Projoodle API (1.0.0)

1. In Projoodle, open Account settings → API & AI Access and create a token. Pick the smallest scope that does the job and set an expiry date.
2. Copy the token while it is shown. Projoodle stores only a hash of it and cannot display it a second time.
3. Send it as a bearer token:

curl -H "Authorization: Bearer pj_..." \
  https://app.projoodle.com/api/v1/projects

Every response is JSON. Requests carry no cookies and never receive a session cookie, so the token alone decides what a call may do.

A token is bound to one membership in one project. It cannot see or change another project, even when your account belongs to several. Create a separate token per project you want to reach.

A scope never widens your own permissions. A read token cannot write even when your role would allow it, and a readwrite token cannot write where an archived project, a frozen column or your role would stop you in the browser either. Revoking a token takes effect on the very next request.

Unexpected failures return a generic error together with a correlation ID, both in the body and in the X-Correlation-ID header. Quote that ID when reporting a problem: it identifies the server-side log entry, which never contains your token.

List endpoints are paginated - pass limit and offset. Projoodle's task model currently has no priority and no parent/subtask relation, so those fields are deliberately absent rather than stored outside the shared application model.

Treat a token like a password: it acts with your permissions inside its project. Keep it out of chats, tickets, commits, screenshots and shell history, prefer a short expiry, and revoke what you no longer use.

Tokens are stored only as SHA-256 hashes and stay bound to the membership they were created for. Account-bound OAuth access tokens exist for the MCP endpoint only and are not accepted on this REST surface.