/api/v1/clips/:id	Session or token	internal
GET	/api/v1/cloud-oauth/callback	No login guard	internal
DELETE	/api/v1/cloud-storage/:provider	Session or token	internal
GET	/api/v1/cloud-storage/:provider/auth-url	Session or token	internal
POST	/api/v1/cloud-storage/:provider/import	Session or token	internal
GET	/api/v1/cloud-storage/:provider/thumbnail	Session or token	internal
GET	/api/v1/cloud-storage/:provider/token	Session or token	internal
GET	/api/v1/cloud-storage/providers	Session or token	internal
GET	/api/v1/cloud-storage/settings	Session or token	internal
PUT	/api/v1/cloud-storage/settings/:provider	Session or token	internal
DELETE	/api/v1/cloud-storage/settings/:provider	Session or token	internal
PUT	/api/v1/collection/userid	Session or token	internal
GET	/api/v1/collection/userid/:id	Session or token	internal
POST	/api/v1/comments	Session or token	internal	Saves a new comment or reply on a project, list or task. The caller must be able to open that project, list and task, else 404 with statusText. Reads data (object, required) from the body, with projectId, sprintId, taskId, message, mediaURL and parentId (ids and text). The author is always the caller, whatever userId is sent. Mentions in message are found and notified, unread counts are raised and agents or AI may start when named. Answers with status and data: the saved comment, plus ai or agents when those started. Bad thread ids answer 400, and failures 500.
PUT	/api/v1/comments	Session or token	internal	Edits or soft-deletes a comment. The caller must be able to open its thread, else 404. Only the author or an owner or admin may change it, but any member may change only pinnedMessage, else 403 with message. Reads id (comment id, required), data (object of fields to set), isProjectComment (boolean) and options (only timestamps, a boolean) from the body. A comment cannot move to another thread or author, answering 400. Answers with status and data: the updated comment. Failures answer 500.
GET	/api/v1/comments/action-items	Session or token	internal	Lists the open assigned comments on one task, oldest first, up to 100. The caller must be able to open the task, else 404. Reads taskId (id, required, else 400), projectId (id) and sprintId (id) from the query. Answers with data: the comments. Failures answer 500.
POST	/api/v1/comments/assign	Session or token	internal	Assigns a task comment to a member, or clears its assignee. The caller must be able to post to the task, else 404. Changing an existing assignment is allowed only to the comment's author, the one who assigned it, the current assignee or an owner or admin, else 403 with statusText. Reads id (comment id, required, else 400) and assigneeId (user id, empty to clear) from the body. The assignee must be an active person who can see the task, else 400. Answers with status and data: the updated comment. The new assignee is notified. Failures answer 500.
GET	/api/v1/comments/assigned-to-me	Session or token	internal	Lists the open comments assigned to the caller, newest assignment first, up to 50. Only those on tasks and docs the caller can still open are returned. Reads nothing from the request. Answers with data: the comments, each with taskName and taskKey for task comments. Failures answer 500.
GET	/api/v1/comments/get-paginated-messages	Session or token	internal	Lists the top level comments of a project, list or task chat, newest first. The caller must be able to open the project, list and task, else 404 with statusText. Reads projectId (id, required), taskId (id), sprintId (id), isDefault, mainChat (booleans), skipValue and batchLimit (numbers, default 0 and 25) and tabLeaveTime (a timestamp in milliseconds) from the query. Answers with data: the comments, with a reply summary where threads apply. Failures answer 500.
GET	/api/v1/comments/get-searched-messages	Session or token	internal	Searches the messages of a project, list or task chat. The caller must be able to open the project, list and task, else 404 with statusText. Reads projectId (id, required), sprintId and taskId (ids), searchText (string, matched against message and file names), isPinnedMessage (true for pinned only), skip and limit (numbers, default 0 and 25) and sort (asc or desc) from the query. Answers with data: the matching comments. Failures answer 500.
GET	/api/v1/comments/replies	Session or token	internal	Lists the replies in one comment thread, oldest first. The caller must be able to open the thread's project, list and task, else 404 with statusText. Reads parentId (comment id, required, else 400) from the query. Answers with data: the replies, and root: the parent comment. Failures answer 500.
POST	/api/v1/comments/resolve	Session or token	internal	Marks an assigned task comment as resolved or open again. The caller must be able to open the task, else 404. Only the assignee, the person who assigned it or an owner or admin may do it, else 403 with statusText. Reads id (comment id, required, else 400) and resolved (boolean, true unless false) from the body. The comment must be assigned, else 400. Answers with status and data: the updated comment. Failures answer 500.
GET	/api/v1/commonDateFormate	Session or token	internal
PUT	/api/v1/commonDateFormate	Session or token	internal
POST	/api/v1/company	Session or token	internal
PUT	/api/v1/company	Session or token	internal
PUT	/api/v1/company-invitation	Session or token	internal
GET	/api/v1/connector-oauth/google/callback	No login guard	internal	Google's redirect after consent. Public: it exchanges nothing and returns the browser to the signed-in page, which completes the connection.
POST	/api/v1/createBucket	Instance admin	internal
POST	/api/v1/createproject	Session or token	internal	Creates a new project, with its first list, in the workspace. Needs the project.project_create permission, and any people named in AssigneeUserId, LeadUserId or watchers must be members. Reads from the body ProjectName (required), ProjectCode (required), source (required), proposalId (required when the source is upwork), projectIcon, isPrivateSpace (true or false), isTemplate, ProjectRequiredComponent and other project fields. The workspace and creator are set from the session, so a body naming another company is refused with 403. Answers with data: the new project, and statusText: "createProject added successfully". Failures answer status false with statusText giving the reason.
GET	/api/v1/currency	Session or token	internal
PUT	/api/v1/currency/:cid/:id	Session or token	internal
GET	/api/v1/customField	Session or token	internal
POST	/api/v1/customField	Session or token	internal
PUT	/api/v1/customField	Session or token	internal
POST	/api/v1/dashboard	Session or token	internal
GET	/api/v1/dashboard/:id	Session or token	internal
POST	/api/v1/dashboard/at-risk	Session or token	internal
POST	/api/v1/dashboard/employee-workload	Session or token	internal
POST	/api/v1/dashboard/milestone-summary	Session or token	internal
POST	/api/v1/dashboard/my-achievements	Session or token	internal
POST	/api/v1/dashboard/my-due-soon	Session or token	internal
POST	/api/v1/dashboard/my-leave	Session or token	internal
POST	/api/v1/dashboard/my-next-tasks	Session or token	internal
POST	/api/v1/dashboard/my-time	Session or token	internal
POST	/api/v1/dashboard/on-leave	Session or token	internal
POST	/api/v1/dashboard/project-metrics	Session or token	internal
POST	/api/v1/dashboard/project-utilization-summary	Session or token	internal
POST	/api/v1/dashboard/tasks-by-status	Session or token	internal
POST	/api/v1/dashboard/team-logged-vs-eta	Session or token	internal
POST	/api/v1/dashboard/team-tasktype-breakdown	Session or token	internal
GET	/api/v1/dashboards	Session or token	internal
POST	/api/v1/dashboards	Session or token	internal
GET	/api/v1/dashboards/:id	Session or token	internal
PUT	/api/v1/dashboards/:id	Session or token	internal
DELETE	/api/v1/dashboards/:id	Session or token	internal
PUT	/api/v1/dashboards/:id/cards	Session or token	internal
POST	/api/v1/dashboards/:id/duplicate	Session or token	internal
POST	/api/v1/deleteUserChat	Session or token	internal
POST	/api/v1/deletemilestone	Session or token	internal
GET	/api/v1/download/:bucketId/*	No login guard	internal
POST	/api/v1/draggablemilestone	Session or token	internal
POST	/api/v1/email-in/:token	No login guard	internal
GET	/api/v1/email-in/inboxes	Session or token	internal
POST	/api/v1/email-in/inboxes	Session or token	internal
PUT	/api/v1/email-in/inboxes/:id	Session or token	internal
DELETE	/api/v1/email-in/inboxes/:id	Session or token	internal
POST	/api/v1/estimatedTime	Session or token	internal	Runs a read query over planned time rows and returns the result. Any signed-in member of the workspace may call it. Reads queryeta (an aggregation pipeline) from the body. The query is limited to the rows and projects the caller may see, and a query that breaks that limit answers 400. Answers with the list of result rows itself, not wrapped in data.
