API

Public, no account needed, and rate limited per address. Filed in the ChewedFeed HQ enquiry inbox.

Use a project's ID when creating a ticket directly in its backlog.

key_prefix (optional) renames every ticket key in the project (TL-123 → TRK-123); only organization admins can change it. Use 2–6 capital letters or digits starting with a letter; 409 if another project in the org uses it.

This action cannot be undone and permanently deletes all work under the project. Organization admin session required.

Server-sent events, like the board stream: the latest retained event on connect, then updates, with a heartbeat every 20 seconds. Events are refinement-session (the whole session) and refinement-session-ended.

The host can hand over to anyone in the session. Anyone in the session can make themselves host once the host hasn't been seen for a minute.

Call every 30 seconds while taking part; anyone not seen for a minute drops off the list. A host gone for two minutes ends the session.

url is the space's incoming webhook (https://chat.googleapis.com/v1/spaces/…); leave it out to change only the kinds. Defaults: created, review, approval, over_capacity, finished, wont_do. A project's space gets its events; the org's gets every project's.

The token is sealed (AES-GCM) with the server's TRACKLINES_SECRET_KEY before it's stored; 503 when the server has no key.

For GitHub, ?installation=<id> disconnects just that account; without it, every GitHub account is disconnected.

The link carries a sealed state tied to the org (15 minutes). 503 when the provider isn't configured on the server.

Uses the caller's verified Clerk email addresses and does not require an active organization.

Organizations and their members live in Clerk; TrackLin.es only records which members are admins. The first time an org's admins are needed, one is chosen from Clerk and stored: the user who created the organization if they are still a member, otherwise the longest-standing member with the Clerk org:admin role, otherwise the longest-standing member. granted_by records which rule applied (clerk:creator, clerk:admin-role, clerk:earliest-member) or the admin who granted it. If Clerk can't be reached nothing is stored and the next request tries again (502); an organization with no members gets no admin (409).

Org admins only, signed in with a Clerk session (API keys are refused). The user must be a Clerk member of the organization.

Org admins only, signed in with a Clerk session. The last admin can't be removed.

Org admins only. Pending, accepted, and revoked TrackLin.es invitations are returned newest first; expired pending invitations are reported as expired.

Org admins only. Clerk sends an organization invitation with the org:member role. For team or project scope, the recipient must accept through Clerk and then call the accept operation below with a signed-in session using the invited, verified email address. Team invites create ordinary team membership; project invites create project membership. Organization members retain read access to all organization projects.

The invitee must first accept the Clerk invitation. This endpoint then verifies the Clerk invitation, active organization membership, and a verified matching email. Team and project invitations create the corresponding local membership; team invitations never assign team leader authority. API keys are refused.

Returns role-free member details for the caller's active organization. Results are paginated.

TrackLin.es creates this webhook itself when an org admin links a Bitbucket repo (POST /projects/{id}/repos), with its own random secret (sealed, never shown) and this URL naming the link; unlinking removes it. Deliveries are verified with that link's secret (X-Hub-Signature) and only affect that link's org and repo: pullrequest:* events (X-Event-Key) link PRs to the tickets they mention; MERGED closes them, once.

Authenticates the raw payload with the Svix headers and CLERK_WEBHOOK_SECRET (timestamps more than 5 minutes off are rejected). organizationMembership.created completes the new member's pending TrackLin.es invitations to that org (team and project access included) for their verified emails (TL-518); organizationMembership.deleted removes the user's admin and team rows in that org and revokes their API keys for it; user.deleted does the same across every org; organization.deleted removes the org's admins and teams and revokes its API keys (projects, boards and tickets are kept). Other event types are acknowledged and ignored. Safe to replay.

pull_request events link PRs to the tickets whose keys they (or their commits) mention (in repos linked to a project of an org connected through that installation); merging closes them, once. An uninstalled app disconnects the org. A 5xx makes GitHub redeliver.

Org admins only, signed in with a Clerk session. The team's leaders' authority is scoped to the boards it runs. The team must belong to the organization and already be linked to the board's project; removing the team from the project unlinks it from that project's boards. null unlinks.

