tasklite.net: hosted backend, REST API and admin for apps built by AI agents
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Give a person access to an app by their phone number: the phone and a role, nothing else. This is how the people who run an app (the business owner, a manager, staff) get into its admin screen, whose endpoints are in row-level security mode "shared". The person needs no invite code and does not have to sign in first. If the phone already signed in to this organization with a code, access is on at once and the answer has status "active" and their userId. Otherwise the answer has status "pending" and a pendingId: nothing is created for the number yet, and the access opens by itself the first time that phone signs in to the app with an SMS code (POST /auth/otp/send, then /auth/otp/verify). The phone is matched whatever its spelling: 054-1234567, +972 54 123 4567 and 972541234567 are one number; a number outside Israel needs its country code. Calling again for the same phone sets its role again, and switches back on a user who was switched off. Roles: editor (reads and writes), viewer (reads), submitter (creates). The app must still sign people in by phone code; a person who signs in another way (email and password, Google) is a different account, give them access with set_app_user_role after their first sign-in. Requires organization owner or admin (an editor gets 403).
App id or slug (from list_apps / create_app)
The phone number, e.g. "0541234567" or "+972541234567"; any spelling of an Israeli mobile, or any other number with its country code
App-level access role: editor (reads and writes; the default), viewer (reads), submitter (creates)
For a phone that has not signed in yet: days the waiting access stays valid (1-365). Omit and it waits with no time limit, which is the normal choice
Organization id; defaults to the credential organization when omitted
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Give a person access to an app by their phone number: the phone and a role, nothing else. This is how the people who run an app (the business owner, a manager, staff) get into its admin screen, whose endpoints are in row-level security mode "shared". The person needs no invite code and does not have to sign in first. If the phone already signed in to this organization with a code, access is on at once and the answer has status "active" and their userId. Otherwise the answer has status "pending" and a pendingId: nothing is created for the number yet, and the access opens by itself the first time that phone signs in to the app with an SMS code (POST /auth/otp/send, then /auth/otp/verify). The phone is matched whatever its spelling: 054-1234567, +972 54 123 4567 and 972541234567 are one number; a number outside Israel needs its country code. Calling again for the same phone sets its role again, and switches back on a user who was switched off. Roles: editor (reads and writes), viewer (reads), submitter (creates). The app must still sign people in by phone code; a person who signs in another way (email and password, Google) is a different account, give them access with set_app_user_role after their first sign-in. Requires organization owner or admin (an editor gets 403).
| Argument | Type | Description |
|---|---|---|
| role | string | App-level access role: editor (reads and writes; the default), viewer (reads), submitter (creates) |
| appId* | string | App id or slug (from list_apps / create_app) |
| phone* | string | The phone number, e.g. "0541234567" or "+972541234567"; any spelling of an Israeli mobile, or any other number with its country code |
| expiresInDays | integer | For a phone that has not signed in yet: days the waiting access stays valid (1-365). Omit and it waits with no time limit, which is the normal choice |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"phone"
],
"properties": {
"role": {
"enum": [
"viewer",
"editor",
"submitter"
],
"type": "string",
"description": "App-level access role: editor (reads and writes; the default), viewer (reads), submitter (creates)"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"phone": {
"type": "string",
"description": "The phone number, e.g. \"0541234567\" or \"+972541234567\"; any spelling of an Israeli mobile, or any other number with its country code"
},
"expiresInDays": {
"type": "integer",
"maximum": 365,
"minimum": 1,
"description": "For a phone that has not signed in yet: days the waiting access stays valid (1-365). Omit and it waits with no time limit, which is the normal choice"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Post a comment on an item's thread. To notify people, pass their user ids in mentionedUserIds (each also appears as an @mention). attachmentIds references already-uploaded files. Needs projectId and itemId.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item (row) id |
| content* | string | The comment text |
| projectId* | string | Project id (from list_projects / create_project) |
| attachmentIds | array | Ids of already-uploaded attachments to link |
| mentionedUserIds | array | User ids to @mention and notify |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"itemId",
"content"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"content": {
"type": "string",
"description": "The comment text"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"attachmentIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "Ids of already-uploaded attachments to link"
},
"mentionedUserIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "User ids to @mention and notify"
}
},
"additionalProperties": false
}Build a whole backend in one call from a spec you compose: the project, its boards, their typed columns (including relations between the boards), optional sample rows, and optionally a published REST API with one endpoint per board and a server-side key. Use it whenever the user describes a system ("a backend for my repair shop: customers, orders, payments") instead of calling create_project, create_board, create_column, create_app, publish_app, create_app_endpoint and create_app_api_key one by one. You do the design, pick column types by meaning (phone, date, currency, dropdown/status with options for closed choices), link boards with a relation column (type "relation", relatedBoard: "<board name in this spec>", relationType: many_to_one for an order→customer link), and this tool executes it and returns one compact summary. API field names are derived from column names and never collide with reserved item fields, so there is nothing to retry. Boards are created as plain data tables (kind "data": only the columns you define, no task fields); set kind "tasks" on a board where people track work to do and want status, priority, assignee and due date built in. Every row still has a title. When the API has its own users, api.rowLevelSecurity: true gives every endpoint mode "owner"; a board may carry its own rowLevelSecurity instead (mode shared, phone or relation, with columns named as in this spec), e.g. Coaches { mode: "phone", phoneColumn: "Phone" } and Trainees { mode: "relation", relationColumn: "Coach", identityPhoneColumn: "Phone", allowInvites: true }.
| Argument | Type | Description |
|---|---|---|
| api | object | Include to publish a REST API over every board and mint a key; omit for a boards-only build |
| boards* | array | The boards (tables) of the backend, in any order |
| project* | object | The project that holds the boards |
Check whether an invite code works right now, the way an app does before sign-up (POST /auth/invites/check, the same public route, limited to 10 calls a minute per address). A working code answers { valid: true, organizationId, app: { name, slug }, label, expiresAt }; anything else (unknown, revoked, expired, used up, its row deleted, its app switched off or deleted) answers only { valid: false }, with no reason, by design. It does not use the code up. For the reason a code stopped working, read its status in list_app_invites.
| Argument | Type | Description |
|---|---|---|
| code* | string | The invite code, e.g. "K7PM-4XQ2"; case and the dash do not matter |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"code"
],
"properties": {
"code": {
"type": "string",
"description": "The invite code, e.g. \"K7PM-4XQ2\"; case and the dash do not matter"
}
},
"additionalProperties": false
}Read or change the settings object of an app. Call with only appId to read. To change, pass set: the keys in it are MERGED into the current settings (objects merge key by key at every depth, arrays and plain values replace, null removes a key). The server itself does not merge: PATCH replaces the whole settings object with what it is sent, so this tool reads the app, merges, and writes the full object back; two writers at the same moment can still overwrite each other, so do not run it in parallel on one app. Settings the server reads: passwordReset.returnUrls (array of up to 50 URLs the "reset password" email may send a user back to, matched by scheme, host, port and path prefix; needed only for a custom app scheme such as myapp://reset or a domain other than the app's own {slug}.tasklite.dev and its connected custom domains, which are always allowed; http is never accepted), language (the language of the password reset email: a value starting with "he" gives Hebrew, any other value English; left out, the user's own language decides), endUserDeletion.rows ("delete": when an end user deletes their account, the rows they wrote in this app are deleted with it and erased for good 30 days later; left out, the rows stay with the author shown as a deleted account). Other keys are stored as given and returned, and the server does not act on them.
| Argument | Type | Description |
|---|---|---|
| set | object | Keys to merge into the settings, e.g. { passwordReset: { returnUrls: ["myapp://reset"] } } or { endUserDeletion: { rows: "delete" } }. null removes a key: { language: null }. Omit to read without changing anything |
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
Read or change how EXTERNAL users (people who sign up to your app through TaskLite auth) get into an organization. This policy governs sign-up by email and password and by Google. Sign-in by a phone code (POST /auth/otp/send, then /auth/otp/verify) obeys only "invite": under "closed", "approval" and "open" any phone that verifies a code becomes an external member of the organization, who reaches nothing until an endpoint's row-level security or the app's access list (add_app_user) gives them something; under "invite" a new phone needs an invite code or an add_app_user grant. The two ways in that obey the whole policy: email and password (POST /auth/register-external with this organizationId, then POST /auth/login), or Google (POST /auth/google-external with a Google ID token and this organizationId). Either way the answer carries a token the app sends as Authorization: Bearer on every App API call. registrationPolicy: "open", in at once; "approval", an organization admin approves each signup (TaskLite mails the admins on every signup, and the person once approved; unapproved users are never billed); "invite", a new person gets in only with an invite code (create_app_invite, or a code a user of the app minted on a relation endpoint with allowInvites): the app sends it as inviteCode with POST /auth/otp/verify, /auth/register-external or /auth/google-external, a sign-up without one is refused with 403 INVITE_REQUIRED and a bad code with 403 INVITE_INVALID, while people who are already members keep signing in as before; "closed" (the default), self-signup refused, external users are created by an admin. Under every policy a valid invite code admits its holder as if the organization were open, so "invite" is the policy for an app where people join only through someone who invited them (a coach inviting trainees). appLoginUrl: the page of YOUR app where these users log in, it becomes the "Log in" button in the approval email, so set it whenever you deploy an app that uses this flow; pass "" to clear. Call with no changes to just read the current settings. Requires organization admin.
| Argument | Type | Description |
|---|---|---|
| appLoginUrl | string | https URL of your app's login page for external users; "" clears it |
Create an app, a named API surface over the boards of a project, for an external frontend. Then add endpoints and an API key.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable name |
| projectId* | string | Project id (from list_projects / create_project) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name",
"projectId"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Create an API key for an app. SECURITY: the key must live server-side only (env var, Next.js API routes), never in browser code. If the app has its own users, the server also sends `X-App-User: <user id>` with the key so per-user endpoints know who is acting.
| Argument | Type | Description |
|---|---|---|
| name | string | Human-readable name |
| appId* | string | App id or slug (from list_apps / create_app) |
| scopes | array | Permissions on the key: "read", "write", "email". Omit to match the app: write when any endpoint accepts POST, PATCH or DELETE. Sending email from the app server (POST /apps/<slug>/api/_email/send) needs the key to include "email" or "write"; a read-only key is refused with 403 APP_KEY_SCOPE_REQUIRED. |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"scopes": {
"type": "array",
"items": {
"enum": [
"read",
"write",
"email"
],
"type": "string"
},
"description": "Permissions on the key: \"read\", \"write\", \"email\". Omit to match the app: write when any endpoint accepts POST, PATCH or DELETE. Sending email from the app server (POST /apps/<slug>/api/_email/send) needs the key to include \"email\" or \"write\"; a read-only key is refused with 403 APP_KEY_SCOPE_REQUIRED."
