Authentication
Create a key in Settings, then API. Send it as a bearer token. Keys are scoped to a workspace and can be limited to read-only, which is what you want for dashboards and reporting jobs.
Core resources
Boards, posts, votes, comments, statuses, users and changelog entries are all available. Listing endpoints are cursor-paginated and accept the same filters as the UI, including category, status and segment.
Webhooks
Subscribe to post.created, post.status_changed, post.merged, vote.created, comment.created and changelog.published. Payloads are signed with an HMAC header; verify the signature before acting on a request.
Deliveries retry with exponential backoff for 24 hours, and the delivery log shows the exact request and response for each attempt.
Rate limits
The default is 600 requests per minute per workspace. Bulk imports should use the import endpoint rather than looping over post creation.