PUT	/api/v1/estimatedTime	Session or token	internal	Saves the planned time for one person, task and day. Any signed-in member of the workspace may call it. A member may plan their own time only; planning for others needs an owner or admin role or the Everyone grant on the workload or project timesheet. The project must be one the caller can open, else 403. Reads userId, taskId, projectId (ids), date and minutes (a number from 0 to 1440) from the body, all required, plus id (the row id, to edit a row) and timeZone. Without id it creates the row or updates the one for that person, day and task. Answers with the saved row itself, not wrapped in data; bad input answers 400.
GET	/api/v1/estimatedTime/:pid/:tid	Session or token	internal	Lists the planned time rows for one task. Any signed-in member of the workspace may call it. Callers without the Everyone grant on the workload or project timesheet see only their own rows, and only for projects they can open; a project they cannot open gives an empty list. Reads pid (project id) and tid (task id) from the path. Answers with the list of rows itself, not wrapped in data.
POST	/api/v1/estimatedTime/ai/:tid	Session or token	internal	Asks the AI for an estimate of a task and saves it on the task. Needs a task the caller can open and the permission to change task estimated hours in its project, else 403. Reads tid (task id) from the path and userId and userName (strings) from the body. The task must have a description. Answers with data: totalEstimatedTime, minutes, optimistic, likely, pessimistic, confidence, work_items, reasoning and basedOnSamples. Failures give status false and a statusText.
POST	/api/v1/estimatedTime/ai/:tid/propose	Session or token	internal	Asks the AI for an estimate of a task without saving it. Needs a task the caller can open and the permission to change task estimated hours in its project, else 403. Reads tid (task id) from the path. The task must have a description. Answers with data: minutes, optimistic, likely, pessimistic, confidence, work_items, reasoning, basedOnSamples and previousMinutes. Failures give status false and a statusText.
POST	/api/v1/export/csv	Session or token	internal
POST	/api/v1/export/pdf	Session or token	internal
POST	/api/v1/export/xlsx	Session or token	internal
GET	/api/v1/fileExtensions	Session or token	internal
PUT	/api/v1/fileExtensions	Session or token	internal
POST	/api/v1/findOneAiModel	Session or token	internal
POST	/api/v1/findOnePrompts	Session or token	internal
POST	/api/v1/folder	Session or token	internal	Creates a folder in a project, or a category in a chat space. The caller needs project.project_folder_create in the project (chat categories are judged by chat access instead). AI agent accounts are refused. Reads projectId (id), folderName (string), parentFolderId (id of a live folder of the same project, optional, folders nest one level) and mainChat (boolean) from the body. The acting user is taken from the session. Answers with data: the new folder, and statusText 'Folder added successfully'. A bad parent answers 400 with the reason, other failures answer status false with the error text.
PATCH	/api/v1/folder/:id	Session or token	internal	Renames, moves, archives, deletes or restores one folder, depending on type. The caller must be able to open the folder's project and needs the permission for the change: project.project_folder_name_edit for a rename, that key or project.project_folder_create for a move, project.folder_archive, project.folder_delete or project.folder_restore for the matching deletedStatusKey. AI agent accounts are refused. Reads id (folder id) from the path and type (string, one of editFolderName, updateFolder, moveFolder, required) from the body. For editFolderName it reads folderName and projectId, and also renames the folder copy kept on its tasks. For moveFolder it reads parentFolderId (an id, or null for the top level; required). For updateFolder it reads updateObject, which may only be { $set: { deletedStatusKey } } with 0, 1 or 2, and it carries sub folders and their tasks along. Answers with data: the folder, and statusText 'Folder renamed successfully', 'Folder moved successfully' or 'Folder updated successfully' (updateFolder also returns subfolders). A missing type answers status false with 'type not found', an unknown type answers 400 'Invalid type', a folder that is not found answers status false with 'Folder not found'.
GET	/api/v1/freeCompanyCount/:userId	Session or token	internal
GET	/api/v1/general-reminders	Session or token	internal
POST	/api/v1/general-reminders	Session or token	internal
PATCH	/api/v1/general-reminders/:id	Session or token	internal
DELETE	/api/v1/general-reminders/:id	Session or token	internal
POST	/api/v1/general-reminders/:id/run-now	Session or token	internal
POST	/api/v1/general-reminders/run-due	Session or token	internal
GET	/api/v1/generateMongoId	Session or token	internal
POST	/api/v1/generatePrompt	Session or token	internal
GET	/api/v1/generatePrompt/events/:id	No login guard	internal
POST	/api/v1/generatePromptChat	Session or token	internal
GET	/api/v1/generateSignedUrl/:bucketId	Session or token	internal
POST	/api/v1/get-remaining-projects	Session or token	internal	Fetches the full records of projects from a list of ids. Any signed-in member of the workspace may call it, and ids of projects the caller cannot open are dropped from the list first. Reads dataIds (list of project ids, required) from the body. Answers with data: the matching projects. An empty or badly formed list, or one with nothing left after dropping, answers 400 with statusText and field.
POST	/api/v1/getAiCategory	Session or token	internal
POST	/api/v1/getAiModels	Session or token	internal
GET	/api/v1/getBrandSettingsData	No login guard	internal
GET	/api/v1/getBucket/:bucketId	Session or token	internal
GET	/api/v1/getBucketSize/:bucketId	Session or token	internal
GET	/api/v1/getEmailTemplates	No login guard	internal
POST	/api/v1/getGlobalTemplate	Session or token	internal
POST	/api/v1/getPrompts	Session or token	internal
POST	/api/v1/getTaskTypeImage	Session or token	internal
GET	/api/v1/getTime	No login guard	internal
POST	/api/v1/getUserProfile	Session or token	internal
GET	/api/v1/getcompany-reffercode	Session or token	internal
GET	/api/v1/getlogo	No login guard	internal
GET	/api/v1/getreferralpercentage	Session or token	internal
GET	/api/v1/github-connect/callback	No login guard	internal
POST	/api/v1/github/access-token	No login guard	internal
POST	/api/v1/gitlab/access-token	No login guard	internal
POST	/api/v1/google/access-token	No login guard	internal
GET	/api/v1/groupByUsers	Session or token	internal
POST	/api/v1/importSettings	Session or token	internal
POST	/api/v1/importSettingsNotification	Session or token	internal
POST	/api/v1/importSettingsProjectFunction	Session or token	internal
PATCH	/api/v1/importTasks	Session or token	internal	Creates many tasks in one list from imported rows. The caller needs task.task_create in the project named by projectData, and must be able to see the target list (a private list is only for its people and the admins). AI agent accounts are refused. Reads tasks (list of task rows), projectData (object with _id and CompanyId), sprint (object with id, the list to import into), statusArray (list of statuses with name, key, type), indexObj, eventId (a string used to report progress) and userData from the body. The list must belong to the project, else it answers 404 'Project or sprint not found.'. A missing permission answers 403 'You do not have permission to import tasks into this project.'. On success answers with data: createdTasks, customFields, adjusted, droppedFieldValues, and statusText 'Task updated successfully.'.