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Expose a board as a REST endpoint of an app: /apps/{appSlug}/api/{slug}. exposedColumns limits which columns are readable/writable. rowLevelSecurity.enabled makes the endpoint per-user: the developer's server sends `X-App-User: <their user id>` next to the API key, and the endpoint returns, updates and deletes ONLY that user's rows (401 without the header). Use it whenever the app has its own users. rowLevelSecurity.mode chooses which rows a user reaches: owner (the rows they created), shared (all rows, for authorized users), phone (the rows that carry their verified phone) or relation (the rows linked through a relation column to the row that stands for them). An app with two kinds of people in one organization, coaches and their trainees, is built from these: the Coaches board in mode phone (phoneColumn = its phone column), so each coach reads and edits his own row; Trainees in mode relation with relationColumn = its Coach column and identityPhoneColumn = the Coaches phone column, so a coach who signed in by phone sees only his trainees; boards one hop further (weigh-ins of a trainee) in mode relation with relationColumn = the Trainee column and viaColumn = Trainees.Coach for the coach, plus a second endpoint on the same board without viaColumn for the trainee herself. A trainee becomes her row through an invite code (create_app_invite, or allowInvites so the coach mints it in the app) or link_app_user.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable name |
| slug* | string | URL slug: lowercase letters, digits and dashes |
| appId* | string | App id or slug (from list_apps / create_app) |
| boardId* | string |
Create an invite code for an app (8 characters shown as XXXX-XXXX, typed without regard to case or the dash). The person signs up or signs in through the app with the code: the app sends it as inviteCode with POST /auth/otp/verify, /auth/register-external or /auth/google-external, after it may check it with POST /auth/invites/check. An invite does one or both of two things, and must do at least one: itemId links the new user to that row, so they "are" the row for every endpoint in row-level security mode "relation" (invite a trainee to her own Trainees row, or a coach to his Coaches row); role puts them on the app's access list (viewer, editor or submitter), which is what mode "shared" endpoints check. A valid code also admits a new person into an organization whose registration policy is "invite" or "closed" (configure_external_access). An existing access row is never changed by an invite: it does not re-enable a user who was switched off and does not raise a role. Requires organization owner or admin (an editor gets 403). To let the app's own users invite (a coach invites his trainees from inside the app), set allowInvites on the relation endpoint instead; the app then calls POST /apps/{appSlug}/api/{endpointSlug}/{itemId}/invites.
| Argument | Type | Description |
|---|---|---|
| role | string | App-level access role granted on sign-up: viewer (reads), submitter (creates), editor (reads and writes). Omit to grant no access row. Required unless itemId is given |
| appId* | string | App id or slug (from list_apps / create_app) |
| label | string | Shown to whoever checks the code before signing up, e.g. "Dana, trainee of coach Avi"; up to 120 characters. Do not put anything private in it: the check is public |
| itemId | string |
Create an automation on a board: when something happens, do something. The most useful action here is http_request, which calls an external API and writes the answer back into columns, pair it with the "scheduled" trigger and the board keeps itself up to date (prices, exchange rates, shipment status, weather). Triggers: item_created, status_changed, column_value_changed, date_approaching, scheduled. Actions: http_request, send_notification, send_email, send_push, change_status, set_column_value, create_cross_board_item, send_webhook. The scheduled trigger has no cron expression: the server checks once an hour, and triggerConfig takes { intervalHours, runAtHour } only (intervalHours: at least this many hours between runs, default 24; runAtHour: 0-23, run only during that hour of the day in UTC, not in the user's time zone, so convert: 08:00 in Israel is runAtHour 5 in summer and 6 in winter). A scheduled run executes the actions once for every row of the board that passes conditions, so filter with conditions. send_push sends a notification to the phones of app users through the app's own Firebase project (set up once per app: push_status; try it with send_test_push). Its config: { title, body, data, userIds, recipientsFromRelation, includeRowOwner, sound, badge, dataOnly }. title and body take {{column name}} placeholders, title defaults to the row title. Recipients are the union of: the row's owner under row-level security (includeRowOwner, default true; false leaves them out), userIds (fixed user ids, as in list_app_users), and recipientsFromRelation, a dotted path of column NAMES such as "Client.Coach.Coach user" that walks relation columns from this row and whose LAST segment must be a people column holding user ids (a single segment is a people column on this board); it does not resolve the user linked to a row by an invite or by phone, so without such a people column use userIds or the row owner. data is a flat object of strings the app reads to decide where to open (itemId and boardId are added). sound: "default" or the file name of a sound bundled in the app; badge: 0 to 99999, 0 clears; dataOnly: true shows nothing and delivers only data (no title, body, sound or badge; iOS may throttle or drop it). With no recipient the action is skipped, not failed. Two more things every action list can use: a { type: "delay", config: { minutes | hours | days } } action pauses the run and resumes the actions after it later (reminders, follow-ups); and any network action (http_request, send_webhook, send_email, send_whatsapp) may carry config.retry: { attempts (1-5), delaySeconds (1-60) }. send_webhook accepts config.secret for an HMAC signature. send_email sends mail from the organization to the people on a row. Its config: { to, subject, body, columnEmailField, fromName, replyTo, kind, attachments }. kind is "transactional" (the default: orders, receipts, notifications) or "marketing" (promotional mail: it needs the Pro plan or higher and a verified sender domain, and it gets an unsubscribe footer; people who unsubscribed are skipped). attachments is an array of FILE column ids on the triggering row (or {{column.<id>}}): the stored files in those cells are attached, up to 5MB in total, and a missing file is skipped instead of failing the action. Email is counted per month by plan: Free 300, Plus 3000, Pro 20000 (read the numbers with get_email_usage); a message held back by the quota is recorded as skipped in the communications log and can be resent from there. To send email from an app's own server instead of an automation, POST /apps/<slug>/api/_email/send with the app server key (X-API-Key, never a user token; the key needs the "email" or "write" scope, see create_app_api_key): { to: [up to 50 addresses], subject, html or text, replyTo, kind, attachmentIds: [stored file ids] }; each app may send 500 a day (429 APP_EMAIL_DAILY_LIMIT). create_cross_board_item copies a new row to another board: config { targetBoardId, title?: "{{item.title}}", columnValues: { "<column id on the TARGET board>": "{{<column NAME on this board>}}" } }; there is no mapping field, and a column left out is not copied. To act only on some rows pass conditions, e.g. [{ field: "<column id on this board>", operator: "equals", value: "New seller" }]. Change an automation later with update_automation; call list_automations first so you do not add a second one that does the same thing.
Create a board (a data table) inside a project. Add typed columns with create_column afterwards. kind: "tasks" (default) also gives the board the built-in task columns, status, priority, assignee, due date, tags, for work people track; "data" creates a plain table with only the columns you add, for records such as customers, products or orders (requires a TaskLite server from 2026-09-06; older servers ignore kind).
| Argument | Type | Description |
|---|---|---|
| kind | string | "tasks": with the built-in task columns (status, priority, assignee, due date, tags). "data": only the columns you add. Default tasks. |
| name* | string | Human-readable name |
| projectId* | string | Project id (from list_projects / create_project) |
| description | string | Free-text description |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"name"
],
"properties": {
"kind": {
"enum": [
"tasks",
"data"
],
"type": "string",
"description": "\"tasks\": with the built-in task columns (status, priority, assignee, due date, tags). \"data\": only the columns you add. Default tasks."
