Projects
Workspace Projects and their workflow Statuses.
List access-filtered Project activity
/api/v1/projects/{project_id}/activityReturns newest-first, cursor-bounded meaningful work changes inside one
Project: its own changes plus its Tasks, comments, Documents and
Milestones. It shares the Workspace Activity retention, redaction,
grouping, and safe projection rules, and Project read access is
re-evaluated for every request, so a private Project the caller cannot
read returns 404 and no item, cursor, or has_more value can disclose
inaccessible work. limit bounds the events examined, so a page may
hold fewer items than limit; only has_more says whether history
continues. Activity is immutable historical evidence and never
determines which Tasks are in progress.
Path Parameters
Query Parameters
Responses
integer <int64>·min 0Authorized collection size before cursor bounds; refreshed at read time. Activity counts admitted events before display grouping and Comments include retained ordinals.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Read the optional Project lifecycle policy
/api/v1/workspaces/{workspace_id}/project-lifecycleReturns the revisioned Workspace policy. The durable default is disabled at revision 1.
Path Parameters
Responses
stringQuoted decimal optimistic-concurrency version.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Enable or disable Project lifecycle states
/api/v1/workspaces/{workspace_id}/project-lifecycleRequires workspace:manage. Disabling preserves state definitions and
Project selections, but all catalog and Project-state mutations are
refused until the capability is enabled again.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Request Body
Responses
stringQuoted decimal optimistic-concurrency version.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List Workspace Project states
/api/v1/workspaces/{workspace_id}/project-statesReturns a cursor-bounded ordered page. Active members may read retained definitions even while the optional capability is disabled.
Path Parameters
Query Parameters
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Create a Project state
/api/v1/workspaces/{workspace_id}/project-statesRequires workspace:manage, an enabled lifecycle policy, and fewer than 100 retained definitions.
Path Parameters
Header Parameters
Request Body
Responses
stringQuoted decimal optimistic-concurrency version.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Rename or restore a Project state
/api/v1/project-states/{state_id}Changes exactly one field. Restore uses archived: false; the capability must be enabled.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Request Body
Responses
stringQuoted decimal optimistic-concurrency version.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Archive an unused Project state
/api/v1/project-states/{state_id}Refuses an in-use state with 409 project_state_in_use; use the replacement command for that case.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Replace an in-use Project state and archive it
/api/v1/project-states/{state_id}/archive-and-replaceAtomically moves active Projects to a different active same-Workspace state and archives the source.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Request Body
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Move a Project state
/api/v1/project-states/{state_id}/moveReorders the bounded active catalog using immediate neighbour anchors.
Path Parameters
Header Parameters
Request Body
application/jsonstring <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
Responses
stringQuoted decimal optimistic-concurrency version.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List Workspace Projects
/api/v1/workspaces/{workspace_id}/projectsReturns one bounded page of authorized Workspace Projects in shared manual order. Every bearer caller resolves current membership for the requested Workspace; browser callers retain their current session behavior. A continuation binds the prior page's Workspace Project and authority revision. A reorder or permission change returns 409 catalog_changed with no items; restart the traversal from the first page.
Path Parameters
Query Parameters
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Create a Project
/api/v1/workspaces/{workspace_id}/projectsCreates a Project with its default Backlog/Todo/In Progress/
Done workflow. key is the uppercase-normalized ticket prefix
([A-Z][A-Z0-9]{1,7}, unique per Workspace, immutable after
creation); it is not a substitute for the opaque id.
Accepts native mobile bearer credentials with live Workspace and Project
authorization. Browser sessions still require CSRF; native callers omit it.
Path Parameters
Header Parameters
Request Body
application/jsonstringUppercase-normalized ticket prefix used to form human-readable Task
references (for example ASSIGN-42). Unique per Workspace and
immutable after creation; not a substitute for the opaque id.
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Current Actor that owns the Project and serves as its lead. The owner and Workspace administrators may publish or unpublish it; governed owner transfer is separately revision-checked.
stringUppercase-normalized ticket prefix used to form human-readable Task
references (for example ASSIGN-42). Unique per Workspace and
immutable after creation; not a substitute for the opaque id.
string·min 1·max 63Editable, Workspace-unique URL segment generated from the Project name at creation.
string·max 500Optional plain-text Project summary. It is returned only to authenticated Project readers.
string <uri>·max 2048Optional absolute HTTP or HTTPS Project link. It is returned only to authenticated Project readers.
string <uuid>Selected Workspace Project-state identifier. It remains present when the optional capability is disabled, but cannot be changed until re-enabled.