POST	/api/v1/importTemplate	Session or token	internal
POST	/api/v1/importUser	Session or token	internal
GET	/api/v1/inbox	Session or token	internal
POST	/api/v1/inbox/clear	Session or token	internal
POST	/api/v1/inbox/clear-all	Session or token	internal
GET	/api/v1/inbox/counts	Session or token	internal
POST	/api/v1/inbox/read	Session or token	internal
POST	/api/v1/inbox/read-all	Session or token	internal
POST	/api/v1/inbox/restore	Session or token	internal
POST	/api/v1/inbox/restore-all	Session or token	internal
POST	/api/v1/inbox/snooze	Session or token	internal
POST	/api/v1/inbox/unsnooze	Session or token	internal
GET	/api/v1/integrations/app-connections	Session or token	internal
GET	/api/v1/integrations/catalog	Session or token	internal
GET	/api/v1/integrations/connections	Session or token	internal
POST	/api/v1/integrations/connections	Session or token	internal
PUT	/api/v1/integrations/connections/:id	Session or token	internal
DELETE	/api/v1/integrations/connections/:id	Session or token	internal
GET	/api/v1/integrations/connections/:id/github-repos	Session or token	internal
PUT	/api/v1/integrations/connections/:id/projects	Session or token	internal
POST	/api/v1/integrations/connections/:id/repos	Session or token	internal
DELETE	/api/v1/integrations/connections/:id/repos/:projectId	Session or token	internal
GET	/api/v1/integrations/github/authorize	Session or token	internal
POST	/api/v1/integrations/github/complete	Session or token	internal
GET	/api/v1/integrations/github/projects/:projectId	Session or token	internal
POST	/api/v1/invoice/find	Instance admin	internal
GET	/api/v1/main-chats	Session or token	internal
POST	/api/v1/main-chats/find	Session or token	internal
POST	/api/v1/manageTrackerUserPermission	Session or token	internal
GET	/api/v1/mediaFiles	Session or token	internal
GET	/api/v1/members	Session or token	internal	Lists the member rows of the workspace. Any signed-in member of the workspace may call it, and the fields on each row depend on the caller: owners, admins and holders of settings.settings_member_list see seat details, others see a smaller set, and userId is hidden on rows that are not accepted yet. Reads nothing from the request. Answers with data: the member rows, and sets a FromCache header when cached. Failures answer 500.
PUT	/api/v1/members	Session or token	internal	Changes fields on a member row, such as role, seat status, removal, manager or designation. Needs the settings.settings_member_list permission, except that any member may change their own dashboardLocked setting. Reads id (member row id, required) and data (object, required) from the body. Only an owner or admin can change another member or managerId. Only an owner can grant the owner or admin role or change an owner. Nobody can change their own role, and the last owner cannot be demoted or removed. Fields such as userId, companyId and userEmail cannot be changed, and $ operators are refused. A manager must pass the reporting line check. Removing a member releases their seat and revokes their API tokens. Answers with status, statusText (Member updated.) and data: the updated row. Refusals answer 400, 403 or 404 with statusText, and other failures 500.
GET	/api/v1/members/:id	Session or token	internal	Finds one member row by account id. Any signed-in member of the workspace may call it. Reads id (the member's user id) from the path. Managers of members can find any row of that account, everyone else only finds a live seat. Answers with the member row itself (no data wrapper), or an empty answer when none matches. Failures answer 500.
GET	/api/v1/members/:key/:value	Session or token	internal	Checks whether any member holds a given role or designation. Any signed-in member of the workspace may call it. Reads key (roleType or designation) and value (a whole number) from the path. Anything else answers 400 with message. Answers with isUsed: true when a member has it. Failures answer 500.
POST	/api/v1/members/count	Session or token	internal	Counts member rows that match a simple filter. Any signed-in member of the workspace may call it. Reads query (object) from the body, which may use only roleType, designation, status and isDelete, each a string, number or boolean. Anything else answers 400 with statusText. Answers with a list holding totalCount (or an empty list when nothing matches), with no data wrapper. Failures answer 500.
POST	/api/v1/members/private-view	Session or token	internal	Adds, changes or removes a private view saved on the caller's own member row. Any signed-in member may call it, but only on their own row, else 403 with statusText. Reads id (member row id, required), data (object, required), operation (push, update, settings or delete, required) and key (name, title or isPin, used with update) from the body. update and settings also need data.id (the view id) and the view must exist, else 404. Answers with status and statusText (Private view saved.). Bad input answers 400, an unknown row 404, and other failures 500. It also records a note in the project history when the view names a project the caller can read.
POST	/api/v1/milestone	Session or token	internal
GET	/api/v1/milestone/:id	Session or token	internal
GET	/api/v1/milestone/project/:pid	Session or token	internal
GET	/api/v1/milestoneBillingPeriod	Session or token	internal
GET	/api/v1/milestoneRange	Session or token	internal
POST	/api/v1/milestoneReport	Session or token	internal
GET	/api/v1/milestoneStatus	Session or token	internal
PUT	/api/v1/milestoneStatus	Session or token	internal
POST	/api/v1/mongoOpration	Session or token	internal
GET	/api/v1/notes	Session or token	internal
POST	/api/v1/notes	Session or token	internal
PATCH	/api/v1/notes/:id	Session or token	internal
DELETE	/api/v1/notes/:id	Session or token	internal
PUT	/api/v1/notifications	Session or token	internal
GET	/api/v1/notifications/:id	Session or token	internal
GET	/api/v1/notifications/preferences	Session or token	internal
PUT	/api/v1/notifications/preferences	Session or token	internal
GET	/api/v1/plan-feature-display	Session or token	internal
GET	/api/v1/portfolio	Session or token	internal
POST	/api/v1/portfolio	Session or token	internal
PUT	/api/v1/portfolio/:id	Session or token	internal
DELETE	/api/v1/portfolio/:id	Session or token	internal
GET	/api/v1/portfolio/:id/rollup	Session or token	internal
POST	/api/v1/portfolio/summary	Session or token	internal
GET	/api/v1/project	Session or token	internal
GET	/api/v1/project-close	Session or token	internal	Reads the workspace policy for closing inactive projects. Any signed-in member of the workspace may call it. Reads nothing from the body or query. Answers with data: policy and validInactiveMonths.
PUT	/api/v1/project-close	Session or token	internal	Changes the workspace policy for closing inactive projects. Only an owner or an admin may call it, otherwise it answers 403. Reads enabled (true or false) and inactiveMonths (a number from the allowed list) from the body, and needs at least one of them. Answers with data: policy as saved, and statusText: "Auto-close settings updated". A bad value answers 400 with statusText.
GET	/api/v1/project-dashboard/:projectId	Session or token	internal
GET	/api/v1/project-status-template	Session or token	internal
POST	/api/v1/project-status-template	Session or token	internal
PUT	/api/v1/project-status-template	Session or token	internal
DELETE	/api/v1/project-status-template/:id	Session or token	internal
GET	/api/v1/project/:id	Session or token	undocumented	Reads one project by its id.
PUT	/api/v1/project/:id	Session or token	internal	Updates fields of one project. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members need the permission tied to each field they change (for example the name, dates, status, assignee or description permissions), and project.project_details for fields without their own key. Reads id (id) from the path and updateObject (object, required), key (one of $set, $unset, $push, $pull, $addToSet; default $set), arrayFilters (list) and timeZone (string) from the body. Server owned fields such as the creator, company or counters cannot be changed and answer 400, and moving a project is refused for agent tokens. People named must be members. Answers with the project record. Failures answer 400 with message (for example a bad source or proposal id) or 500.
PUT	/api/v1/project/:id/view-settings	Session or token	internal	Saves the settings of one view of a project. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.view_list or project.project_details permission. Reads id (id) from the path and viewId (string, required) and settings (object, required) from the body. Answers with data: viewId and the cleaned settings, and statusText: "View saved.". An unknown view or project answers 404.
POST	/api/v1/project/:id/views	Session or token	internal	Adds a new view to a project, copied from an existing view or built from a view template. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.view_list or project.project_details permission. Reads id (id) from the path. In the body it reads either templateId (with optional title, isPrivate, isPin) or sourceViewId (string, required) with title (required) and optional settings (object). Answers with data: the new view (or a prepared private view), leftOut, and statusText: "View added." A project holds at most 60 views. An unknown view or template answers 404, and a bad body answers 400.
PUT	/api/v1/project/allTask/:id	Session or token	internal	Changes the deleted state of tasks in a project, used when a project is closed, deleted, archived or restored. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members need the project.project_delete or project.project_close permission, and agent tokens are refused. Reads id (id) from the path and findObject (required; only ProjectID and deletedStatusKey) and updateObject (required; only deletedStatusKey, a whole number) from the body. Answers with data: matched and modified, and statusText: "Project tasks updated." Bad input answers 400 with statusText.