Org admins only, signed in with a Clerk session. A team can have several leaders; leaders must be on the team, and removing them from the team ends their leadership.

Only members of the active organization and its active AI keys are listed. Service/API keys are excluded.

The ticket joins the board's open sprint. On that sprint's last day it goes to the bottom of the project backlog instead: still 201, with column_id null, redirected_to_backlog: true, and any estimate dropped.

One row per ticket, newest mention first. Mentions are recorded when a comment names someone, and stay when the notification is cleared.

The same list as /mentions, with how many there are in all.

Creates a ticket without requiring a board or column. The ticket is attributed to the API key's agent name and defaults to type task if type is omitted.

By default ready tickets come first, then blocked ones, ordered by backlog position. sort=newest or sort=oldest orders the full filtered backlog by creation date before pagination. The counts field is per type and respects label and priority filters, but not the type filter, for type tabs. Label counts cover the whole backlog. The unpaged list stays at /projects/{projectId}/backlog.

Epics are large pieces of work: they stay in the backlog (never on a board or in a sprint), take no estimate, and can't sit anywhere inside another epic. Work joins one by becoming its sub-ticket. Progress counts the epic's direct sub-tickets (duplicates left out); size sums their estimates as points. Open epics come first, by backlog position.

Every ticket in the project that isn't in its board's Done column, plus the backlog, without descriptions. Ordered the way work is picked: tickets in their board's open sprint first, then priority (urgent first), then on a board before in the backlog, then oldest. The MCP tool list_open_tickets maps to this.

Full-text over titles (weighted highest), descriptions and comments. Every word must match, as a prefix, so it works while typing; punctuation is ignored. A ticket key in q (TL-123, case-insensitive) returns just that ticket. Ranked by relevance, then most recently changed. Without q it lists by recent change, filtered. The MCP tool search_tickets maps to this.

For "Copy link": shortens a link to this site (tickets, boards…) through 1tn. The same link always gives the same short link. Links to any other site are refused.

MCP tools also accept keys wherever they take a ticket_id, parent_id or ticket_ids.

Use board_id to look up the Done column before closing a ticket.

title is required; empty type and priority retain their current values.

Set assignee to an active member of the caller's organization or an active AI key name; set it to null to unassign. Server/service keys cannot be assignees.

Agents cannot move tickets awaiting human review into the backlog.

Use an empty ticket_ids array to clear dependencies. Dependencies must be in the same project and cannot form a cycle. A done ticket can keep or drop its blockers but not gain new ones (409).

The linked crash report's live details, fetched server-side with the org's Bugfixes connection and cached for a minute. regressed is true when the report is open and was seen after the ticket was done. When the org hasn't connected Bugfixes (reason not_connected) or Bugfixes can't be reached (unavailable), available is false but the link is still returned.

AI keys and signed-in people may claim tickets. Server/service keys cannot claim work.

Marks ticketId as a duplicate of another ticket in the same project, closes it, and links it from the original. Optionally copies labels and comments to the original. Duplicate tickets do not count toward sprint velocity or carry-over. MCP tool mark_duplicate accepts ticket keys or ids.

The same object can be sent as external when creating a backlog ticket with an API key. A null body clears it.

When a ticket leaves its board (to the backlog, or another board), its sub-tickets on that board that aren't done, at any depth, go with it. Finished ones stay as the board's history; ones on other boards belong to those teams. Empty for a backlog ticket.

Each stage the ticket entered, or skipped on the way to a later one: the backlog, a board column (named as it was then), and resolved (done, wont_do or duplicate). Created straight on a board, its backlog and any earlier columns are skipped; moving forward skips the columns jumped over. Append-only and recorded with each change. Same access as reading the ticket; resolved tickets keep their history. History starts from when it was introduced (October 2026).

To close a ticket, first get its board, then move it to the column with the greatest position (the board's Done column). position may be zero. Moving a ticket into a sprint (from the backlog, another board or outside the sprint) on the sprint's last day answers 409; moves inside the sprint, to Done, or out of it are allowed.

For a ticket link opened while another organization is active, so the app can offer to switch. Answers only a signed-in person who belongs to the ticket's organization; anyone else (and API keys) gets 404, as if it didn't exist.