Optional decorative marker. A null value uses the client fallback without persisting it.
stringPrivate Projects require explicit Project membership except for governed Workspace owner/admin access. Public affects only the sanitized anonymous projection; authenticated access remains policy-checked.
workspaceprivatepublicstring <uuid>Opaque unlisted identifier present only while the Project is public.
booleanProject-owned Board preference. False omits cancelled-type columns from the ordinary Board.
integer·min 0Present on Workspace Project list reads. Exact count of all Tasks excluding archived, trashed and purged Tasks; independent of Task pagination. Includes completed and cancelled Tasks. Mutation and detail responses may omit this aggregate.
string <date-time>Latest updated_at among the Tasks included in task_count. Omitted when no active Tasks exist or the aggregate was not read.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Current Actor that owns the Project and serves as its lead. The owner and Workspace administrators may publish or unpublish it; governed owner transfer is separately revision-checked.
stringUppercase-normalized ticket prefix used to form human-readable Task
references (for example ASSIGN-42). Unique per Workspace and
immutable after creation; not a substitute for the opaque id.
string·min 1·max 63Editable, Workspace-unique URL segment generated from the Project name at creation.
string·max 500Optional plain-text Project summary. It is returned only to authenticated Project readers.
string <uri>·max 2048Optional absolute HTTP or HTTPS Project link. It is returned only to authenticated Project readers.
string <uuid>Selected Workspace Project-state identifier. It remains present when the optional capability is disabled, but cannot be changed until re-enabled.
Optional decorative marker. A null value uses the client fallback without persisting it.
stringPrivate Projects require explicit Project membership except for governed Workspace owner/admin access. Public affects only the sanitized anonymous projection; authenticated access remains policy-checked.
workspaceprivatepublicstring <uuid>Opaque unlisted identifier present only while the Project is public.
booleanProject-owned Board preference. False omits cancelled-type columns from the ordinary Board.
integer·min 0Present on Workspace Project list reads. Exact count of all Tasks excluding archived, trashed and purged Tasks; independent of Task pagination. Includes completed and cancelled Tasks. Mutation and detail responses may omit this aggregate.
string <date-time>Latest updated_at among the Tasks included in task_count. Omitted when no active Tasks exist or the aggregate was not read.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Update Project metadata, planning dates, path, visual identity, or visibility
/api/v1/projects/{project_id}Applies an optimistic compare-and-swap to exactly one of name, path,
description, url, visual_identity, visibility, or owner_actor_id, or sends the complete nullable start_on/target_on date pair. If-Match must carry the revision last observed by
the client. Send visual_identity: null to restore the default marker.
Setting visibility to public requires the Workspace's public-publishing billing
entitlement; denial returns 403 paid_workspace_required. Unpublishing remains
available subject to normal authorization. Public reads return the existing privacy-safe
404 while that entitlement is absent, without changing stored visibility or content.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Request Body
application/jsonbooleanProject managers may persist whether cancelled-type Board columns are shown.
string <date>Must be sent with start_on; when both values are present, it cannot precede start_on.
A single allowlisted Lucide icon name or fully-qualified Unicode Emoji 17.0 sequence.
stringPublishing is permitted only for the Project owner or a Workspace administrator.
workspaceprivatepublicstring <uuid>Transfers the owner/lead to an active Workspace member. Only the current owner or a Workspace administrator may use it.
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Current Actor that owns the Project and serves as its lead. The owner and Workspace administrators may publish or unpublish it; governed owner transfer is separately revision-checked.
stringUppercase-normalized ticket prefix used to form human-readable Task
references (for example ASSIGN-42). Unique per Workspace and
immutable after creation; not a substitute for the opaque id.
string·min 1·max 63Editable, Workspace-unique URL segment generated from the Project name at creation.
string·max 500Optional plain-text Project summary. It is returned only to authenticated Project readers.
string <uri>·max 2048Optional absolute HTTP or HTTPS Project link. It is returned only to authenticated Project readers.
string <uuid>Selected Workspace Project-state identifier. It remains present when the optional capability is disabled, but cannot be changed until re-enabled.