POST	/api/v1/project/checklist	Session or token	internal	Adds, changes or removes items of a project's checklist. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members need the project.project_checklist permission; adding or removing an assignee on an item can be done with either project.project_checklist_assign_remove or project.project_checklist. Reads id (the project id), operation (push, update or delete), checklistItem (an item, or a list of item ids for delete) and key (name, isChecked, assigneeAdd or assigneeRemove, for update) from the body. An update by name or assignee needs checklistItem.id. Answers status true. An unknown project answers 404 and a bad operation answers 400 with message.
GET	/api/v1/project/filter/:userId	Session or token	internal	Lists the caller's saved project filters. Any signed-in member of the workspace may call it, but userId (id, from the path) must be the caller's own id or it answers 403. Answers with data: the caller's saved filters of the project kind.
POST	/api/v1/project/filter/create	Session or token	internal	Saves a project filter for the caller. Any signed-in member of the workspace may call it, and the filter always belongs to the caller. Reads name (string, required, up to 200 characters), filter (string, required), typeFilter (string, required), filters (list), sortByField and sortByOrder (objects) and userId (must be the caller's own) from the body. Answers with data: the saved filter, and statusText: "Filter saved." A bad field answers 400 with statusText and field, and another user's id answers 403.
DELETE	/api/v1/project/filter/delete/:cid/:id	Session or token	internal	Deletes one saved filter of the caller. Any signed-in member of the workspace may call it, but only the owner of the filter can delete it. Reads cid (id, must match the workspace of the request) and id (id, the filter) from the path, and an optional projectId from the query for the history. Answers status true. A wrong company answers 403, a bad id 400, and a filter that is not the caller's or does not exist 404.
PUT	/api/v1/project/filter/update	Session or token	internal	Changes one saved project filter of the caller. Any signed-in member of the workspace may call it, but only the owner of the filter can change it. Reads id (id, required; _id also works) and at least one of name, filters (list), sortByField, sortByOrder (objects) from the body, and userId if sent must be the caller's own. Answers with data: the updated filter, and statusText: "Filter updated." A bad field answers 400, another user's id 403, and a filter that is not found 404.
POST	/api/v1/project/personal	Session or token	internal	Finds the caller's personal list project, or creates it the first time. Any signed-in member of the workspace may call it, and it only ever returns the caller's own personal project. Reads nothing from the body or query. Answers with data: project and sprint (its first list), and statusText is "Personal list created" or "Personal list found". Failures answer 400 with message.
POST	/api/v1/project/search	Session or token	internal	Searches the projects, sprints, folders or archived lists the caller can see. Any signed-in member of the workspace may call it, and results only include projects the caller may open (private ones only if assigned or if their role sees all private projects). Reads type (required; one of sprint, folder, projectName, projectFilter, projectFilter_projectName, projectFilter_folder, projectFilter_sprint, showArchiveOnly) from the body, plus search (string), fields (comma separated string), query, sortByField, sortByOrder, showArchived, skip and limit (numbers). Answers with the list of matches itself (no data wrapper), or an empty list if the caller has no active seat. A missing type answers 404 with message.
PUT	/api/v1/project/sprint/:id	Session or token	internal	Adds or removes the caller's own favourite star on a list (sprint). Needs access to the sprint and its project, and no extra permission for this own star. Reads id (id) from the path and key ($addToSet or $pull) and updateObject from the body, which must be exactly { favouriteTasks: { userId } } with the caller's own id. Anything else answers 400. Answers with the updated sprint.
GET	/api/v1/project/sprintFolder/:id	Session or token	internal	Lists the sprints or folders of a project, or counts them. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner). Reads id (id) from the path and collection (required; sprints or folders), count, fields (comma separated string), skip and limit from the query. Sprints the caller may not see are left out unless the caller is an owner or admin, and removed ones are left out. Answers with the list itself (no data wrapper), or a count when count is set. A missing or unknown collection answers 400 with message.
POST	/api/v1/project/tags	Session or token	internal	Adds, renames, recolours or removes a tag defined on a project. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members need the task.task_tag permission. Reads id (the project id), operation (push, update or delete), items (the tag; for update and delete it needs id, the tag's uid) and key (tagName or tagColor, for update) from the body. Answers status true. An unknown project answers 404 and a bad operation answers 400 with message.
GET	/api/v1/project/template/custom	Session or token	internal	Lists the custom project templates of the workspace. Any signed-in member of the workspace may call it. Reads nothing from the body or query. Answers with data: the templates (served from a cache when one is fresh).
POST	/api/v1/project/template/custom	Session or token	internal	Saves a custom project template for the workspace. Only an owner or an admin may call it, otherwise it answers 403. Reads data (object, required) from the body; data.TemplateName is required, a string of up to 250 characters. Answers with data: the saved template, and statusText: "Template saved." A bad name answers 400 with statusText and field.
DELETE	/api/v1/project/template/custom/:id	Session or token	internal	Deletes one custom project template. Only an owner or an admin may call it, otherwise it answers 403. Reads id (id) from the path. Answers status true, or status false with 404 when nothing was deleted.
POST	/api/v1/project/template/custom/ai-generate	Session or token	internal	Asks the AI to draft task statuses, task types and project statuses for a project template, without saving anything. Only an owner or an admin may call it, otherwise it answers 403. Reads category (string, required) and useCaseDescription (string) from the body. Answers with data: the draft template (taskStatusData, TemplateTaskType, projectStatusData, finalTemplateTaskStatusData, finalProjectStatusData), matched to the workspace's existing statuses and types. A missing category answers 400, and so does an AI that is not set up.
GET	/api/v1/projectRules/:pid	Session or token	internal
DELETE	/api/v1/projectRules/delete/:pid	Session or token	internal
PUT	/api/v1/projectRules/update	Session or token	internal
POST	/api/v1/projectSetting/autoArchive	Session or token	internal	Sets the rule that archives finished tasks of a project after some days. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.project_details permission for that project. Reads projectId (id, required), enabled (true or false) and afterDays (a number, kept between 1 and 365) from the body. Answers with data: enabled and afterDays as saved. A missing project answers status false with statusText.
GET	/api/v1/projectSetting/autoArchive/:pid	Session or token	internal	Reads the auto archive rule of a project. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner). Reads pid (id) from the path. Answers with data: enabled (true or false) and afterDays (days, 1 to 365, default 30). A missing project answers status false with statusText.
POST	/api/v1/projectSetting/estimationScale	Session or token	internal	Sets the story point scale a project offers. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.project_details permission for that project. Reads projectId (id, required) and scale (one of fibonacci, linear, tshirt, hours; anything else becomes fibonacci) from the body. Answers with data: estimationScale. A missing project answers status false with statusText.
POST	/api/v1/projectSetting/migrateSprintsFun	Instance admin	internal	Runs a one time migration that turns the sprints and folders stored inside every project and chat of the workspace into their own records. Only the instance owner may call it, or a script that sends the adminkey header; an API token is refused. Reads nothing from the body or query. Answers status true with statusText: "done" once every project was processed.
POST	/api/v1/projectSetting/taskStatus	Session or token	internal	Moves every task in the old statuses of a project over to the new status chosen for each one. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.project_details permission for that project. Reads projectId (id, required), taskStatusKey (list, required) and oldTaskStatus (list, required; each item has key and convertStatus with key, name and type) from the body. Answers status true with statusText: "TASK UPDATE SUCCESSFULLY". A missing field answers status false with a statusText naming it.
POST	/api/v1/projectSetting/taskStatus/wipLimit	Session or token	internal	Sets or clears the work in progress limit of one status column in a project. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.project_details permission for that project. Reads projectId (id, required), statusKey (required) and wipLimit (a number) from the body. A value that is empty, zero or below clears the limit, and the limit tops out at 999. Answers with data: statusKey, wipLimit, taskStatusData, and statusText says the limit was set or cleared. Failures answer status false with statusText (bad project id, project not found, status not on the project).