},
"name": {
"type": "string",
"description": "Human-readable name"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"description": {
"type": "string",
"description": "Free-text description"
}
},
"additionalProperties": false
}Add a typed column to a board. Valid types: text, rich_text, number, status, date, datetime, duration, people, checkbox, dropdown, label, priority, link, email, phone, relation, lookup, rollup, formula, rating, currency, file. Choose by meaning, date for dates, phone for phones, number/currency for amounts, dropdown/status (with settings.options as an array of labels) for closed choices; text is for free text only. An obvious name/type mismatch is rejected with the suggested type; pass force:true to override. Rules go in settings.validation: { unique, min, max, minLength, maxLength, pattern, patternMessage }, enforced on every write (UI, MCP, App API). Closed choices (dropdown/status) reject values outside settings.options unless settings.allowCustom is true.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable name |
| type* | string | Action type: http_request, send_notification, send_email, send_whatsapp, change_status, set_column_value, create_cross_board_item, send_webhook or delay |
| force | boolean | Create the column even when the name suggests a different type |
| boardId* | string | Board id (from list_boards / create_board) |
| settings | object | Type-specific settings. For dropdown/status/priority: options, either as labels ["A","B"] or as full objects [{value,label,color}], labels are expanded server-side, and colors are assigned if you do not supply them. |
| projectId |
Create an item (row) with all of its data in one call. cells maps columnId -> value (use get_board_schema for column ids); every cell is saved with the row. Use set_cell only for later edits.
| Argument | Type | Description |
|---|---|---|
| tags | array | Tags as an array of strings |
| cells | object | Cell values keyed by column id: { "<columnId>": value }. Scalars, { amount, currency } for currency, { relatedItemIds: [...] } for relations |
| title* | string | Item title, shown as the row name |
| status | string | Task status of the row on a task board: todo, in_progress, review or done. Refused on a data board, where it would only write a hidden task field: set that board's status column with cells (create_item) or set_cell (update_item) instead |
| boardId* | string | Board id (from list_boards / create_board) |
| dueDate | string | ISO date |
| priority | string | Priority: low, medium, high or urgent |
| projectId* | string | Project id (from list_projects / create_project) |
Create a project (a business process container). Boards with data live inside projects.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable name |
| description | string | Free-text description |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"description": {
"type": "string",
"description": "Free-text description"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Create a business role of an app's project, or change the label of an existing one (calling again with the same key and a label updates the label). A role is only a name; what it may do is written in the board policies. Example: key "manager", label "Agents manager". Roles can also come from the data itself with set_policy_identity (an employees board with a role column) instead of grant_app_role per person. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| key* | string | Role key, e.g. "manager". Lowercase letters, digits, dash or underscore are safest; "*" and "public" are built in and cannot be defined |
| appId* | string | App id or slug (from list_apps / create_app) |
| label | string | Display name, e.g. "Agents manager". Defaults to the key |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Role key, e.g. \"manager\". Lowercase letters, digits, dash or underscore are safest; \"*\" and \"public\" are built in and cannot be defined"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"label": {
"type": "string",
"description": "Display name, e.g. \"Agents manager\". Defaults to the key"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Delete an endpoint of an app for good: /apps/{appSlug}/api/{slug} stops answering at once and the endpoint cannot be brought back (create it again with create_app_endpoint). The board and its rows are not touched. Confirm with the user first: a frontend that calls this endpoint breaks. To take an endpoint offline and keep its definition, use update_app_endpoint with isActive false instead (list_app_endpoints shows active endpoints only, so keep the id). Get the endpoint id from list_app_endpoints.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| endpointId* | string | Endpoint id (from list_app_endpoints) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"endpointId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"endpointId": {
"type": "string",
"description": "Endpoint id (from list_app_endpoints)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Delete a business role of an app's project. Check first with list_app_role_grants who holds it and with get_board_policy where policies still name it: a policy that names a role that no longer exists simply matches nobody. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| key* | string | Role key: a short stable id such as "manager" or "agent" (what policies name). Built-in keys: "*" (every signed-in user of the app) and "public" (anonymous visitors); they need no definition and no grant |
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Role key: a short stable id such as \"manager\" or \"agent\" (what policies name). Built-in keys: \"*\" (every signed-in user of the app) and \"public\" (anonymous visitors); they need no definition and no grant"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Delete a board with every item on it. Destructive and not undoable, confirm with the user first, and prefer delete_column when only part of the model is wrong.
| Argument | Type | Description |
|---|---|---|
| boardId* | string | Board id (from list_boards / create_board) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId"
],
"properties": {
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Remove a board's access policy. An endpoint of that board in rowLevelSecurity mode "policy" then has no policy to follow; check what it allows afterwards with explain_access before leaving it on a live app. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| boardId* | string | Board id (from list_boards) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"boardId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Delete a column and every value stored in it. Destructive, confirm with the user first. Use update_column when the column is right but its name, type or options are wrong.
| Argument | Type | Description |
|---|---|---|
| boardId* | string | Board id (from list_boards / create_board) |
| columnId* | string | Column id (from get_board_schema) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"columnId"
],
"properties": {
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"columnId": {
"type": "string",
"description": "Column id (from get_board_schema)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Delete a comment from an item thread. Destructive, confirm with the user before calling. Needs projectId, itemId and the commentId.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item id (from query_items / create_item) |
| commentId* | string | Comment id (from list_comments / add_comment) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"itemId",
"commentId"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item id (from query_items / create_item)"
},
"commentId": {
"type": "string",
"description": "Comment id (from list_comments / add_comment)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Delete an item. Destructive, confirm with the user before calling.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item id (from query_items / create_item) |
| boardId* | string | Board id (from list_boards / create_board) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"itemId"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item id (from query_items / create_item)"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Delete a project with every board, column and row inside it. Destructive: confirm with the user first, and name the project in the confirmation. The project goes to the organization recycle bin, so it can be restored from the admin until it is emptied.
| Argument | Type | Description |
|---|---|---|
| projectId* | string | Project id (from list_projects / create_project) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId"
],
"properties": {
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Deploy a static frontend to TaskLite hosting and get a live URL https://{slug}.tasklite.dev (HTTPS, auto-published on first deploy, versions kept for rollback_deployment). Hand over the frontend in ONE of three ways: `files`, the files inline (path + content), the way to go from ChatGPT or any hosted client: write index.html and its assets, then deploy in the same turn; `zipUrl`, a public https URL of a zip (a Lovable/Bolt export, a GitHub release asset); `dir`, a build output folder on this machine (only when the MCP runs locally next to the files); `fromAppId`, a version already hosted in the same organization, copied on the server (start a new app from an existing site, or bring an old version back as a new one; get_deployment_files reads a version first). A real build that already exists on the person's machine fits none of these from a hosted server: tell them to drop the zip on the app's Versions screen (the adminUrl of the app, then Versions), which deploys the same way and keeps the same version history. In the frontend, call the app API via relative /api/{endpoint}, the hosting proxy injects the app identity, so no key ships to the browser.
| Argument | Type | Description |
|---|---|---|
| dir | string | Local path to the BUILD OUTPUT directory (the one containing index.html), not the project root. Only where the MCP runs on the same machine as the files |
| appId* | string | App UUID or slug (app-xxxxxx), see list_apps |
| files | array | The site files inline. Must include index.html. Up to 500 files / 8MB decoded, right for a frontend written in the conversation |
| zipUrl | string | Public https URL of a zip of the BUILD OUTPUT (index.html at the root, or inside a single top-level folder). Up to 50MB |
Say what a user, or a list of roles, may do on a board under its policy: which rows they read and write, which columns, create and delete. Pass boardId and exactly one of userId (an app user from list_app_users; the answer includes the roles that person has) or roles (role keys, to try a role before anyone holds it). Changes nothing; use it after every set_board_policy. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| roles | array | Role keys to explain, e.g. ["agent"]. Pass this or userId |
| userId | string | An app user's id (from list_app_users). Pass this or roles |
| boardId* | string | Board id (from list_boards) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"boardId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"roles": {
"type": "array",
"items": {
"type": "string"
},
"description": "Role keys to explain, e.g. [\"agent\"]. Pass this or userId"
},
"userId": {
"type": "string",
"description": "An app user's id (from list_app_users). Pass this or roles"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}The whole project as JSON, boards, columns with settings, items with their cells keyed by column id. For migrations, backups and reading a system back. Items are capped per board for the model's sake; the REST endpoint GET /organizations/{orgId}/projects/{projectId}/export.json returns everything.
| Argument | Type | Description |
|---|---|---|
| projectId* | string | Project id (from list_projects / create_project) |
| organizationId | string | Defaults to the credential organization |
| maxItemsPerBoard | integer | Default 200 |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId"
],
"properties": {
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"organizationId": {
"type": "string",
"description": "Defaults to the credential organization"
},
"maxItemsPerBoard": {
"type": "integer",
"maximum": 2000,
"description": "Default 200",
"exclusiveMinimum": 0
}
},
"additionalProperties": false
}One project, board or item in full, by the id search returned (project:<id>, board:<projectId>:<boardId>, item:<projectId>:<boardId>:<itemId>) or by an app URL path. Returns { id, title, text, url, metadata }, the ChatGPT fetch contract; text is the record as JSON.
| Argument | Type | Description |
|---|---|---|
| id* | string | An id from search, or an app URL path such as /projects/…/boards/…/items/… |
| organizationId | string | Only needed for project ids when the credential has no default organization; otherwise resolved automatically |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "An id from search, or an app URL path such as /projects/…/boards/…/items/…"
},
"organizationId": {
"type": "string",
"description": "Only needed for project ids when the credential has no default organization; otherwise resolved automatically"
}
},
"additionalProperties": false
}Get the machine-readable spec of an app: base URL, endpoints, methods, fields, auth. Two formats: "tasklite" (default), the compact shape the frontend prompts are built from, and "openapi", a standard OpenAPI 3.1 document for developers and other tools. When the user asks for the OpenAPI spec, or wants to hand the API to a developer, pass format "openapi". appId accepts either the app UUID or its slug (app-xxxxxx); list_apps shows both. The returned baseUrl is absolute, use it verbatim, do not rebuild it from the admin URL.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| format | string | "tasklite" (default): compact endpoint list. "openapi": OpenAPI 3.1 document, every endpoint with typed fields, filter grammar, auth and errors |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"format": {
"enum": [
"tasklite",
"openapi"
],
"type": "string",
"description": "\"tasklite\" (default): compact endpoint list. \"openapi\": OpenAPI 3.1 document, every endpoint with typed fields, filter grammar, auth and errors"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Read a board's access policy: { boardId, policy, updatedAt, updatedBy }, policy null when the board has none. A policy only takes effect on endpoints whose rowLevelSecurity mode is "policy". Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| boardId* | string | Board id (from list_boards) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"boardId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Get a board with its full column schema (ids, names, types, settings). Call this before creating items with cells.