The ticket stays in the backlog until the planned sprint starts. Without an estimate it keeps one already on the same scale. planned_sprint_id null takes it out of the plan (and clears the estimate). Going over capacity is allowed; the sprint then needs approval before it can start.

A PR in a repo linked to the ticket's project is linked when its branch, title, description or commit messages mention the ticket's key (TL-123; only the project's own prefix counts). Kept up to date by the provider webhooks. When a linked PR is merged, the ticket moves to its board's Done column (or is resolved in the backlog) with a "Closed by" comment.

AI keys and signed-in people may release ticket assignments. Server/service keys cannot.

Marks a backlog ticket resolved without putting it on a board. A resolved ticket counts as done everywhere (blockers, sub-ticket progress, the done flag), leaves backlog pages and open-ticket lists, keeps its links and stays readable by id. Resolving again is a no-op; moving it onto a board reopens it. If it was the last unfinished sub-ticket of its parent, the parent is completed too (resolved if it's in the backlog, moved to its board's Done column if it's on a board), and so on up the chain. A ticket on a board is moved to the board's Done column with the resolution (moving it out again reopens it), for people and service keys (e.g. Bugfixes when a report is resolved or ignored). AI keys finish board tickets by moving them instead (409), so a board's agent review still applies. MCP tool resolve_ticket. With resolution wont_do it's closed as decided against (the ticket's resolution says so; the reason, if given, is added as a comment). No body resolves it as done. Agents cannot resolve tickets that have entered human review.

People only. The comment, if given, is added to the ticket by the reviewer.

Adds a top-level comment to the ticket conversation. Use this for progress reports or follow-up findings; it does not replace the ticket description.

Org admins only, signed in with a Clerk session. Send a full template, or {name, from_board_id} to copy an existing board's columns, WIP limits, style and estimate scale.

Use the column with the greatest position as the Done column when closing a ticket.

Provide any of name, estimate_scale and style. Changing estimate_scale clears the estimates of tickets on the board, except those in closed sprints (kept for velocity history). Switching to kanban ends the open sprint, if any: it closes with no successor, keeps its done tickets, and its unfinished tickets stay on the board outside any sprint. Kanban boards can't start sprints and show only Done tickets finished in the last 14 days.

Takes it off the project's boards; its history stays. Refused (409) while it has unfinished tickets. Its open sprint closes with no next sprint (finished tickets stay with it for velocity); its planned sprints are dropped and their tickets go back to the backlog unplanned. No tickets can be added to or moved onto an archived board (409).

Returns tickets completed during the requested rolling window of UTC calendar weeks, including empty throughput weeks. Cycle-time percentiles include only tickets with a recorded started_at; older tickets without an exact start time remain in throughput but have a null cycle_days.

Server-sent events fan out across backend instances through Valkey. Connects with the latest retained event, then streams updates; sends a heartbeat comment every 20 seconds. Events are named standup, standup-ended, or refinement.

Starting a standup makes the starter its host; ending it ends the session. Events (standup-session, standup-session-ended) go out on the board's live stream.

The new column goes just before the last column (Done), which stays last. A ticket is done when it's in the board's last column.

The edit board page's save. Columns in order, each an existing column (id) or a new one (no id), with its name and WIP limit. The first (To do) and last (Done) stay first and last, and take no WIP limit. Columns left out are deleted, refused (409) while they hold tickets in the current sprint. All or nothing. Board managers only.

Every column exactly once, with the last column (Done) still last; moving it is a 400, since a ticket is done when it's in the last column.

Files due to be deleted (warned, soonest first) and files the clean-up has deleted (newest first, the latest 500). Org admins only; API keys can't.

Files are warned about a year after they're added (or last kept) and deleted at 13 months unless kept. Org admins and the file's uploader can keep it; API keys can't.

The file must already be uploaded; this endpoint stores its metadata and does not upload bytes.

A closed sprint's completed value is its tickets that were done when it closed (closing carries the rest into the next sprint). Unit is points on a board with an estimate scale (t-shirt sizes count XS=1, S=2, M=3, L=5, XL=8; unestimated tickets count 0), otherwise tickets.

Records the total, who and when. If the planned total later goes above it, the sprint needs approval again.