POST	/api/v1/projectSetting/taskType	Session or token	internal	Moves every task of the old task types in a project over to the new type chosen for each one. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner), and owners and admins always pass. Other members also need the project.project_details permission for that project. Reads projectId (id, required), taskTypeKey (list, required) and oldTaskType (list, required; each item has key and convertType with key and value) from the body. Answers status true with statusText: "TASK UPDATE SUCCESSFULLY". A missing field answers status false with a statusText naming it.
GET	/api/v1/projectTabs	Session or token	internal
GET	/api/v1/projectdata/taskData	Session or token	internal	Reads one task with its project, list, folder and its subtasks. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner). The caller must also be able to read the task, or it answers 404. Reads taskId (id, required), projectId (id, required) and subTaskLimit (a number, required) from the query. Answers with the list result itself (no data wrapper): the project row with tasks, subtasks (newest first, up to subTaskLimit) and parentFolder. A missing or malformed parameter answers 400 with message.
GET	/api/v1/projects-apps	Session or token	internal
GET	/api/v1/pto	Session or token	internal
POST	/api/v1/pto	Session or token	internal
DELETE	/api/v1/pto/:id	Session or token	internal
PUT	/api/v1/pto/:id/status	Session or token	internal
GET	/api/v1/pto/capacity	Session or token	internal
PUT	/api/v1/push-mark-read	Session or token	internal
POST	/api/v1/pushupdateunreadcommentscount	Session or token	internal	Changes the signed-in user's unread count for a project, task, chat message, mention or notification. Any signed-in member of the workspace may call it, but only for their own counts: if userIds (array of ids) names anyone else it answers 403 with statusText. Reads key (number, required: 1 project, 2 task, 3 chat message, 4 mention, 5 notification), read, set and readAll (booleans), messageCount and prevCount (numbers), projectId, sprintId, taskId, messageId and parentTaskId (ids) from the body. Keys 1 and 2 need projectId and userIds, key 2 also needs sprintId and taskId, key 3 needs messageId, key 4 needs readAll. With read, set or readAll it changes only the caller's count; without them only keys 1, 2 and 4 are accepted, else 403. A companyId in the body that differs from the company header is refused. Answers with status and data: a message that the count was updated. A rejected request answers 400 with statusText.
POST	/api/v1/recurring-tasks	Session or token	internal	Creates a repeating task rule for a project. The caller needs task.task_create in the project named by projectData. Reads name (string, required), taskName (string, required), projectData (object with _id required, plus CompanyId, ProjectCode, ProjectName), freq (required, daily, weekly or monthly), interval (a number), byweekday (list of numbers 0 to 6), monthday (a number), runHour (a number, default 9), skipIfOpen (boolean), missedPolicy (skip, create or roll), until (a date), sprintId or sprintArray, assignees (list of user ids), taskType, taskTypeKey, priority, points, rawDescription, descriptionBlock and userData from the body. A missing required field answers status false with 'Missing required fields (name, taskName, projectData, freq)'. Answers with data: the saved rule, and statusText 'Recurring task created'. A description that is too long answers 400.
PATCH	/api/v1/recurring-tasks/:id	Session or token	internal	Changes a repeat rule. The caller must be able to write in the rule's project (no task permission key is checked here). Reads id (rule id) from the path and any of name, enabled, freq, interval, byweekday, monthday, runHour, skipIfOpen, missedPolicy and until from the body; when the schedule fields change the next run time is worked out again. Answers with status true and statusText 'Updated'. A failure answers status false with the error text.
DELETE	/api/v1/recurring-tasks/:id	Session or token	internal	Deletes a repeat rule by switching it off and marking it deleted. The caller must be able to write in the rule's project (no task permission key is checked here). Reads id (rule id) from the path. Answers with status true and statusText 'Deleted'. A failure answers status false with the error text.
POST	/api/v1/recurring-tasks/:id/run-now	Session or token	internal	Makes one task from a repeat rule right now. The caller needs task.task_create in the rule's project. Reads id (rule id) from the path. Answers with data: id (the new task id or null) and skipped (true when the last task is still open and the rule's policy says not to make another), and statusText 'Task created' or 'Skipped, previous instance still open'. A rule that is not found answers status false with 'Definition not found'.
GET	/api/v1/recurring-tasks/project/:pid	Session or token	internal	Lists the recurring task rules of one project. Needs a project the caller can open (a private project only for people assigned to it or roles that see every private project; a personal list only for its owner). Reads pid (id) from the path. Answers with data: the project's recurring task rules that are not deleted. On an error it answers status false with statusText.
POST	/api/v1/recurring-tasks/run-due	Session or token	internal	Runs every repeat rule of the workspace that is due now. Only an owner or an admin may call it. Reads nothing from the body. Answers with data: processed (rules looked at) and created (tasks made), and statusText 'Processed due recurring tasks'. A failure answers status false with the error text.
GET	/api/v1/recurring-tasks/task/:taskId	Session or token	internal	Reads the repeat rule of one task. The caller must be able to open the task's project. Reads taskId (id) from the path. Answers with status true and data: the rule, or null when the task does not repeat. A bad id answers 400 'A valid task id is required.', a task that is not found answers 404 'Task not found.'.
PUT	/api/v1/recurring-tasks/task/:taskId	Session or token	internal	Makes a task repeat, or changes how it repeats. The caller needs task.task_due_date and task.task_create in the task's project. Reads taskId (id) from the path and freq (required, daily, weekly or monthly), interval (whole number from 1 up), byweekday (list of days 0 to 6), monthday (1 to 31), runHour (0 to 23), until (a date), maxRuns (whole number) and missedPolicy (skip, create or roll) from the body. The acting user comes from the session. Answers with data: the rule, and statusText 'Repeat set' for a new rule or 'Repeat updated' for an existing one. A bad schedule or id answers 400 with the reason, a task that is not found answers 404 'Task not found.'.
DELETE	/api/v1/recurring-tasks/task/:taskId	Session or token	internal	Stops a task from repeating by removing its repeat rule. The caller needs task.task_due_date in the task's project. Reads taskId (id) from the path. Answers with status true and statusText 'Repeat removed', also when the task had no rule. A bad id answers 400, a task that is not found answers 404 'Task not found.'.
POST	/api/v1/refundamount	Session or token	internal
GET	/api/v1/reminders	Session or token	internal
POST	/api/v1/reminders	Session or token	internal
PATCH	/api/v1/reminders/:id	Session or token	internal
DELETE	/api/v1/reminders/:id	Session or token	internal
POST	/api/v1/reminders/:id/run-now	Session or token	internal
POST	/api/v1/reminders/run-due	Session or token	internal
DELETE	/api/v1/removeBucket/:bucketId	Instance admin	internal
POST	/api/v1/removeCache	Session or token	internal
POST	/api/v1/removeUserNotification	Session or token	internal
GET	/api/v1/reports/capacity	Session or token	internal
GET	/api/v1/reports/capacity/months	Session or token	internal
GET	/api/v1/reports/custom	Session or token	internal
POST	/api/v1/reports/custom	Session or token	internal
PUT	/api/v1/reports/custom/:id	Session or token	internal
DELETE	/api/v1/reports/custom/:id	Session or token	internal
POST	/api/v1/reports/custom/:id/duplicate	Session or token	internal
GET	/api/v1/reports/custom/:id/run	Session or token	internal
POST	/api/v1/reports/custom/from-template	Session or token	internal
POST	/api/v1/reports/custom/run	Session or token	internal
GET	/api/v1/reports/custom/templates	Session or token	internal
GET	/api/v1/reports/schedules	Session or token	internal
POST	/api/v1/reports/schedules	Session or token	internal
PUT	/api/v1/reports/schedules/:id	Session or token	internal
DELETE	/api/v1/reports/schedules/:id	Session or token	internal
POST	/api/v1/reports/schedules/:id/run-now	Session or token	internal
POST	/api/v1/reports/schedules/run-due	Session or token	internal
GET	/api/v1/reports/variance	Session or token	internal
GET	/api/v1/reports/variance/summary	Session or token	internal
GET	/api/v1/restricted-extensions	Session or token	internal
PUT	/api/v1/root-members	Session or token	internal	Lets an invited person accept their invitation to a company. The caller must be signed in, and either holds settings.settings_member_list or sends a body that only links their own account to the invitation. Reads id (invitation row id, required), companyId (id, required), data (object with userId and status, required) and linkId (string, the invitation link token) from the body. The data.userId must be the caller, data.status must be 2, and the invitation must still be pending, carry the right link and be sent to the caller's account or email. Answers with status, statusText (Invitation accepted.) and data: the seat row. Refusals answer 400, 401, 403 or 404 with statusText, and other failures 500.