| Argument | Type | Description |
|---|---|---|
| boardId* | string | Board id (from list_boards / create_board) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId"
],
"properties": {
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Read cells of one item from the database (not a cache): one current value per column, the value set_cells_if_unchanged compares. Use it to decide a conditional write, and pass each value back as `expected` exactly as it came.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item (row) id |
| boardId* | string | Board id (from list_boards / create_board) |
| columnIds | array | Only these columns (default: every cell of the item) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"itemId"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"columnIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "Only these columns (default: every cell of the item)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Read back what a hosted frontend version is made of: every file with its size and its URL on that version, and the full text of the text files (HTML, CSS, JS, JSON, SVG...). This is how a new conversation continues a site an earlier one built: "take my Krispool site and keep going" starts here, not from scratch. For a site written by hand the files ARE the source. For a bundled build (Vite, React) the JS is minified output: fine to inspect, not something to edit, so ask for the project's source instead. Images and other binaries come back as URLs only. Text is capped at 512KB per file and 4MB per call; narrow with `paths` for a big site. To start another app from this version, or bring an old version back as a new one, use deploy_frontend with fromAppId.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| paths | array | Only these files, as listed by a previous call, e.g. ["index.html", "css/site.css"] |
| version | integer | Version to read (from list_deployments). Default: the live version |
| includeContent | boolean | false lists the files without their text, a cheap first look at a large site. Default true |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
How much of the monthly email quota an organization has used: emails sent this month, emails waiting in the queue, the plan limit (Free 300, Plus 3000, Pro 20000; null means unlimited), whether the plan allows marketing email, and whether sending is paused for the organization (too many bounces or complaints). Covers email sent by automations, the communications endpoints and app servers (POST /apps/<slug>/api/_email/send).
| Argument | Type | Description |
|---|---|---|
| organizationId | string | Defaults to the credential organization |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"organizationId": {
"type": "string",
"description": "Defaults to the credential organization"
}
},
"additionalProperties": false
}Get a ready-made prompt describing the app backend, for pasting into a frontend generator (v0/bolt/lovable/cursor). appId accepts the app UUID or its slug (app-xxxxxx), use list_apps to find it.
| Argument | Type | Description |
|---|---|---|
| tool* | string | Target tool the prompt is written for |
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"tool"
],
"properties": {
"tool": {
"enum": [
"v0",
"bolt",
"lovable",
"cursor",
"claude-code"
],
"type": "string",
"description": "Target tool the prompt is written for"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Read the change history of one item (row), newest first: who changed which field, from what to what, when, through which channel, with the event and reason when a named action made the change. Returns { items: [{ field, fieldId, from, to, at, actor: { userId, name }, channel, event, reason }], nextBefore }. Page backwards by passing nextBefore as `before`. Needs access to the item's board.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Entries per page (server default when omitted) |
| before | string | The nextBefore of the previous page, to read older entries |
| itemId* | string | Item (row) id, from query_items |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"itemId"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Entries per page (server default when omitted)"
},
"before": {
"type": "string",
"description": "The nextBefore of the previous page, to read older entries"
},
"itemId": {
"type": "string",
"description": "Item (row) id, from query_items"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Read the project's role identity: which board holds the people and how their rows map to roles (see set_policy_identity). Returns { identity }, null when none is set. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Give an app user a business role (a user can hold several). Takes the userId from list_app_users and a role key from list_app_roles. expiresAt makes the grant temporary. Granting the same pair again changes only expiresAt. This is for personal exceptions; for a whole team prefer set_policy_identity, which reads the roles from an employees board. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| userId* | string | The user's id (userId from list_app_users), a UUID |
| roleKey* | string | Role key: a short stable id such as "manager" or "agent" (what policies name). Built-in keys: "*" (every signed-in user of the app) and "public" (anonymous visitors); they need no definition and no grant |
| expiresAt | string | ISO 8601 date-time when the grant ends. Omit for no end |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId",
"roleKey"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID"
},
"roleKey": {
"type": "string",
"description": "Role key: a short stable id such as \"manager\" or \"agent\" (what policies name). Built-in keys: \"*\" (every signed-in user of the app) and \"public\" (anonymous visitors); they need no definition and no grant"
},
"expiresAt": {
"type": "string",
"description": "ISO 8601 date-time when the grant ends. Omit for no end"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Link an existing user of an app to a row, so the user "is" that row for every endpoint in row-level security mode "relation": link a coach to his Coaches row and he reaches the trainees whose Coach column points at it. This is the manual form of what an invite code does at sign-up; use it for someone who already has an account (find the userId with list_app_users). A user may be linked to several rows, and linking the same pair again changes nothing. The user must already be a member of the app's organization (anyone who signed in to the app is) and the row must be a live row in that organization, otherwise 404. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| itemId* | string | Id of the row that stands for this user (from query_items) |
| userId* | string | The user's id (userId from list_app_users), a UUID; not their externalId |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId",
"itemId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"itemId": {
"type": "string",
"description": "Id of the row that stands for this user (from query_items)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID; not their externalId"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List an app's REST endpoints, slug, board, allowed methods, and how many columns each exposes. An endpoint exposing 0 columns is broken: it returns only item metadata and silently discards writes.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the invite codes of an app, newest first (the latest 200): the ones created with create_app_invite and the ones the app's own users minted through a relation endpoint with allowInvites (createdVia admin or app). Each carries id, code, itemId, role, label, maxUses, useCount, expiresAt, revokedAt and status: active, used (no uses left), expired or revoked.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the role grants of an app's project, as { grants }: who holds which role and until when. Pass userId to see one person's. Roles that come from the employees board (set_policy_identity) are not grants and are not listed here; explain_access with a userId shows the roles a person ends up with. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| userId | string | Only this user's grants (userId from list_app_users) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"userId": {
"type": "string",
"description": "Only this user's grants (userId from list_app_users)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the business roles of an app's project, as { roles: [{ key, label }] }. Roles are what board policies (set_board_policy) name in their `roles` lists; they are separate from the app access role (viewer, editor, submitter) of add_app_user. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the rows one user of an app is linked to, oldest first: each link has itemId, source (invite or admin) and createdAt. These are the rows the user "is" under row-level security mode "relation". A user can also stand for a row with no link at all, through identityPhoneColumn or identityEmailColumn; those matches are computed on every request and do not appear here.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| userId* | string | The user's id (userId from list_app_users), a UUID |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the people of an app, as { users, pending }. users: everyone who ever called it with X-App-User or signed in to it with a code. Each has userId (the id set_app_user_role, remove_app_user, link_app_user, list_app_user_links and send_test_push take), externalId (the developer's own id for them, or null for a user who signed in by code), name, phone (the phone they proved with a code, or null), source (api or otp), role (viewer, editor or submitter), isActive, hasAccessRow, lastSeenAt and itemCount (rows they own on the app's boards). hasAccessRow says whether they are on the app's access list: when it is false, role and isActive are only defaults, and an endpoint in row-level security mode "shared" refuses them with 403 until add_app_user or set_app_user_role puts them on the list. pending: the phones add_app_user is still holding access for, each with id, phone, role, createdAt, expiresAt and status (pending, or expired); they get in on their first sign-in with a code. Use it to see who can use the app and to find the userId of a person.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the apps in the organization, id, slug, status. Call this first when you need an app id: the slug (app-xxxxxx) is what shows up in URLs and in generated code, and this is how you map it back to the app.
| Argument | Type | Description |
|---|---|---|
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the automations on a board, so you can see what already runs before adding another.
| Argument | Type | Description |
|---|---|---|
| boardId* | string | Board id (from list_boards / create_board) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId"
],
"properties": {
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}List the boards inside a project, id, name, description. Every other board tool needs a boardId, and this is the only way to discover one without being handed a URL.
| Argument | Type | Description |
|---|---|---|
| page | number | 1-based; defaults to 1 |
| limit | number | Defaults to 50 |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId"
],
"properties": {
"page": {
"type": "number",
"description": "1-based; defaults to 1"
},
"limit": {
"type": "number",
"description": "Defaults to 50"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}List the comments (the correspondence thread) on an item, oldest first. Each comment includes its author and any @mentions. Needs projectId and itemId (get itemId from query_items).
| Argument | Type | Description |
|---|---|---|
| page | integer | 1-based page, default 1 |
| limit | integer | Page size, default 20 |
| itemId* | string | Item (row) id |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"itemId"
],
"properties": {
"page": {
"type": "integer",
"description": "1-based page, default 1",
"exclusiveMinimum": 0
},
"limit": {
"type": "integer",
"maximum": 100,
"description": "Page size, default 20",
"exclusiveMinimum": 0
},
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}List the hosted-frontend deployments of an app, versions, which one is live, and the public URL.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List the organizations the authenticated user belongs to. Use the returned id as organizationId in other tools.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}List projects in an organization. The API returns 50 per page, an organization with more than that needs page 2 and beyond, so check the returned total before assuming a project does not exist.
