Public REST API with OAuth sign-in and signed outbound webhooks

AgileHero now has a public REST API and signed outbound webhooks. Both are on every plan, with no per-action metering.

Scripts and apps sign in to the API with OAuth, so there's never a key to create, paste, or leak. The caller gets exactly the permissions of the person who authorized it.

The API covers the full card lifecycle: create, update, move, labels, assignees, relations, checklists, and comments. The API's list of a project's cards can be read page by page and filtered by last update. Workspaces, projects, members, and epics are read-only, and comments can't be edited.

The API is version 0. It's still in development, and endpoints can change. Since 5 October, each connected app can make 150 requests a minute on Free workspaces and 600 on trial and Pro, with no daily quota.

Scripts and apps you've authorized are listed on the new API access page in Settings, where you can revoke them. The full reference is in the API docs.

Workspace owners and admins can register HTTPS endpoints that receive the workspace's events, signed so the receiver can verify them. There are 28 events across cards, comments, epics, lists, labels, checklists, and membership, and each delivery carries the whole resource, not only the change.

A failed delivery is retried 7 times over about 28 hours. After 3 deliveries in a row fail for good, the endpoint switches itself off, and owners and admins get an email.

Each endpoint has a test event, secret rotation, and a delivery log kept for 30 days, with one-click redeliver. The signing secret is shown only once, when you create the endpoint or rotate the secret.

Free workspaces get 2 endpoints, and trial and Pro get 20. Disabled endpoints count toward the limit. Webhooks have their own tab in the workspace's Integrations settings.