Overview
Every endpoint a token can reach, grouped by resource, with the scope each one requires.
These pages list the published surface — the allowlist of endpoints an API token can reach. A path that is not on this list refuses a token regardless of its scopes, because the gate is a default-deny allowlist rather than a set of per-endpoint opt-outs.
The tables on these pages are generated from the same OpenAPI document the
backend publishes at /api/v1/public/schema/, which a backend test keeps in
step with the code. When you need request and response bodies rather than the
shape of the surface, read the schema or the reference UI at
/api/v1/public/docs/ — both are open, no token required.
By resource
Tasks
Tasks, subtasks, links, followers, activity, labels, milestones, sprints and search
Projects
Projects and project memberships
Comments
Comments and reactions
Attachments
Upload, list and download files
Custom fields
Field definitions, options and ordering
Workflows
Statuses, transitions and workflow definitions
Reports
Throughput, cycle time, burndown, velocity, aging and time logged
Standups
Entries, blockers, history and worklists
Webhooks
Endpoints, the event catalog, deliveries and replay
Members
The workspace roster. Read-only by design
What is not here
Not an oversight — these are deliberately outside the published surface, so no combination of scopes reaches them:
- API tokens themselves. A token that could mint a broader token defeats the model entirely.
- Organization settings, SSO and billing.
- Seat and membership management. Changing who is in the workspace, and at what role, is how an automation would escalate its own reach.
- Inbound email routing.
- Data export. Rate-limited to once a day and not published.
A note on identifiers
Endpoints humans reach for take the identifiers humans use — a task key like
krrim-0042, a project key like APOLLO. Everything else takes a numeric id.
See Conventions.