| Argument | Type | Description |
|---|---|---|
| page | number | 1-based; defaults to 1 |
| limit | number | Defaults to 50 |
| organizationId | string | Defaults to the credential organization |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"page": {
"type": "number",
"description": "1-based; defaults to 1"
},
"limit": {
"type": "number",
"description": "Defaults to 50"
},
"organizationId": {
"type": "string",
"description": "Defaults to the credential organization"
}
},
"additionalProperties": false
}The files attached to an item, including everything that came in through a request_file_upload link, each with a download URL that is signed and short lived (mint a fresh one by calling again). Also lists the upload links on the item and how many files each has taken, which is how to tell whether the person you asked has delivered.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item (row) id |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"itemId"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Publish an app, required before its API endpoints accept external calls.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Whether an app can send push notifications to phones, and how many devices are registered. Push goes out through the customer's OWN Firebase project, so it has to be configured once per app before send_push automations do anything. This tool never returns the key.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}List items (rows) of a board, including their cell values. Returns all items unless limit/page are given (the API defaults to 50 per page when unpaged, so the tool pages through and concatenates). Narrow the result with search, status, priority and sort instead of fetching everything. This is the admin view; the REST endpoints of a published app take a fuller grammar, filter[column][gte], relation filters, per-field search, see get_app_spec.
| Argument | Type | Description |
|---|---|---|
| page | integer | 1-based page, only with limit |
| sort | string | Sort by title, createdAt, updatedAt or status; prefix with "-" for descending, e.g. "-createdAt" for newest first. Anything else keeps the board order |
| limit | integer | Page size; omit to fetch all items |
| search | string | Free text; matches the row title and its text cells |
| status | string | Only rows whose status is one of these, comma separated. Matched against the board's status column by option value or label, case-insensitive: "todo,in_progress" on a task board, "Received,In Repair" on a data board whose status column lists those (get_board_schema shows the options). Needs a status column. A board with none (no column of type status) gets an error that lists its dropdown columns, instead of unfiltered rows. A board whose status is a dropdown named status/סטטוס/מצב is filtered here on that dropdown, after fetching, so an explicit limit can give a page with fewer rows (the answer says so) |
Take a person's access to an app away. Pass exactly one of two ids from list_app_users: userId, for someone who already signed in, switches them off (the same as set_app_user_role with isActive false: their calls are refused in every mode, nothing of theirs is deleted, and set_app_user_role or add_app_user switches them back on); pendingId, for a phone that add_app_user is still holding access for, cancels it, so that phone's first sign-in opens nothing. Requires organization owner or admin (an editor gets 403).
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| userId | string | The user's id (userId from list_app_users), a UUID. Pass this or pendingId |
| pendingId | string | Id of a waiting phone (id in the pending list of list_app_users, or pendingId from add_app_user), a UUID. Pass this or userId |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID. Pass this or pendingId"
},
"pendingId": {
"type": "string",
"description": "Id of a waiting phone (id in the pending list of list_app_users, or pendingId from add_app_user), a UUID. Pass this or userId"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Set the display order of a board's columns. Pass every column id in the wanted order (get_board_schema lists them).
| Argument | Type | Description |
|---|---|---|
| boardId* | string | Board id (from list_boards / create_board) |
| columnIds* | array | Column ids in the new order (every column of the board) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"columnIds"
],
"properties": {
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"columnIds": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1,
"description": "Column ids in the new order (every column of the board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Create a link that puts files onto an item from outside TaskLite: the customer's photos, a signed contract, a logo, a build zip. Returns an address like https://app.tasklite.net/upload/<token> that anyone you hand it to can use with no account, no login and no API key; pass clientEmail and TaskLite emails the link for you. What arrives lands as attachments on that item, and list_uploaded_files reads them back with a download URL. This is the answer when the person has the file and the model does not: a hosted client cannot read a folder on someone's machine. The link is public for as long as it lasts, so keep expiryDays short and maxFiles tight, and revoke_upload_link when the material is in.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item (row) the files belong to, from query_items / create_item. Make the row first if the material has no home yet |
| message | string | What to upload, in the words the recipient will read: "the four room photos and the price list" |
| maxFiles | integer | How many files the link accepts before it stops. Default 10 |
| clientName | string | Who is being asked, shown on the upload page |
| expiryDays | integer | How long the link lives. Default 7 days |
| clientEmail | string | Send the link to this address. Omit to get the link back and pass it on yourself |
Revoke an invite code so nobody else can sign up with it. People who already used it stay linked to their row and keep their access; to cut one of them off use unlink_app_user. Cannot be undone, create a new invite instead. Requires organization owner or admin. Get the invite id (not the code) from list_app_invites.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| inviteId* | string | Invite id, the id field from list_app_invites (a UUID, not the code) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"inviteId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"inviteId": {
"type": "string",
"description": "Invite id, the id field from list_app_invites (a UUID, not the code)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Take a business role away from an app user (a grant made with grant_app_role). A role the user gets from the employees board (set_policy_identity) is not a grant: change the board row instead. Revoking a grant that does not exist also succeeds. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| userId* | string | The user's id (userId from list_app_users), a UUID |
| roleKey* | string | Role key: a short stable id such as "manager" or "agent" (what policies name). Built-in keys: "*" (every signed-in user of the app) and "public" (anonymous visitors); they need no definition and no grant |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId",
"roleKey"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID"
},
"roleKey": {
"type": "string",
"description": "Role key: a short stable id such as \"manager\" or \"agent\" (what policies name). Built-in keys: \"*\" (every signed-in user of the app) and \"public\" (anonymous visitors); they need no definition and no grant"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Close an upload link before it expires, so the address stops accepting files. The files already uploaded stay on the item. Use it as soon as the material is in, because until then anyone holding the link can add more.
| Argument | Type | Description |
|---|---|---|
| tokenId* | string | Link id (the tokenId from request_file_upload) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"tokenId"
],
"properties": {
"tokenId": {
"type": "string",
"description": "Link id (the tokenId from request_file_upload)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Point the live URL back at a previous deployment version (see list_deployments for available versions).
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| version* | integer | Deployment version number (from list_deployments) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"version"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"version": {
"type": "integer",
"description": "Deployment version number (from list_deployments)",
"exclusiveMinimum": 0
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Full-text search across the projects, boards and items of the organization. Returns { results: [{ id, title, url }] }, the shape ChatGPT connectors and deep research expect; pass a result id to fetch for the full record. When you already know the board, query_items is cheaper and complete.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max results, default 20 |
| query* | string | Search text |
| projectId | string | Limit the search to one project |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 50,
"description": "Max results, default 20",
"exclusiveMinimum": 0
},
"query": {
"type": "string",
"maxLength": 100,
"minLength": 1,
"description": "Search text"
},
"projectId": {
"type": "string",
"description": "Limit the search to one project"
}
},
"additionalProperties": false
}Send one real push notification to the given app users, to prove the chain works before an automation depends on it. Confirm with the user first: this reaches actual phones.
| Argument | Type | Description |
|---|---|---|
| body | string | Notification body |
| appId* | string | App id or slug (from list_apps / create_app) |
| title | string | Notification title; defaults to "TaskLite" |
| userIds* | array | App user ids to notify (the same ids row-level security uses) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userIds"
],
"properties": {
"body": {
"type": "string",
"description": "Notification body"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"title": {
"type": "string",
"description": "Notification title; defaults to \"TaskLite\""
},
"userIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "App user ids to notify (the same ids row-level security uses)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Change what an existing user of an app may do, or switch them off or back on. Takes the userId from list_app_users and at least one of role and isActive. It also puts on the app's access list a user who is not on it yet (hasAccessRow false in list_app_users), which is what an endpoint in row-level security mode "shared" checks: use it for someone who already signed in and is refused with 403. isActive false switches the user off in every mode: their calls are refused until it is set back to true; nothing of theirs is deleted. For a person who has not signed in yet there is no userId: use add_app_user with their phone. Requires organization owner or admin (an editor gets 403).
