Projoodle API (1.0.0)

1. In Projoodle, open Account settings → API & AI Access and create a token. Pick the smallest scope that does the job and set an expiry date.
2. Copy the token while it is shown. Projoodle stores only a hash of it and cannot display it a second time.
3. Send it as a bearer token:

curl -H "Authorization: Bearer pj_..." \
  https://app.projoodle.com/api/v1/projects

Every response is JSON. Requests carry no cookies and never receive a session cookie, so the token alone decides what a call may do.

A token is bound to one membership in one project. It cannot see or change another project, even when your account belongs to several. Create a separate token per project you want to reach.

A scope never widens your own permissions. A read token cannot write even when your role would allow it, and a readwrite token cannot write where an archived project, a frozen column or your role would stop you in the browser either. Revoking a token takes effect on the very next request.

There is a second way in, and it is the one to use for ChatGPT or another MCP client: Projoodle speaks the Model Context Protocol at https://app.projoodle.com/mcp, with OAuth 2.1 (authorization code, PKCE S256) instead of a token you copy by hand.

The difference is worth knowing before you pick one:

• A service token reaches one project and works on both this REST API and the MCP endpoint. Good for a script or a local tool.
• An OAuth connection is bound to your account, so it reaches every project you are a member of, and the set of projects follows your memberships as they change. It works at /mcp only - an OAuth access token is deliberately rejected on this REST surface.

OAuth uses finer-grained scopes than the two above:

They are discoverable at https://app.projoodle.com/.well-known/oauth-authorization-server, so a client that speaks the protocol finds them without being told.

The same sentence applies here as above: a scope never widens your own permissions. Your role, your project membership and any plan freeze decide what happens, exactly as they do in the browser.

Some features belong to Projoodle PRO, on this API exactly as in the browser: text search (q on the task lists) and repeating tasks. A call that needs one of them without PRO on the project or account returns 403 with the code plan_feature_required. Ending an existing series with frequency none always works, so a lapsed plan never traps a task in a loop.

Unexpected failures return a generic error together with a correlation ID, both in the body and in the X-Correlation-ID header. Quote that ID when reporting a problem: it identifies the server-side log entry, which never contains your token.

List endpoints are paginated - pass limit and offset. Projoodle's task model currently has no priority and no parent/subtask relation, so those fields are deliberately absent rather than stored outside the shared application model.

Treat a token like a password: it acts with your permissions inside its project. Keep it out of chats, tickets, commits, screenshots and shell history, prefer a short expiry, and revoke what you no longer use.

Tokens are stored only as SHA-256 hashes and stay bound to the membership they were created for. Account-bound OAuth access tokens exist for the MCP endpoint only and are not accepted on this REST surface.