For a closed sprint, tickets are the ones it finished (closing moves the rest to the next sprint) and burn.total is what it held when it closed; sprints closed before scope was recorded fall back to what they finished and carried_over is null. burn.ends_at is the close time. For an open sprint, everything reflects now.

With no body, the sprint just closes: unfinished tickets stay on the board, out of any sprint, until the next POST /boards/{id}/sprints, which takes them in along with a waiting planned sprint (and its goal). Give next_length_days and/or next_starts_at to open the next sprint at once instead, as auto-close does when a sprint runs out: unfinished tickets carry over, and a planned sprint (refinement) within capacity or approved becomes the next sprint (its length unless next_length_days is given, and its tickets, which join the first column). A planned sprint over capacity without approval isn't promoted and stays planned.

Every hosted standup (on a board) and refinement (on a project) running in the caller's organization, in one request. Archived boards are left out. Empty when live sessions are off.

Org admins and the project's team leaders. Visibility defaults to team; public needs a signed-in org admin (API keys get 403).

Public roadmaps are readable without a token; login_only and team roadmaps require a signed-in member of the owning organization. Non-owner readers see progress counts but not linked-ticket IDs or titles.

Org admins and the project's team leaders. Leaving out visibility keeps it. Changing visibility to or from public needs a signed-in org admin (API keys get 403).

Signed-in org admins only; API keys get 403.

Existing item IDs are updated in place; IDs omitted from the submitted list are removed. Unknown or omitted IDs create items.

Linking an epic counts its sub-tickets towards the item's progress (not the epic itself), worked out on every read, so ones added to the epic later count too.

Uses the roadmap's public, login-only, or team visibility rules. Responses contain only update status, note, and date; linked ticket and organization details are never included.

Appends an immutable update to a roadmap owned by the caller's active organization.

Service keys belong to the organization, so every member sees them and when they expire, whoever made them.

The plaintext key is returned only once. This route requires a Clerk session. Only organization admins can create service keys.

Your own keys; organization admins can also revoke any of the organization's service keys.

The plan belongs to the organization; everyone in it sees it, and its admins buy and manage it.

For an organization that isn't paying yet. One already on a paid plan changes plan instead (POST /subscription/plan).

Moves the existing Stripe subscription to the other plan's price; Stripe prorates the difference. Org admins only.

Authenticates the raw payload with Stripe-Signature. The handler is mounted at this path both under /api and at the API root.

Public; no key needed. The same document as /openapi.yaml.

Public; no key needed. Built into the API, so it always matches what's running.

Says nothing else about the project.

Held for the team to triage; never put on a board. Limits: 5 per sender per hour, 200 per project per day. A filled-in website field (hidden from people) marks a bot: accepted and dropped.

Org admins only, in a signed-in session. API keys get 403, even an admin's.

MCP over Streamable HTTP (stateless; responses are application/json). Send JSON-RPC MCP messages (initialize, tools/list, tools/call). Authenticate like the REST API (tl_ API key or Clerk session). Each tool calls the matching REST route with the caller's credentials, so results, permissions and errors are the same as REST; a failed call is a tool result with isError and the REST status in its text. GET and DELETE return 405 (no sessions or server-initiated streams).

The TrackLin.es Google Chat app sends your own notifications (assigned, mentioned, review…) to your chat with it, once you've linked your account from the link it sends you.

Signed-in sessions only (not API keys). Linking again replaces the earlier link.

Events: assigned (someone assigned you a ticket), mention (@you in a comment), finished (a ticket you raised was finished or resolved), wont_do (a ticket you raised was closed as won't do, with the reason), review (an agent finished a ticket on a board you manage), sent_back (your ticket was sent back from review), approval (a planned sprint on a board you manage went over capacity). Nobody is told about their own actions; only people (not agents) get notifications. MCP tool list_notifications.

The browser's PushSubscription. The endpoint must be https on a known push service (Google, Mozilla, Apple, Microsoft): the server sends to it. The same browser subscribing again takes the row over. The device then gets every notification from the inbox, even with TrackLin.es closed.

Signed by Google for this endpoint (Authorization Bearer ID token); anything else is refused.