GET	/api/v1/screenshot-retention	Session or token	internal
PUT	/api/v1/screenshot-retention	Session or token	internal
GET	/api/v1/screenshot-retention/preview	Session or token	internal
GET	/api/v1/securityPermissions	Session or token	internal
PUT	/api/v1/securityPermissions	Session or token	internal
POST	/api/v1/send-fcm	Session or token	internal
POST	/api/v1/setPresetCompany	No login guard	internal
GET	/api/v1/setPresetCompany/:id	No login guard	internal
GET	/api/v1/setting/category	Session or token	internal
GET	/api/v1/setting/companyUserStatus	Session or token	internal
GET	/api/v1/setting/designation	Session or token	internal
PUT	/api/v1/setting/designation/update	Session or token	internal
GET	/api/v1/setting/projectStatus	Session or token	internal
PUT	/api/v1/setting/projectStatus	Session or token	internal
GET	/api/v1/setting/roles	Session or token	internal
PUT	/api/v1/setting/roles/update	Session or token	internal
GET	/api/v1/setting/skills	Session or token	internal
PUT	/api/v1/setting/skills	Session or token	internal
GET	/api/v1/setting/taskStatus	Session or token	internal
PUT	/api/v1/setting/taskStatus	Session or token	internal
GET	/api/v1/setting/taskType	Session or token	internal
PUT	/api/v1/setting/taskType	Session or token	internal
GET	/api/v1/settings/oauth	Instance admin	internal
POST	/api/v1/settings/oauth	Instance admin	internal
POST	/api/v1/slack/command/:companyId	No login guard	internal
POST	/api/v1/sprint	Session or token	internal	Creates a list (sprint) in a project, or a chat channel. The caller needs project.project_sprint_create in the project (chat channels are judged by chat access instead), and any person named as a member of a channel must be a member of the workspace. AI agent accounts are refused. Reads projectId (id), sprintName (string), folder (object with folderId, the folder to put it in, which must be a live folder of the project), private (boolean), icon, mainChat (boolean, for a chat channel), AssigneeUserId and sendMessage (channels only), isPreCompany, from and taskSprintObj from the body. The acting user is taken from the session. Answers with data: the new list, and statusText 'List added successfully'. It answers status false with 'Upgrade your plan' (and isUpgrade true) when the plan's list limit is reached, or 'Channels creation limits have been exceeded' for channels. Other failures answer status false with the error text.
PATCH	/api/v1/sprint/:id	Session or token	internal	Renames, updates or deletes one list (sprint) or chat channel, depending on type. The caller must be able to open the list and write in its project, and needs the permission that matches the change: project.project_sprint_name_edit for a rename, project.sprint_delete for deleteChannel, and for updateSprint the restore, delete or archive key for the new deletedStatusKey, or the edit or share keys when it moves a list or changes who may see it. AI agent accounts are refused. Reads id (list id) from the path and type (string, one of editSprintName, updateSprint, deleteChannel, required) from the body. For editSprintName it reads sprintName (string, 1 to 50 characters) and projectId. For updateSprint it reads updateObject, which may only $set deletedStatusKey, private, AssigneeUserId, folderId, folderName, or $addToSet or $pull one member or watcher. A list that is running a Scrum sprint cannot be archived. For deleteChannel it reads companyId. Answers with data: the updated list, and statusText 'Sprint_updated_successfully' (or 'Sprint_deleted_successfully' for a delete). A missing type answers status false with 'type not found', an unknown type answers 400 'Invalid type', a list that is not found answers status false with 'Sprint not found'.
DELETE	/api/v1/storage/removeFile/:bucketId	Session or token	internal
POST	/api/v1/storage/uploadFile	Session or token	internal
POST	/api/v1/storage/uploadFileBase64	Session or token	internal
GET	/api/v1/subscription	Session or token	internal
PUT	/api/v1/subscription	Instance admin	internal
GET	/api/v1/subscription/:id	Session or token	internal
POST	/api/v1/subscription/find	Session or token	internal
POST	/api/v1/subscriptions	Instance admin	internal
GET	/api/v1/subscriptions/:id	Session or token	internal
POST	/api/v1/tabSyncTask	Session or token	internal	Returns the tasks of one list that changed since the person left the browser tab, so the board or table can refresh. Any signed-in member of the workspace may call it, and the rows are limited to tasks the caller may see. Reads pid (project id, required), sprintId (list id, required), istableTask (boolean, required, true for table view and false for board view), tabLeaveTime (a time in milliseconds), item (the group being refreshed, with indexName and mongoConditions or conditions), indexName, sortKey (like 'field:1'), showAllTasks, userId and parentId (to read sub tasks of one parent) from the body. Answers with the raw list of matching rows, not wrapped in data; for board view it is one object holding result (changed tasks) and count. A missing required field or a refused query answers 400 with message.
PUT	/api/v1/task	Session or token	internal	Moves every task of one project between active, closed, deleted and restored states, to follow a change of the project itself. AI agent accounts are refused. The caller must be a member of the workspace and, unless owner or admin, able to open the project, and must hold the permission for the change: project.project_close for 0 to 8, project.project_delete for 0 to 7 or 0 to 1, project.project_list for 7 to 0 or 8 to 0. Reads key (string, must be updateMany), firstParameter (object with ProjectID or objId.ProjectID, and deletedStatusKey as the current state number) and secondParameter (object { $set: { deletedStatusKey } } with the new state number), all required; any other body key is refused. Answers with data: the update result (matchedCount, modifiedCount), and statusText 'Tasks updated successfully.'. A refused request answers 403 with statusText 'Forbidden' and a message; a missing field answers 400.
GET	/api/v1/task/:id	Session or token	undocumented	Reads one task by its id.
GET	/api/v1/task/filter/:userId	Session or token	internal	Lists the saved task filters of the caller. Any signed-in member of the workspace may call it, but only for themselves. Reads userId (id) from the path; if it is not the caller's own id it answers 403 'You can only read your own saved filters.'. Answers with status true and data: the caller's saved filters of kind taskFilter for projectTask, or an empty list. A failure answers 500 with statusText.
POST	/api/v1/task/filter/create	Session or token	internal	Saves a task filter for the caller. Any signed-in member of the workspace may call it, and the filter always belongs to the caller. Reads the filter fields from the body, for example name, filters, sortByField, sortByOrder; any _id is dropped and userId and companyId are set by the server. A userId naming someone else answers 403 'A saved filter can only be created for yourself.'. Answers with status true and data: the saved filter. A failure answers 500 with statusText.
DELETE	/api/v1/task/filter/delete/:cid/:id	Session or token	internal	Deletes one saved task filter of the caller. Any signed-in member of the workspace may call it, and it can only remove filters the caller owns. Reads cid (company id, must equal the workspace in the companyid header, else 403) and id (filter id) from the path, and projectId from the query only to write a history line. A bad id answers 400, a filter that is not found for the caller answers 404 'Saved filter not found.'. On success answers status true with no data.
PUT	/api/v1/task/filter/update	Session or token	internal	Changes one saved task filter of the caller. Any signed-in member of the workspace may call it, and it can only touch filters the caller owns. The body is a list of two items: first { _id } (the filter id, required, 24 character id), then { $set } holding any of name, filters, sortByField, sortByOrder (other fields are ignored). Reads projectId from the query only to write a history line. A bad id or an empty update answers 400, a filter that is not found for the caller answers 404 'Saved filter not found.'. On success answers status true with no data.
POST	/api/v1/task/find	Session or token	internal	Runs a read only search over tasks using a query pipeline and returns the matching tasks. Any signed-in member of the workspace may call it, and the server first narrows the rows to tasks the caller may see. Reads findQuery (a list of query stages, or one stage, required), replaceUndefined (boolean) and inList (a list id, so that tasks added to that list as an extra list are included) from the body. Answers with the raw list of matching rows, not wrapped in data. A missing query answers 400 'Query is required.', a stage that is not allowed answers 400 'Query refused' with message and stage, and other failures answer 500.