| Argument | Type | Description |
|---|---|---|
| role | string | App-level access role: editor (reads and writes), viewer (reads), submitter (creates). Omit to keep the current one |
| appId* | string | App id or slug (from list_apps / create_app) |
| userId* | string | The user's id (userId from list_app_users), a UUID; not their externalId |
| isActive | boolean | false switches the user off, true switches them back on. Omit to keep the current state |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
Set who may read, write, create and delete rows of a board, and which columns, as a JSON document (a FULL REPLACE of the board's policy; read get_board_policy first to change part of one). It is enforced on the app's endpoints of this board whose rowLevelSecurity.mode is "policy" (create_app_endpoint / update_app_endpoint). Organization owners, admins and editors using the app are let through unless internalBypass is false. Fields: - schemaVersion: 1 (required). - internalBypass: default true. - rows.read / rows.write: a list of { roles, scope }. scope is "all", { "mine": "<column id>" } (rows whose column points at the caller: a relation to the row that stands for them, their verified phone or email, or a people column; add "via": "<relation column id>" for one more hop), { "created": true } (rows they created through the app) or { "where": CONDITION } (rows a condition selects, e.g. open cases older than 3 days, for an escalation view). A user gets the union of the rules that name any of their roles; no rule for their roles means no access. - rows.create / rows.delete: plain role lists. - columns: { "<column id or reserved field>": { "read": ACCESS, "write": ACCESS } }. ACCESS is a role list, or { "roles": [...], "orMine": "<column id>" } (these roles, or anyone for whom the row is theirs by that column). A column without an entry follows the row rules. An EMPTY list ("write": []) locks the column for everyone through the app: use it for assignedTo and for any field only an admin or an action may change. Reserved fields are title, description, status, priority, dueDate and assignedTo, addressed by those names. Reserved fields are open to anyone who may write the row unless you lock them, so lock assignedTo. - CONDITION (in where, rules.when): { "all": [c...] } | { "any": [c...] } | { "not": c } | a leaf { "col": "<column id or reserved field>", "op": OP, ... }. OP: eq / neq (with "value"), in (value is a list), empty, notEmpty, isMe (the column points at the caller; optional "via"), olderThan (col is updatedAt, createdAt or a date column; give "hours" or "days"), changed (this write sets col; only in rules). No free expressions. - rules: [{ "id", "when": CONDITION, "deny": { "write": "*" | [column ids], "except": [roles] }, "require": [column ids that must be filled after the write], "except": [roles], "message" }]. deny is judged on the row as it is BEFORE the write, require AFTER it. Rules bind people acting through the app; internal bypass users and an action's own columns are not held to deny. - actions: { "<name>": { "roles": [...], "input": { "<input name>": { "col": "<column id the value is written to>", "required": true } }, "set": { "<column id>": constant }, "event": "TRANSFER", "scope": "write" | "read", "approval": "<approval workflow id of the board>" } }. An action is role-gated, validates its input (an input without col is only data; "reason" is always accepted and goes to the history), writes its set and bound inputs in one transaction, and records event and reason in the history. It is the only way to change a column whose write is []. With approval it files a request for that workflow instead of writing; the write happens when the last step approves. Roles named by approval steps must exist (define_app_role). Actions run through the App API only (see below). Frontends run an action with POST /apps/<slug>/api/<endpoint>/<itemId>/actions/<name> and the inputs as the body; approvers read GET /apps/<slug>/api/me/approvals and answer POST /apps/<slug>/api/approvals/<requestId>/decide { "decision": "approve" | "reject", "comment"? }; GET /apps/<slug>/api/me/permissions lists the actions the caller may run as [{ name, allowed, roles, inputs, approval, event, scope }]. There is no MCP tool that runs an action. Roles are keys from list_app_roles, plus "*" (any signed-in user) and "public". Column ids come from get_board_schema. An invalid document is refused with POLICY_INVALID and an errors list naming each problem. Example (agents see and edit only their own cases, the manager sees and edits all, bookkeeping reads all, commission is visible to the owner, the manager and to the agent on his own rows): { "schemaVersion": 1, "rows": { "read": [ { "roles": ["owner","manager","bookkeeping"], "scope": "all" }, { "roles": ["agent"], "scope": { "mine": "<agent column id>" } } ], "write": [ { "roles": ["owner","manager"], "scope": "all" }, { "roles": ["agent"], "scope": { "mine": "<agent column id>" } } ], "create": ["owner","manager","agent"], "delete": ["owner"] }, "columns": { "<commission column id>": { "read": { "roles": ["owner","manager"], "orMine": "<agent column id>" }, "write": ["owner"] }, "<agent column id>": { "write": ["owner","manager"] }, "assignedTo": { "write": [] } }, "rules": [ { "id": "lock", "when": { "all": [ { "col": "<locked column id>", "op": "eq", "value": true } ] }, "deny": { "write": "*", "except": ["owner","manager"] }, "message": "The case is locked to its agent" } ], "actions": { "transfer": { "roles": ["owner","manager"], "input": { "agent": { "col": "<agent column id>", "required": true }, "reason": { "required": true } }, "set": { "<locked column id>": false }, "event": "TRANSFER" }, "unlock": { "roles": ["owner","manager"], "input": { "reason": { "required": true } }, "set": { "<locked column id>": false }, "event": "UNLOCK" }, "exception": { "roles": ["agent"], "input": { "reason": { "required": true } }, "set": { "<exception column id>": true }, "approval": "<workflow id, a role step>" } } } (The Achituv shape: a locked case cannot be edited except by the owner and the manager; transfer and unlock are the only way to change the agent or the lock, with a recorded reason; an exception asks a role step for approval.) Test it with explain_access and simulate_request before telling the user it is done. Requires organization owner or admin.
Set a single cell value on an item by columnId.
| Argument | Type | Description |
|---|---|---|
| value* | any | The new cell value; shape depends on the column type |
| itemId* | string | Item (row) id |
| boardId* | string | Board id (from list_boards / create_board) |
| columnId* | string | Column id (from get_board_schema) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"itemId",
"columnId",
"value"
],
"properties": {
"value": {
"anyOf": [
{
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"type": "null"
},
{
"type": "array",
"items": {}
},
{
"type": "object",
"additionalProperties": {}
}
],
"description": "The new cell value; shape depends on the column type"
},
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"columnId": {
"type": "string",
"description": "Column id (from get_board_schema)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Compare-and-set on cells of one item, all or none. Each cell carries the value you read (`expected`, null = empty) and the value to write. If any cell no longer holds its `expected`, nothing is written and the answer is an error with code CELL_CONFLICT and `conflicts` [{columnId, current}]: read again (use `current`), decide again, and never resend the same call. CELL_BUSY (the row is being written) also writes nothing: read again, then retry. Plain columns only (not relation, file, lookup, rollup, formula, button or system columns). Use set_cell for a write that needs no precondition.
| Argument | Type | Description |
|---|---|---|
| cells* | array | 1 to 50 cells of this item, each column once |
| itemId* | string | Item (row) id |
| boardId* | string | Board id (from list_boards / create_board) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"itemId",
"cells"
],
"properties": {
"cells": {
"type": "array",
"items": {
"type": "object",
"required": [
"columnId",
"value",
"expected"
],
"properties": {
"value": {
"anyOf": [
{
"type": "string"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"type": "null"
},
{
"type": "array",
"items": {}
},
{
"type": "object",
"additionalProperties": {}
}
],
"description": "The value to write; null clears the cell"
},
"columnId": {
"type": "string",
"description": "Column id (from get_board_schema)"
},
"expected": {
"anyOf": [
{
"$ref": "#/properties/cells/items/properties/value/anyOf/0"
},
{
"$ref": "#/properties/cells/items/properties/value/anyOf/1"
},
{
"$ref": "#/properties/cells/items/properties/value/anyOf/2"
},
{
"$ref": "#/properties/cells/items/properties/value/anyOf/3"
},
{
"$ref": "#/properties/cells/items/properties/value/anyOf/4"
},
{
"$ref": "#/properties/cells/items/properties/value/anyOf/5"
}
],
"description": "The value you read, exactly as it came back (null = empty or missing)"
}
},
"additionalProperties": false
},
"maxItems": 50,
"minItems": 1,
"description": "1 to 50 cells of this item, each column once"
},
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Derive "who is this user and what is their role" from the data, instead of a grant per person: point at the employees board, its phone/email column, the column that says what each person does, and a map from that column's values to role keys. A signed-in user whose verified phone (or email) is in a row of that board gets that row's roles; a row that is not active gives none. Full replace. Example: { "board": "<Employees board id>", "phoneColumn": "<Phone column id>", "roleColumn": "<Position column id>", "roleMap": { "Agent": ["agent"], "Agents manager": ["manager"], "Owner": ["owner"] }, "activeColumn": "<Status column id>", "activeValues": ["Active"] }. Board and columns are ids (get_board_schema). A grant (grant_app_role) adds to what the board gives. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| identity* | object | |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"identity"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"identity": {
"type": "object",
"required": [
"board",
"roleColumn",
"roleMap"
],
"properties": {
"board": {
"type": "string",
"description": "Id of the board whose rows stand for people"
},
"roleMap": {
"type": "object",
"description": "Value of roleColumn to role keys, e.g. { \"Agent\": [\"agent\"] }",
"additionalProperties": {
"type": "array",
"items": {
"type": "string"
}
}
},
"roleColumn": {
"type": "string",
"description": "Column id whose value says the person's position"
},
"emailColumn": {
"type": "string",
"description": "Email column id on that board"
},
"phoneColumn": {
"type": "string",
"description": "Phone column id on that board"
},
"activeColumn": {
"type": "string",
"description": "Column id that says whether the person is still active"
},
"activeValues": {
"type": "array",
"items": {
"type": "string"
},
"description": "Values of activeColumn that count as active"
}
},
"additionalProperties": false
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Dry-run one app API request in the name of a user and get the verdict (allowed or refused, and why), changing nothing: the endpoint slug, the HTTP method (or the name of a policy action, with its itemId) and optionally the column keys the body would carry. Use it to prove that a forbidden thing is refused (an agent PATCHing assignedTo, reading another agent's row) and an allowed one passes. Requires organization owner or admin.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| action | string | Name of a policy action to try on itemId (needs itemId) instead of a plain method |
| itemId | string | The row the request is about (PATCH, DELETE, single GET) |
| method | string | HTTP method of the request. Pass this or action |
| userId* | string | The app user the request is made as (from list_app_users) |
| bodyKeys | array | Field or column keys the request body would write |
| endpoint* | string | Endpoint slug (from list_app_endpoints) |
Remove the link between a user of an app and a row: the user stops being that row, and at once loses the rows of every relation endpoint they reached through it. The account, the row and the user's app access are not touched, and nothing is deleted. A user matched to the row by identityPhoneColumn or identityEmailColumn still reaches it; change the phone or email in the row to end that. Requires organization owner or admin. Removing a link that does not exist also answers success.
| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| itemId* | string | Id of the linked row (itemId from list_app_user_links) |
| userId* | string | The user's id (userId from list_app_users), a UUID |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId",
"itemId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"itemId": {
"type": "string",
"description": "Id of the linked row (itemId from list_app_user_links)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}Change an existing endpoint, most often to set exposedColumns on one that was created without them. Get the endpoint id from list_app_endpoints and the column ids from get_board_schema.