Optional decorative marker. A null value uses the client fallback without persisting it.
stringPrivate Projects require explicit Project membership except for governed Workspace owner/admin access. Public affects only the sanitized anonymous projection; authenticated access remains policy-checked.
workspaceprivatepublicstring <uuid>Opaque unlisted identifier present only while the Project is public.
booleanProject-owned Board preference. False omits cancelled-type columns from the ordinary Board.
integer·min 0Present on Workspace Project list reads. Exact count of all Tasks excluding archived, trashed and purged Tasks; independent of Task pagination. Includes completed and cancelled Tasks. Mutation and detail responses may omit this aggregate.
string <date-time>Latest updated_at among the Tasks included in task_count. Omitted when no active Tasks exist or the aggregate was not read.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Archive a Project
/api/v1/projects/{project_id}Archives a Project with optimistic concurrency. The current Project
revision must be supplied in If-Match; retries with the same
idempotency key replay the original response.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Read the bounded Project overview projection
/api/v1/projects/{project_id}/overviewReturns one permission-filtered Project overview. Active Task counts,
Status distribution, ongoing work, recent resources, milestone progress,
member summaries, and freshness metadata are server-computed. Ongoing
work is selected only through the immutable in_progress and
in_review Status categories; clients must not infer it from labels or
rebuild this response by fanning out over collection endpoints.
Path Parameters
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
object[]·max 2Current Tasks grouped only by authoritative workflow category; each group contains at most five Tasks.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Move a Project in the Workspace's shared manual order
/api/v1/projects/{project_id}/movePlaces the Project between its optional neighbour anchors. Clients never
send or receive a mutable position or rank. expected_revision is the
Project revision being moved; a stale revision returns 409 revision_conflict. A missing, archived, or out-of-Workspace anchor
returns 409 anchor_not_found.
Path Parameters
Header Parameters
Request Body
application/jsonResponses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Current Actor that owns the Project and serves as its lead. The owner and Workspace administrators may publish or unpublish it; governed owner transfer is separately revision-checked.
stringUppercase-normalized ticket prefix used to form human-readable Task
references (for example ASSIGN-42). Unique per Workspace and
immutable after creation; not a substitute for the opaque id.
string·min 1·max 63Editable, Workspace-unique URL segment generated from the Project name at creation.
string·max 500Optional plain-text Project summary. It is returned only to authenticated Project readers.
string <uri>·max 2048Optional absolute HTTP or HTTPS Project link. It is returned only to authenticated Project readers.
string <uuid>Selected Workspace Project-state identifier. It remains present when the optional capability is disabled, but cannot be changed until re-enabled.
Optional decorative marker. A null value uses the client fallback without persisting it.
stringPrivate Projects require explicit Project membership except for governed Workspace owner/admin access. Public affects only the sanitized anonymous projection; authenticated access remains policy-checked.
workspaceprivatepublicstring <uuid>Opaque unlisted identifier present only while the Project is public.
booleanProject-owned Board preference. False omits cancelled-type columns from the ordinary Board.
integer·min 0Present on Workspace Project list reads. Exact count of all Tasks excluding archived, trashed and purged Tasks; independent of Task pagination. Includes completed and cancelled Tasks. Mutation and detail responses may omit this aggregate.
string <date-time>Latest updated_at among the Tasks included in task_count. Omitted when no active Tasks exist or the aggregate was not read.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Responses
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Required when requires_review is true; must be a Project-applicable in_review Status.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Configure whether completion requires review
/api/v1/projects/{project_id}/completion-policyAn authorized Project manager may enable review-before-completion only while naming a Project-applicable default review Status and default done Status. Disabling it retains the configured defaults but makes completion direct. The backend validates Status categories and all authorization; clients cannot bypass the policy through Task patch.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Request Body
application/jsonstring <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Required when requires_review is true; must be a Project-applicable in_review Status.
Responses
stringQuoted decimal optimistic-concurrency version.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Required when requires_review is true; must be a Project-applicable in_review Status.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List Project Statuses
/api/v1/projects/{project_id}/statusesReturns one workflow-ordered page combining the Project's own Statuses and the Workspace-wide Statuses applicable to it.
Path Parameters
Query Parameters
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Create a Project workflow Status
/api/v1/projects/{project_id}/statusesAppends a Status to the Project-scoped workflow. The caller must have Project management access.
Path Parameters
Header Parameters
Request Body
application/jsonstringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledResponses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Null for a Workspace-wide Status applicable to every Project.
stringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledstringOptional shared Tailwind family or pinned shade, retaining legacy six-digit hex colors. A bare family uses step 500 for Status markers; null inherits the lifecycle default.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List the Project's explicit members
/api/v1/projects/{project_id}/membersReturns an owner-first, stable, cursor-bounded projection of active Project membership. It never substitutes the Workspace roster and is unavailable from public Project views.