POST	/api/v1/taskIndex	Session or token	internal	Saves the new place of a task after it is dragged on a board, and changes any field the drag changed. The caller must be able to open the task, with the task.task_list permission in its project. Reads from the body, all required: taskId, projectId, sprintId, taskKey, isFirst (boolean), isFirstWithRecord (boolean), relevantIndex (a number), indexName (one of groupByStatusIndex, groupByPriorityIndex, groupByAssigneeIndex, groupByDueDateIndex), searchKey (one of statusKey, Task_Priority, AssigneeUserId, DueDate), relevantKey and updateData (object with the changed statusKey, Task_Priority, AssigneeUserId, DueDate and so on). The workspace is taken from the header. The work is queued per project and done after the answer, so it answers right away with status true and statusText 'Process Is Start For Index'. A missing field answers 400 '<field> is required'.
GET	/api/v1/taskPriority	Session or token	internal	Lists the workspace's task priorities. Any signed-in member of the workspace may call it. Reads nothing from the body or query; the workspace comes from the companyid header. Answers with the raw list of settings documents named for task priorities (not wrapped in data), kept in a cache for a week and marked with a FromCache header when it came from there. A missing header answers 400, a failure answers 500 with message.
PUT	/api/v1/taskPriority	Session or token	internal	Changes the workspace's list of task priorities. Only an owner or an admin may call it. Reads key (string, required, $push or $pull) and updateObject (object, required, holding settings with one priority entry) from the body. A missing or invalid value answers 400 with message. Answers with the raw update result (not wrapped in data), and clears the cached priority list. A failure answers 500 with message and error.
GET	/api/v1/teams	Session or token	internal	Lists the teams of the workspace. Any signed-in member of the workspace may call it. Reads nothing from the request. Answers with the list of team records itself (no data wrapper), and sets a FromCache header when the list came from cache. Failures answer 500 with message and error.
POST	/api/v1/teams/addTeam	Session or token	internal	Creates a team. The caller needs the settings.settings_create_team permission, checked strictly, else 403 with statusText. Reads name (string, required), value (string, required), teamColor (object with bgColor and color strings, required) and assigneeUsersArray (list of user ids, each must be a member of the workspace) from the body. Any other field is refused. Answers with the saved team record itself. Bad input answers 400 with statusText, and other failures 500.
PUT	/api/v1/teams/updateTeam	Session or token	internal	Changes a team's name or colour, or adds or removes one member. The caller needs the settings.settings_team_list permission, checked strictly, else 403 with statusText. Reads id (team id, required), key ($set, $addToSet or $pull, required) and updateObject (object) from the body. With $set, updateObject may hold name, value (both strings) and teamColor. With $addToSet or $pull, it holds one assigneeUsersArray user id, and an added user must be a workspace member. Answers with the updated team record itself. Bad input answers 400 with statusText, and other failures 500.
GET	/api/v1/templates/taskStatus	Session or token	internal
POST	/api/v1/templates/taskStatus	Session or token	internal
PUT	/api/v1/templates/taskStatus	Session or token	internal
DELETE	/api/v1/templates/taskStatus/:id	Session or token	internal
GET	/api/v1/templates/taskType	Session or token	internal
POST	/api/v1/templates/taskType	Session or token	internal
PUT	/api/v1/templates/taskType	Session or token	internal
DELETE	/api/v1/templates/taskType/:id	Session or token	internal
POST	/api/v1/timesheet	Session or token	internal
POST	/api/v1/timesheet/billable-summary	Session or token	internal	Adds up billable and non-billable time over a period. Any signed-in member of the workspace may call it. Owners and admins read the whole company and may filter by user; others read only their own time. Projects hidden from the caller are left out. Reads userArray (ids), projectArray (ids), start and end (Unix times in seconds, both needed to filter by date) from the body. Answers with data: the billable split plus scope (company or self).
PUT	/api/v1/timesheet/entries/billable	Session or token	internal	Marks time entries billable or not. Any signed-in member of the workspace may call it. Owners and admins may change any entry; others only their own, and other entries are left alone. Reads entryIds (a list of ids, required, else 400) and billable (a boolean, anything but false counts as true) from the body. Answers with statusText Billable updated. and data: updated and billable.
POST	/api/v1/timesheet/export-csv	Session or token	internal	Exports time entries as a CSV file. Any signed-in member of the workspace may call it. Reads userArray (ids), projectArray (ids), start and end (Unix times in seconds, both needed to filter by date) from the body. Answers with a downloadable CSV file timesheet-export.csv with user, project, date, description, billable and hours. A failure answers 500 with the text Export failed.
POST	/api/v1/timesheet/generate-invoice	Session or token	internal
GET	/api/v1/timesheet/hours-by-source	Session or token	internal	Adds up the hours people logged, leaving out AI agent time. Any signed-in member of the workspace may call it. Owners and admins get the whole company, others only their own hours. Reads start and end (Unix times in seconds) from the query, both optional. Answers with data: peopleHours, entryCount, start, end and scope (company or self).
POST	/api/v1/timesheet/logDetail	Session or token	internal
POST	/api/v1/timesheet/milestone	Session or token	internal
POST	/api/v1/timesheet/project	Session or token	internal
GET	/api/v1/timesheet/rates	Session or token	internal
POST	/api/v1/timesheet/rates	Session or token	internal	Saves a billing rate. Only an owner or admin may call it, else 403. Reads scope and rate (required), refId (needed for scopes other than default) and currency (default USD) from the body. It updates the rate for that scope and refId or adds it. Answers with statusText Rate saved. and data: the saved rate; bad input gives status false.
GET	/api/v1/timesheet/reminder-settings	Session or token	internal	Reads the company's time reminder settings. Any signed-in member of the workspace may call it. Reads the company header only. Answers with data: settings. Without the company header it answers 400.
PUT	/api/v1/timesheet/reminder-settings	Session or token	internal	Changes the company's time reminder settings. Only an owner or admin may call it, else 403. Reads enabled (a boolean) and userIds (a list) from the body; at least one is needed, else 400. Answers with statusText Reminder settings updated. and data: settings.
POST	/api/v1/timesheet/send-reminders	Session or token	internal	Sends the log your time reminder emails now. Any signed-in member of the workspace may call it. Reads nothing. It emails the chosen members who have not logged time today, only when reminders are switched on, there are chosen members and today is a working day. Answers with statusText Reminders processed. and data: reminded, total, users and, when nothing was sent, skipped with the reason.
GET	/api/v1/timesheet/task/:taskId	Session or token	internal	Gives the time entries logged on one task. Needs a task the caller can open. Reads taskId from the path. The caller sees only their own entries, unless they hold the Everyone grant on the user timesheet for that project, then all. Answers with data: taskId, estimateMinutes, totalMinutes, mineMinutes, seesEveryone and entries (each with userId, startedAt, endedAt, minutes, note, billable, source, running, locked and canEdit). A bad id answers 400 and a missing task 404.
POST	/api/v1/timesheet/timelog	Session or token	internal
POST	/api/v1/timesheet/tracker	Session or token	internal
POST	/api/v1/timesheet/user	Session or token	internal
GET	/api/v1/timesheet/week	Session or token	internal	Gives one person's week of logged time, grouped by task, with capacity and approval state. Any signed-in member of the workspace may call it. Only an owner or admin may name another person with userId; for anyone else it is ignored. Reads start and end (dates, required, else 400), userId, projectId, hoursPerDay (a number, default 8) and timeZone from the query. Answers with data: userId, zone, hoursPerDay, workingDays, days, rows, totals, underCapacity, approval and running.
