My API key (connection test)

Returns the API key's validity and capabilities (scopes). Being a GET, it needs no write scope — even a read-only key can inspect its own capabilities. A missing/invalid/expired key returns 401, which is itself the connection-test result. Use canProvision/canWrite/canRead in the response to check ability up front (e.g. if canProvision=false, warn before a provisioning call → avoids a false green light). Separate from infrastructure liveness (whether the server is up).

Provision workspace (idempotent)

Provision a tenant and workspace in one call with a provisioning-scoped API key. Send tenantId to use that tenant (the calling key's account must be OWNER/ADMIN); otherwise tenantExternalRef idempotently finds/creates a tenant in the account namespace (400 if neither is given). workspaceExternalRef is the required idempotency key — repeat requests return the existing resource as 200 instead of creating (201); createdTenant/createdWorkspace tell them apart. Scope hierarchy: provisioning ⊃ write (no separate write needed). ⚠️ businessType has no effect on the result yet (audit only); defaultLocale/accentHue/template are loosely validated (send exact allowed values; unknown template is ignored); response tenant.myRole may be null — do not use it for authorization.

This endpoint is available only on the Enterprise plan. Issuing and using provisioning-scope keys is included in an Enterprise contract.

My tenants

Returns every tenant the API key's account belongs to (direct tenant members + organizations reachable only via a workspace = MEMBER). It's a GET, so a read scope is enough. Judge permissions from each item's myRole (OWNER|ADMIN|MEMBER) — creating a workspace (POST /workspaces) is only possible on tenants where myRole ∈ [OWNER, ADMIN], so an SI client picks an OWNER/ADMIN item's id here and uses it as tenantId.

Single tenant

Returns one tenant in the same shape as the list. If you don't belong to it, the access check fails (403); a nonexistent tenant returns 400 tenant.not_found. A read scope is enough.

Create workspace (existing tenant)

A lightweight path separate from provisioning — it does NOT create a tenant; it creates only a workspace under an existing tenant (tenantId). A write scope is enough (provisioning not required; read-only keys get 403 SCOPE_FORBIDDEN). The calling key's account must be OWNER/ADMIN of that tenant. If you pass externalRef it is idempotent — repeating with the same (tenantId, externalRef) returns the existing workspace as 200 instead of creating a new one (201); if omitted, a new workspace is created on every call (passing it is recommended for safe retries). The created workspace is a team workspace (not personal). ⚠️ defaultLocale/accentHue/template are weakly validated (values pass through; an unrecognized template is ignored). If you need the tenant auto-created, use provisioning (POST /provisioning/workspaces).

Check workspace slug availability

Checks whether a workspace slug is available (not taken) within a tenant. Because a slug is unique per (tenantId, slug), tenantId is required just like workspace creation. The slug is normalized the same way as on save (trimmed, lowercased) before comparison, and an empty or duplicate value returns available:false. Authorization uses the same gate as workspace creation — the caller must be an OWNER/ADMIN of that tenant (requireTenantAdmin); non-members and non-admins get 403, and tenant existence is not disclosed. Being a GET, a read scope is sufficient. Use this to pre-check slug availability before creating a workspace (POST /workspaces).

List workspaces

Returns the workspaces accessible to the API-key account.

Get workspace

Returns a single workspace.

List projects by tenant & workspace

Returns the projects of the given tenant and workspace, paginated. tenantId and workspaceId are required; status can further filter.

List projects

Returns the active projects of a workspace (cancelled/archived excluded).

Create project (idempotent)

Creates a project. With externalRef the call is idempotent — repeating the same (workspaceId, externalRef) returns the existing project with 200 instead of creating a new one (201 on first creation).

Get project / progress

Returns project detail including status, progress (%), planned/actual dates and last-modified time.

Update project

Updates only the fields you send (partial update).

Delete project

Deletes a project. Returns 204 No Content on success (empty body).

Timeline (milestones)

Project milestones — name, status (PLANNED/IN_PROGRESS/COMPLETED), due date, completion date and progress. Ordered by sortOrder.

Activities

Task change events of the project, newest first — type, message, actor and timestamp.

Files

Task and comment attachments of the project merged, newest first. fileUrl is a static, non-expiring URL.

List tasks

Returns the tasks of a project. Use /tasks/paged when you need pagination.

Create task

Creates a task.

Get task

Returns a single task.

Update task

Updates only the fields you send.

Delete task

Deletes a task. Returns 204 No Content on success.

My assigned tasks

Returns the tasks assigned to the API-key account.

List documents

Returns the documents of a project. Use /documents/paged when you need pagination.

Get document

Returns a single document including its content.

Create document

Creates a document.

Update document

Updates only the fields you send.

Delete document

Deletes a document. Returns 204 No Content on success.