Path Parameters
Header Parameters
Request Body
Responses
stringQuoted decimal optimistic-concurrency version.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Request Body
Responses
stringQuoted decimal optimistic-concurrency version.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
Remove a Project member
/api/v1/projects/{project_id}/members/{actor_id}The current owner cannot be removed. Owner transfer must complete first.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
string·min 16·max 200Opaque client-generated key for safely retrying this operation.
Responses
Read a workflow Status
/api/v1/statuses/{status_id}Returns one Status, including an archived Status needed to render historical Tasks.
Path Parameters
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Null for a Workspace-wide Status applicable to every Project.
stringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledstringOptional shared Tailwind family or pinned shade, retaining legacy six-digit hex colors. A bare family uses step 500 for Status markers; null inherits the lifecycle default.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Update or restore a workflow Status
/api/v1/statuses/{status_id}Updates supplied fields. Set archived: false to restore an archived Status.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Request Body
application/jsonstringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledResponses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Null for a Workspace-wide Status applicable to every Project.
stringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledstringOptional shared Tailwind family or pinned shade, retaining legacy six-digit hex colors. A bare family uses step 500 for Status markers; null inherits the lifecycle default.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Archive a workflow Status
/api/v1/statuses/{status_id}Archives a Status without repointing Tasks. It returns 409 status_in_use
with the live Task count when live Tasks still reference it, and
409 required_status when it is the last active todo, in_progress,
or done Status in its own scope.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Move a Status in its workflow order
/api/v1/statuses/{status_id}/moveMoves a Status between optional neighbour anchors within its own
Workspace-wide or Project-scoped workflow. Cross-scope or stale anchors
return 409 anchor_not_found; the server owns integer positions.
Path Parameters
Header Parameters
Request Body
application/jsonstring <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Null for a Workspace-wide Status applicable to every Project.
stringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledstringOptional shared Tailwind family or pinned shade, retaining legacy six-digit hex colors. A bare family uses step 500 for Status markers; null inherits the lifecycle default.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Preview a Status lifecycle migration
/api/v1/statuses/{status_id}/lifecycle-previewReturns the authoritative number of Tasks whose Active/Resolved lifecycle fields would change. Synchronous migration is refused when the count exceeds the returned limit.
Path Parameters
Query Parameters
Responses
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
stringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledstringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledArchive a workflow Status and replace its live Tasks
/api/v1/statuses/{status_id}/archive-and-replaceAtomically moves every non-archived Task that references this Status to
an active replacement Status in the exact same Workspace-wide or
Project-scoped workflow, then archives the source. The source revision
is checked through If-Match; an archived, cross-scope, missing, or
self-replacement returns 409 replacement_status_unavailable.
The operation is refused with 409 required_status when archiving the
source would remove the final active todo, in_progress, or done
Status in its scope. Historical archived Tasks keep their source
Status unchanged.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Request Body
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Null for a Workspace-wide Status applicable to every Project.
stringCanonical lifecycle meaning. Custom labels remain presentation; completed and cancelled are terminal.
backlogunstartedstartedcompletedcancelledstringOptional shared Tailwind family or pinned shade, retaining legacy six-digit hex colors. A bare family uses step 500 for Status markers; null inherits the lifecycle default.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List Project milestones
/api/v1/projects/{project_id}/milestonesEvery returned milestone includes canonical progress for its non-archived, non-trashed Tasks, aggregated independently of loaded Task pages.
Path Parameters
Query Parameters
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Header Parameters
Request Body
application/jsonstring | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string | null·max 19Stable Project-local positive signed-64-bit number as canonical decimal text (maximum 9223372036854775807), independent of Task numbering and rank. Null or absent while a historical Milestone awaits reference backfill; never derive it client-side.
string | null·max 29Canonical uppercase Project-key Milestone reference, for example FRS-M1. Stable across rename, reorder and archive/restore. Null or absent with milestone_number during historical backfill. UUID selectors and foreign keys remain authoritative; knowing a code grants no access.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Resolve a Milestone code within an authorized Project
/api/v1/projects/{project_id}/milestones/by-code/{milestone_code}Resolves only Milestones in the selected Workspace and Project, including archived Milestones. ASCII input casing is normalized; canonical output is uppercase. Codes do not grant access or fall through to Tasks or Documents. Invalid syntax or signed-64-bit overflow is rejected. Existing UUID operations remain valid.