POST	/api/v1/timesheet/workload	Session or token	internal
PUT	/api/v1/timesheet/workload-capacity	Session or token	internal
POST	/api/v1/timesheet/workload-grid	Session or token	internal
POST	/api/v1/timesheet/workload-move	Session or token	internal
GET	/api/v1/tours	Session or token	internal
GET	/api/v1/tracker	No login guard	internal
POST	/api/v1/tracker/create	Instance admin	internal
DELETE	/api/v1/tracker/delete/:id	Instance admin	internal
PUT	/api/v1/tracker/update	Instance admin	internal
POST	/api/v1/unsetCommentCounts	Session or token	internal	Clears stored unread comment counts for a project or list. Any signed-in member of the workspace may call it, and the code checks no project access or role. Reads projectId (id), sprintId (id), searchKey (string) and companyId (id) from the body. One of projectId or searchKey is required, else 400 with statusText. A companyId that differs from the company header answers 403. It removes the matching count fields for every user's count record in the company, not only the caller's. Answers with status, statusText (success) and data: the result of the bulk update. Failures answer 500 with statusText.
POST	/api/v1/updateAiModel	Instance admin	internal
PATCH	/api/v1/updateBucket/:bucketId	Instance admin	internal
POST	/api/v1/updateEmailTemplate	Instance admin	internal
POST	/api/v1/updateTaskIndexOnload	Session or token	internal	Gives a task a board position when it has none for the chosen grouping, as the board loads. The caller must be able to open the task, with the task.task_list permission in its project. Reads taskUpdate (required) from the body: an object with data (the task id) and item (with indexName, searchKey, searchValue). Answers with status true and statusText 'Index Update Successfully' when it set a position, or 'No Need To Processs' when the task already had one. A missing taskUpdate answers status false with 'Task Update Is Required', and a task that is not found answers 404 'Task not found'.
POST	/api/v1/updatemilestone	Session or token	internal
POST	/api/v1/updateunreadcommentscount	Session or token	internal	Changes the signed-in user's unread count for a project, task, chat message, mention or notification. Any signed-in member of the workspace may call it, but only for their own counts: if userIds (array of ids) names anyone else it answers 403 with statusText. Reads key (number, required: 1 project, 2 task, 3 chat message, 4 mention, 5 notification), read, set and readAll (booleans), messageCount and prevCount (numbers), projectId, sprintId, taskId, messageId and parentTaskId (ids) from the body. Keys 1 and 2 need projectId and userIds, key 2 also needs sprintId and taskId, key 3 needs messageId, key 4 needs readAll. With read, set or readAll it changes only the caller's count; without them only keys 1, 2 and 4 are accepted, else 403. A companyId in the body that differs from the company header is refused. Answers with status and data: a message that the count was updated. A rejected request answers 400 with statusText.
PUT	/api/v1/user	Session or token	internal
GET	/api/v1/user/:id	Session or token	internal
POST	/api/v1/user/find	Session or token	internal
POST	/api/v1/userAndCompanyCheck	Session or token	internal
POST	/api/v1/validateRefferalCode	Session or token	internal
POST	/api/v1/verifyToken	Session or token	internal
POST	/api/v1/versionUpdateNotify	Instance admin	internal
POST	/api/v1/wasabi/deleteFile	Session or token	internal
POST	/api/v1/wasabi/retriveObject	Session or token	internal
GET	/api/v1/wasabi/retriveUserProfile/:companyId/:path	Session or token	internal
POST	/api/v1/wasabi/uploadFile	Session or token	internal
POST	/api/v1/wasabi/uploadFile_64	Session or token	internal

Everything else

Method	Path	Auth	Status	Summary
GET	/	No login guard	undocumented
GET	/.well-known/oauth-authorization-server	No login guard	undocumented
GET	/.well-known/oauth-protected-resource	No login guard	undocumented
GET	/.well-known/oauth-protected-resource/mcp	No login guard	undocumented
PATCH	/api/tasks/	Session or token	internal	Changes one task with an older style call that only knows three actions. The caller must be able to open the task and hold the matching task permission in its project: task.task_status for updateStatus, task.task_priority for updatePriority, task.task_name_edit for updateTaskName. Reads action (string, one of those three, any other value is refused with 400) from the body, plus the fields of that action: newStatus, prevStatus (with taskId), task, projectData, isUpdateTask for a status change; firebaseObj (Task_Priority), taskData, priorityObj (with taskId), projectData for a priority change; firebaseObj (TaskName), taskData, obj, projectData for a rename. The acting user is taken from the session, not the body. Answers with data: the result of the action, and statusText 'Task updated successfully.'. A task the caller cannot open answers 404 and a missing task permission answers 403; other failures answer status false with the error text.
POST	/api/v3/timeTracker/start	Session or token	undocumented	Starts a tracker timer on a task, for the desktop tracker. Any signed-in member of the workspace may call it. The caller can only start a timer for themselves; a userId naming someone else answers 403. Only users marked as tracker users may start one, else it answers isPermissionDenied. Reads description, projectId and taskId from the body, all required, plus considerActionTime (boolean) and actionTime (a Unix time in seconds) to set the start time. A start in an approved, locked period is refused. Answers with statusText: the id of the new time entry.
POST	/api/v3/timetracker/capture	Session or token	undocumented	Stores a tracker screenshot on a running timer and moves its end time forward. Any signed-in member of the workspace may call it. Reads file, path, companyId, timeSheetId, key, imageName, prevscreenShot, screenShotTime, memoName and strokes (a JSON string) from a form upload; all are required. companyId must match the company header, timeSheetId must be a timer of the caller that is still running, and path must lie in that timer's own capture folder, or it answers 403 (a path already stored answers 409). The image is the uploaded file. Answers with statusText Data Update Succesfully.
POST	/api/v4/timetracker/capture	Session or token	undocumented	Stores a tracker screenshot on a running timer and moves its end time forward, for the desktop tracker. Any signed-in member of the workspace may call it. Reads file, path, companyId, timeSheetId, key, imageName, prevscreenShot, screenShotTime, memoName and strokes (a JSON string) from a form upload; all are required. companyId must match the company header, timeSheetId must be a timer of the caller that is still running, and path must lie in that timer's own capture folder, or it answers 403 (a path already stored answers 409). The image is the uploaded file. Only tracker users may use it, else it answers isPermissionDenied. It also reads considerActionTime and actionTime (seconds) to set the end time. Answers with statusText Data Update Succesfully.
USE	/apidocs	No login guard	undocumented
GET	/company-create/events/:id	No login guard	undocumented
GET	/connections	No login guard	undocumented
GET	/connections/:id	No login guard	undocumented
GET	/form/:token	No login guard	undocumented
POST	/form/:token	No login guard	undocumented
GET	/health	No login guard	undocumented
GET	/importUser/events/:id	No login guard	undocumented
GET	/mcp	No login guard	undocumented
POST	/mcp	No login guard	undocumented
GET	/mcp/manifest	No login guard	undocumented
GET	/oauth/authorize	No login guard	undocumented
GET	/oauth/consent	No login guard	undocumented
POST	/oauth/consent	Session or token	undocumented
POST	/oauth/consent/approval-request	Session or token	undocumented
GET	/oauth/consent/details	Session or token	undocumented
POST	/oauth/register	No login guard	undocumented
POST	/oauth/revoke	No login guard	undocumented
POST	/oauth/token	No login guard	undocumented
GET	/pickers/google-drive	No login guard	undocumented
GET	/pickers/google-drive.js	No login guard	undocumented
GET	/scim/v2/ResourceTypes	No login guard	undocumented
GET	/scim/v2/Schemas	No login guard	undocumented
GET	/scim/v2/ServiceProviderConfig	No login guard	undocumented
GET	/scim/v2/Users	No login guard	undocumented
POST	/scim/v2/Users	No login guard	undocumented
GET	/scim/v2/Users/:id	No login guard	undocumented
PUT	/scim/v2/Users/:id	No login guard	undocumented
PATCH	/scim/v2/Users/:id	No login guard	undocumented
DELETE	/scim/v2/Users/:id	No login guard	undocumented
GET	/share/:token	No login guard	undocumented
POST	/share/:token	No login guard	undocumented
POST	/share/:token/intake	No login guard	undocumented
GET	/share/:token/page/:pageId	No login guard	undocumented
GET	/task-import/events/:id	No login guard	undocumented
GET	/version	No login guard	undocumented