Developer API
REST API Documentation
Build integrations with the Gravitask REST API. Manage projects, tasks, comments, time entries, and webhooks programmatically.
Try it in the interactive API explorerAuthentication
Three authentication methods are supported depending on your use case.
API Key
Generate an API key in Settings > API & MCP in the Gravitask app. Pass it as a Bearer token in the Authorization header.
curl -H "Authorization: Bearer gt_live_YOUR_KEY" \
https://app.gravitask.net/api/v1/projectsOAuth 2.0
For third-party applications, use the OAuth 2.0 authorization code flow with PKCE. This is the recommended method for apps that act on behalf of a user.
See the MCP setup guide for full OAuth configuration details.
Session Cookie
Used automatically by the Gravitask web application. No additional configuration required.
Quick Start
Get up and running in three steps.
Generate an API key
Go to Settings > API & MCP and create a new API key.
List your projects
GET /api/v1/projects
curl -H "Authorization: Bearer gt_live_YOUR_KEY" \
https://app.gravitask.net/api/v1/projectsCreate a task
POST /api/v1/tasks
curl -X POST https://app.gravitask.net/api/v1/tasks \
-H "Authorization: Bearer gt_live_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{
"project_id": "PROJECT_ID",
"title": "My new task",
"description": "Created via the API"
}'Endpoints Reference
All endpoints are relative to https://app.gravitask.net.
Projects
| Method | Path |
|---|---|
| GET | /api/v1/projectsList projects |
| GET | /api/v1/projects/:idGet project |
Tasks
| Method | Path |
|---|---|
| GET | /api/v1/projects/:id/tasksList tasks |
| GET | /api/v1/tasks/:idGet task (supports short IDs like GRV-42) |
| POST | /api/v1/tasksCreate task |
| PATCH | /api/v1/tasks/:idUpdate task |
| DELETE | /api/v1/tasks/:idDelete task |
| POST | /api/v1/tasks/:id/completeComplete task |
Comments
| Method | Path |
|---|---|
| GET | /api/v1/tasks/:id/commentsList comments |
| POST | /api/v1/tasks/:id/commentsAdd comment |
| DELETE | /api/v1/comments/:idDelete comment |
Time Entries
| Method | Path |
|---|---|
| GET | /api/v1/tasks/:id/time-entriesList time entries |
| POST | /api/v1/tasks/:id/time-entriesLog time |
| PATCH | /api/v1/time-entries/:idUpdate entry |
| DELETE | /api/v1/time-entries/:idDelete entry |
Tags
| Method | Path |
|---|---|
| GET | /api/v1/projects/:id/tagsList tags |
| POST | /api/v1/projects/:id/tagsCreate tag |
| DELETE | /api/v1/tags/:idDelete tag |
Members
| Method | Path |
|---|---|
| GET | /api/v1/workspace/membersList members |
Webhooks
| Method | Path |
|---|---|
| GET | /api/v1/webhooksList webhooks |
| POST | /api/v1/webhooksCreate webhook |
| PATCH | /api/v1/webhooks/:idUpdate webhook |
| DELETE | /api/v1/webhooks/:idDelete webhook |
Webhooks
Receive real-time notifications when events happen in your workspace.
Available Events
Signature Verification
Verify webhook payloads by comparing the X-Gravitask-Signature header against an HMAC-SHA256 digest of the request body using your webhook secret.
const crypto = require('crypto');
function verify(payload, signature, secret) {
const expected = 'sha256=' + crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
);
}Rate Limiting
API requests are rate-limited per workspace.
| Plan | Limit |
|---|---|
| Free | 500 requests / minute |
| Paid | 5,000 requests / minute |
Rate Limit Headers
X-RateLimit-LimitMaximum requests allowed per windowX-RateLimit-RemainingRequests remaining in the current windowX-RateLimit-ResetUnix timestamp when the window resetsWhen you exceed the limit you will receive a 429 Too Many Requests response. Use the Retry-After header to determine how long to wait before retrying.
Pagination
List endpoints use cursor-based pagination. Pass limit and cursor query parameters to page through results.
GET /api/v1/projects?limit=50&cursor=eyJpZCI6IjEyMyJ9Responses include pagination metadata:
{
"data": [ ... ],
"next_cursor": "eyJpZCI6IjEyMyJ9",
"has_more": true
}Continue fetching pages while has_more is true, passing the next_cursor value as the cursor parameter.
Start Building
Explore the full API interactively, connect via MCP, or generate your API key to get started.