Path Parameters
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string | null·max 19Stable Project-local positive signed-64-bit number as canonical decimal text (maximum 9223372036854775807), independent of Task numbering and rank. Null or absent while a historical Milestone awaits reference backfill; never derive it client-side.
string | null·max 29Canonical uppercase Project-key Milestone reference, for example FRS-M1. Stable across rename, reorder and archive/restore. Null or absent with milestone_number during historical backfill. UUID selectors and foreign keys remain authoritative; knowing a code grants no access.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string | null·max 19Stable Project-local positive signed-64-bit number as canonical decimal text (maximum 9223372036854775807), independent of Task numbering and rank. Null or absent while a historical Milestone awaits reference backfill; never derive it client-side.
string | null·max 29Canonical uppercase Project-key Milestone reference, for example FRS-M1. Stable across rename, reorder and archive/restore. Null or absent with milestone_number during historical backfill. UUID selectors and foreign keys remain authoritative; knowing a code grants no access.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Request Body
application/jsonstring | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string | null·max 19Stable Project-local positive signed-64-bit number as canonical decimal text (maximum 9223372036854775807), independent of Task numbering and rank. Null or absent while a historical Milestone awaits reference backfill; never derive it client-side.
string | null·max 29Canonical uppercase Project-key Milestone reference, for example FRS-M1. Stable across rename, reorder and archive/restore. Null or absent with milestone_number during historical backfill. UUID selectors and foreign keys remain authoritative; knowing a code grants no access.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Header Parameters
string·min 43·max 43Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Responses
stringQuoted decimal optimistic-concurrency version.
objectMaterialized lifecycle policy of the entity's current status. Compare
stage_revision and definition_revision for staleness; behaviors
is the complete set for the entity kind, so clients never infer policy
from names or categories. Absent when the selection has no lifecycle
status. Resolved for a whole page with one batch lookup. Project list
rows carry identities and revisions only: stage_name and behaviors
are omitted there and returned by Project detail and the lifecycle
definition list.
string | null·min 1·max 64Optional stable Workspace Milestone stage ID. Must select an active stage whose category agrees with status; null clears the selection. An explicit legacy status update without stage_id clears a custom selection.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string | null·max 19Stable Project-local positive signed-64-bit number as canonical decimal text (maximum 9223372036854775807), independent of Task numbering and rank. Null or absent while a historical Milestone awaits reference backfill; never derive it client-side.
string | null·max 29Canonical uppercase Project-key Milestone reference, for example FRS-M1. Stable across rename, reorder and archive/restore. Null or absent with milestone_number during historical backfill. UUID selectors and foreign keys remain authoritative; knowing a code grants no access.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List Project attachments
/api/v1/projects/{project_id}/attachmentsReturns the newest 100 linked files. Optional attachment_id values select up to 100 exact linked targets regardless of age; deleted, unlinked and private Discuss files are omitted after parent authorization.
Path Parameters
Query Parameters
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Path Parameters
Header Parameters
Request Body
Responses
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string·min 1·max 255Display filename, at most 255 UTF-8 bytes after NFC normalization.
It must not contain a path separator, null, or control character,
must not be . or .., and must not begin or end with whitespace or
a dot. A violating filename is rejected rather than rewritten.
Filenames never contribute to the server-generated object key.
string·max 255Server-detected from the object's leading bytes, not client-declared.
stringMalware-scan state. New uploads are scanned synchronously before
they become usable: only clean attachments may be linked, previewed,
or downloaded. quarantined attachments remain private and unavailable.
not_scanned is retained only for legacy migration visibility.
not_scannedpendingcleanquarantinedstring <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
List attachments of the Project's Tasks
/api/v1/projects/{project_id}/task-attachmentsNewest-first files attached to the Project's current Tasks. A Task moved to another Project takes its files with it.
Path Parameters
Responses
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
Read a published Project status
/api/v1/public/projects/{public_id}Public access requires the owning Workspace's public-publishing billing entitlement; absence returns the same privacy-safe 404 as an unavailable identifier. Returns a deliberately minimal read-only Project status: its name, optional visual marker, and ordered workflow Status labels with aggregate Task counts. The opaque identifier is revoked on unpublish or archive. Workspace identity, owner identity, Task content, members, Documents, attachments, labels, revisions, and audit data are omitted.
Path Parameters
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
integer·min 0Exact count of all non-archived, non-trashed, non-purged Tasks, including completed and cancelled Tasks. Independent of the bounded Status distribution.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
A single allowlisted Lucide icon name or fully-qualified Unicode Emoji 17.0 sequence.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.