| Argument | Type | Description |
|---|---|---|
| name | string | Human-readable name |
| slug | string | URL slug: lowercase letters, digits and dashes |
| appId* | string | App id or slug (from list_apps / create_app) |
| isActive | boolean | Whether it is active |
| endpointId* | string | Endpoint id (from list_app_endpoints) |
| allowedMethods | array | HTTP methods the endpoint accepts: GET, POST, PATCH, DELETE |
| exposedColumns | array | Replacement list of exposed columns (same shape as create_app_endpoint) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
| rowLevelSecurity | any | Replacement row-level security (same shape as create_app_endpoint); null turns it off. The object replaces the stored one whole, it is not merged: to change one field, read the current value with list_app_endpoints and send every field again (enabled, mode and the columns of that mode), or the ones left out are lost |
Change an existing automation: its actions, conditions, trigger config or name, or switch it off with isActive false. Fields left out stay as they are; actions and conditions, when given, replace the whole list. Use it to fix an automation instead of creating a second one next to it. Get the id from list_automations. For send_email actions, config.kind is transactional (default) or marketing (Pro plan or higher, verified sender domain, unsubscribe footer) and config.attachments is an array of file column ids on the row; see create_automation.
| Argument | Type | Description |
|---|---|---|
| name | string | New name |
| actions | array | The full new list of actions (replaces the old one) |
| boardId* | string | Board id the automation belongs to |
| isActive | boolean | false switches it off, true on |
| projectId* | string | Project id (from list_projects / create_project) |
| conditions | array | Run only for rows that match, e.g. [{ field: "<column id>", operator: "equals", value: "New seller" }] |
| automationId* | string | Automation id (from list_automations) |
| triggerConfig |
Rename a board or change its description. Structure (columns) is changed with update_column / delete_column / reorder_columns.
| Argument | Type | Description |
|---|---|---|
| name | string | Human-readable name |
| boardId* | string | Board id (from list_boards / create_board) |
| projectId* | string | Project id (from list_projects / create_project) |
| description | string | Free-text description |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"description": {
"type": "string",
"description": "Free-text description"
}
},
"additionalProperties": false
}Change a column after the fact: rename it, change its type (e.g. number -> currency), replace settings (dropdown options), or set isRequired / isHidden. A type change converts existing values (number↔currency, text→number/date/checkbox, anything→text) and clears the ones that cannot convert; the response carries conversion: { converted, cleared }. settings.validation rules apply here too.
| Argument | Type | Description |
|---|---|---|
| name | string | Human-readable name |
| type | string | New column type (same list as create_column) |
| force | boolean | Skip the name/type sanity check |
| boardId* | string | Board id (from list_boards / create_board) |
| columnId* | string | Column id (from get_board_schema) |
| isHidden | boolean | Hide the column in the TaskLite UI |
| settings | object | Replaces the column settings, e.g. { options: [...] } for dropdown/status |
| projectId* | string | Project id (from list_projects / create_project) |
| isRequired |
Edit the text of an existing comment. Only the author can edit their comment. Needs projectId, itemId and the commentId.
| Argument | Type | Description |
|---|---|---|
| itemId* | string | Item (row) id |
| content* | string | The new comment text |
| commentId* | string | Comment id (from list_comments) |
| projectId* | string | Project id (from list_projects / create_project) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"itemId",
"commentId",
"content"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"content": {
"type": "string",
"description": "The new comment text"
},
"commentId": {
"type": "string",
"description": "Comment id (from list_comments)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
}
},
"additionalProperties": false
}Update item fields (title, description, status, priority, dueDate, tags). On a data board the task fields (status, priority, dueDate, tags) are hidden: its columns, status included, are set with set_cell.
| Argument | Type | Description |
|---|---|---|
| tags | array | Tags as an array of strings |
| title | string | Item title, shown as the row name |
| itemId* | string | Item (row) id |
| status | string | Task status of the row on a task board: todo, in_progress, review or done. Refused on a data board, where it would only write a hidden task field: set that board's status column with cells (create_item) or set_cell (update_item) instead |
| boardId* | string | Board id (from list_boards / create_board) |
| dueDate | string | Due date, ISO 8601 (YYYY-MM-DD or full timestamp) |
| priority | string | Priority: low, medium, high or urgent |
| projectId* | string | Project id (from list_projects / create_project) |
| description |
| organizationId | string | Organization id; needed only when the account belongs to several (the error then lists them) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"project",
"boards"
],
"properties": {
"api": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "App name; defaults to \"<project> API\""
},
"methods": {
"type": "array",
"items": {
"enum": [
"GET",
"POST",
"PATCH",
"DELETE"
],
"type": "string"
},
"description": "HTTP methods every endpoint accepts; defaults to all four"
},
"rowLevelSecurity": {
"type": "boolean",
"description": "true when the app has its own users and each may see only their rows (the caller then sends X-App-User): every endpoint gets mode \"owner\", except a board that carries its own rowLevelSecurity. For shared, phone or relation modes set rowLevelSecurity on the board itself"
}
},
"description": "Include to publish a REST API over every board and mint a key; omit for a boards-only build",
"additionalProperties": false
},
"boards": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"columns"
],
"properties": {
"kind": {
"enum": [
"tasks",
"data"
],
"type": "string",
"description": "\"data\" (default here): a plain table with only the columns you define, right for customers, products, orders, payments. \"tasks\": also the built-in task columns (status, priority, assignee, due date, tags), only for boards where people track work to do."
},
"name": {
"type": "string",
"description": "Board (table) name, e.g. \"Repair Orders\""
},
"rows": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": {}
},
"description": "Optional sample rows keyed by column name, e.g. [{ \"Customer\": \"Sam Miller\", \"Phone\": \"052-555-0142\", \"Price\": 80 }]. \"title\" sets the row title; without it the first plain text value is used, and failing that the row is named after its board and position. A row that other boards reference must carry a title (or a text value) so the reference can be resolved. A relation cell takes the title(s) of rows in the related board (any order in the spec; rows are created in dependency order)."
},
"columns": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"type"
],
"properties": {
"name": {
"type": "string",
"description": "Column name as the user would say it, e.g. \"Customer\", \"Phone\", \"Repair Status\""
},
"type": {
"type": "string",
"description": "text, rich_text, number, currency, date, datetime, phone, email, link, checkbox, dropdown, status, priority, rating, file, people, relation, label, duration"
},
"alias": {
"type": "string",
"description": "API field name to use instead of the derived one (letters, digits, underscore; not a reserved item field)"
},
"options": {
"type": "array",
"items": {
"type": "string"
},
"description": "The closed choices for dropdown/status/priority, e.g. [\"Received\",\"In Repair\",\"Ready\",\"Completed\"]"
},
"required": {
"type": "boolean",
"description": "Reject API creates that leave it blank"
},
"settings": {
"type": "object",
"description": "Other type settings, e.g. { currency: \"ILS\" }. (relatedBoardName / relationType are also accepted here for compatibility.)",
"additionalProperties": {}
},
"validation": {
"type": "object",
"description": "{ unique, min, max, minLength, maxLength, pattern, patternMessage }",
"additionalProperties": {}
},
"relatedBoard": {
"type": "string",
"description": "relation columns only: the name of another board in this spec that this column links to, e.g. \"Customers\""
},
"relationType": {
"enum": [
"many_to_one",
"one_to_many",
"many_to_many",
"one_to_one"
],
"type": "string",
"description": "relation columns only. many_to_one: many rows here point at one row there (an order has one customer; a payment has one order). one_to_many: one row here owns many there. many_to_many: both sides several (a job has several tags). one_to_one: exactly one each way. Defaults to many_to_many, which is rarely what a business model means, say it."
}
},
"additionalProperties": false
},
"minItems": 1,
"description": "Typed columns of the board"
},
"description": {
"type": "string",
"description": "One line on what a row is"
},
"rowLevelSecurity": {
"type": "object",
"properties": {
"mode": {
"enum": [
"owner",
"shared",
"phone",
"relation",
"policy"
],
"type": "string",
"description": "\"owner\" (default): each user sees and edits only the rows they created. \"shared\": every user authorized on the app (on its access list, or an owner, admin or editor of the organization) sees and edits every row; the mode for an admin screen or a team system. Anyone else who signs in is refused with 403, so put the people who run the app on the list with add_app_user (their phone and a role; it works before their first sign-in). \"phone\": a user signed in with a code sent to their phone sees and edits only the rows whose phoneColumn holds that phone, e.g. a directory where each person keeps their own card, or the Coaches board itself in a coaching app (each coach reads and edits his own row; a POST writes his verified phone into the row whatever the body says). \"relation\": each user reaches the rows whose relationColumn points at the row that stands for them, e.g. a Trainees board whose \"Coach\" relation column points at the Coaches board: a coach sees only his trainees. A relation endpoint never returns the row that IS the user, only rows pointing at it, so expose the identity board itself through a second endpoint in mode \"phone\". In relation mode a new row is linked to the caller by the server, the link cannot be moved with PATCH, and a user who stands for no row gets an empty list on GET and 403 on POST. \"policy\": the endpoint follows the access policy of its board (set_board_policy): business roles (define_app_role and grant_app_role, or set_policy_identity), row scope per role, per-column read and write rules. It takes no other rowLevelSecurity field; the board needs a policy and the users need roles, so test with explain_access and simulate_request"
},
"enabled": {
"type": "boolean",
"description": "Defaults to true; false leaves this endpoint without row-level security"
},
"viaColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: one more hop. A RELATION column on the board that relationColumn points to, leading to the board of the caller's own items. Example: a Weigh-ins endpoint with relationColumn = Weigh-ins.\"Trainee\" and viaColumn = Trainees.\"Coach\" lets a coach reach the weigh-ins of all his trainees. For the trainee herself, make a second endpoint on the same board with relationColumn = \"Trainee\" and no viaColumn. The NAME of a relation column of the board relationColumn points to"
},
"singleLink": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true gives each row of this endpoint's board to ONE linked user. Once someone is linked to a row, another person redeeming an invite code for the same row is refused (the sign-up answers inviteRedeemed: false with inviteError \"INVITE_ROW_TAKEN\"), so a coach cannot become a trainee's row from a second account. Whoever is already linked is not affected, and the app owner can still link by hand (link_app_user). Set it on the endpoint of the board whose rows are invited to, e.g. Trainees"
},
"editOwnOnly": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true lets everyone the relation reaches READ a row, while only the user who created it may PATCH or DELETE it, or change its files (others get 403 with code ROW_NOT_YOURS). For rows two people both see but only one of them owns, e.g. a trainee's own log that her coach reads"
},
"emailColumn": {
"type": "string",
"description": "mode \"phone\" only, optional, next to phoneColumn: a column that holds each row's email. A user whose email was proved by a login code also reaches the rows that carry that address; for people whose number takes no SMS (outside Israel the code goes by email, which proves the email, not the phone). The NAME of a column of this board in the spec"
},
"phoneColumn": {
"type": "string",
"description": "mode \"phone\" only, required there: the column that holds each row's phone number. The NAME of a column of this board in the spec"
},
"allowInvites": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true lets a user of the app mint an invite code for a row they reach through this endpoint (POST /apps/{appSlug}/api/{endpointSlug}/{itemId}/invites with body { maxUses?, expiresInDays?, label? }; the endpoint must also allow POST). A coach invites a trainee to the trainee's own row; whoever signs up with the code is linked to that row. Such an invite never grants an access role. Without it only an owner or admin creates invites (create_app_invite)"
},
"relationColumn": {
"type": "string",
"description": "mode \"relation\" only, required there: a RELATION column on this endpoint's board. A row belongs to the caller when this column points at an item that stands for the caller (or, with viaColumn, at an item that points at one). Example: on the Trainees board, the \"Coach\" column. The NAME of a relation column of this board in the spec"
},
"identityEmailColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: like identityPhoneColumn, for an email column and a user whose email was verified by a login code. The NAME of a column of that board in the spec"
},
"identityPhoneColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: a phone column on the board where the caller's own items live (the board relationColumn points to, or with viaColumn the board viaColumn points to). A user whose VERIFIED phone (sign-in by a code sent to that phone) is written in a row there stands for that row, with no invite and no link. Example: Coaches.\"Phone\", so a coach who signed in by phone is his own Coaches row at once. Whoever may write that column decides who the row is, so expose it readOnly wherever it must not move. The NAME of a column of that board in the spec"
}
},
"description": "Row-level security of this board's endpoint, used only when \"api\" is given; overrides api.rowLevelSecurity for this board. Columns are given by NAME as written in this spec (the ids do not exist yet). Only the keys listed here exist; an unknown key is refused, not ignored",
"additionalProperties": false
}
},
"additionalProperties": false
},
"minItems": 1,
"description": "The boards (tables) of the backend, in any order"
},
"project": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Project name, e.g. \"Bike Repair Shop\""
},
"description": {
"type": "string",
"description": "One line on what the system is for"
}
},
"description": "The project that holds the boards",
"additionalProperties": false
},
"organizationId": {
"type": "string",
"description": "Organization id; needed only when the account belongs to several (the error then lists them)"
}
},
"additionalProperties": false
}{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"set": {
"type": "object",
"description": "Keys to merge into the settings, e.g. { passwordReset: { returnUrls: [\"myapp://reset\"] } } or { endUserDeletion: { rows: \"delete\" } }. null removes a key: { language: null }. Omit to read without changing anything",
"additionalProperties": {}
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}| organizationId | string | Defaults to the credential organization |
| registrationPolicy | string | How external sign-ups are admitted: open, approval, invite (only with an invite code) or closed |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"appLoginUrl": {
"type": "string",
"description": "https URL of your app's login page for external users; \"\" clears it"
},
"organizationId": {
"type": "string",
"description": "Defaults to the credential organization"
},
"registrationPolicy": {
"enum": [
"closed",
"approval",
"open",
"invite"
],
"type": "string",
"description": "How external sign-ups are admitted: open, approval, invite (only with an invite code) or closed"
}
},
"additionalProperties": false
}| Board id (from list_boards / create_board) |
| allowedMethods | array | HTTP methods the endpoint accepts: GET, POST, PATCH, DELETE |
| exposedColumns | array | Columns the endpoint reads and writes, with the JSON key each one gets; without it the endpoint returns bare metadata |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
| rowLevelSecurity | object | Row-level security. Off: whoever holds the app key reads everything. On: every request must name a signed-in user, and mode decides which rows they reach. Only the keys listed here exist; an unknown key is refused, not ignored |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"boardId",
"slug",
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"slug": {
"type": "string",
"description": "URL slug: lowercase letters, digits and dashes"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"allowedMethods": {
"type": "array",
"items": {
"enum": [
"GET",
"POST",
"PATCH",
"DELETE"
],
"type": "string"
},
"description": "HTTP methods the endpoint accepts: GET, POST, PATCH, DELETE"
},
"exposedColumns": {
"type": "array",
"items": {
"type": "object",
"required": [
"columnId"
],
"properties": {
"alias": {
"type": "string",
"description": "JSON key exposed for this column: letters, digits, underscore. Never one of the reserved item fields id, title, description, status, priority, dueDate, assignedTo, createdAt, updatedAt, order, appUserId, a business status column becomes repairStatus or orderStatus, not status."
},
"columnId": {
"type": "string",
"description": "Column id (from get_board_schema)"
},
"readOnly": {
"type": "boolean",
"description": "Expose the column for reading only; writes to it are refused with 400"
}
},
"additionalProperties": false
},
"description": "Columns the endpoint reads and writes, with the JSON key each one gets; without it the endpoint returns bare metadata"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
},
"rowLevelSecurity": {
"type": "object",
"required": [
"enabled"
],
"properties": {
"mode": {
"enum": [
"owner",
"shared",
"phone",
"relation",
"policy"
],
"type": "string",
"description": "\"owner\" (default): each user sees and edits only the rows they created. \"shared\": every user authorized on the app (on its access list, or an owner, admin or editor of the organization) sees and edits every row; the mode for an admin screen or a team system. Anyone else who signs in is refused with 403, so put the people who run the app on the list with add_app_user (their phone and a role; it works before their first sign-in). \"phone\": a user signed in with a code sent to their phone sees and edits only the rows whose phoneColumn holds that phone, e.g. a directory where each person keeps their own card, or the Coaches board itself in a coaching app (each coach reads and edits his own row; a POST writes his verified phone into the row whatever the body says). \"relation\": each user reaches the rows whose relationColumn points at the row that stands for them, e.g. a Trainees board whose \"Coach\" relation column points at the Coaches board: a coach sees only his trainees. A relation endpoint never returns the row that IS the user, only rows pointing at it, so expose the identity board itself through a second endpoint in mode \"phone\". In relation mode a new row is linked to the caller by the server, the link cannot be moved with PATCH, and a user who stands for no row gets an empty list on GET and 403 on POST. \"policy\": the endpoint follows the access policy of its board (set_board_policy): business roles (define_app_role and grant_app_role, or set_policy_identity), row scope per role, per-column read and write rules. It takes no other rowLevelSecurity field; the board needs a policy and the users need roles, so test with explain_access and simulate_request"
},
"enabled": {
"type": "boolean",
"description": "true: every request must carry a signed-in user (the token from sign-in, or the app key with X-App-User)"
},
"viaColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: one more hop. A RELATION column on the board that relationColumn points to, leading to the board of the caller's own items. Example: a Weigh-ins endpoint with relationColumn = Weigh-ins.\"Trainee\" and viaColumn = Trainees.\"Coach\" lets a coach reach the weigh-ins of all his trainees. For the trainee herself, make a second endpoint on the same board with relationColumn = \"Trainee\" and no viaColumn. A column id (get_board_schema of that other board)"
},
"singleLink": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true gives each row of this endpoint's board to ONE linked user. Once someone is linked to a row, another person redeeming an invite code for the same row is refused (the sign-up answers inviteRedeemed: false with inviteError \"INVITE_ROW_TAKEN\"), so a coach cannot become a trainee's row from a second account. Whoever is already linked is not affected, and the app owner can still link by hand (link_app_user). Set it on the endpoint of the board whose rows are invited to, e.g. Trainees"
},
"editOwnOnly": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true lets everyone the relation reaches READ a row, while only the user who created it may PATCH or DELETE it, or change its files (others get 403 with code ROW_NOT_YOURS). For rows two people both see but only one of them owns, e.g. a trainee's own log that her coach reads"
},
"emailColumn": {
"type": "string",
"description": "mode \"phone\" only, optional, next to phoneColumn: a column that holds each row's email. A user whose email was proved by a login code also reaches the rows that carry that address; for people whose number takes no SMS (outside Israel the code goes by email, which proves the email, not the phone). A column id (get_board_schema)"
},
"phoneColumn": {
"type": "string",
"description": "mode \"phone\" only, required there: the column that holds each row's phone number. A column id (get_board_schema)"
},
"allowInvites": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true lets a user of the app mint an invite code for a row they reach through this endpoint (POST /apps/{appSlug}/api/{endpointSlug}/{itemId}/invites with body { maxUses?, expiresInDays?, label? }; the endpoint must also allow POST). A coach invites a trainee to the trainee's own row; whoever signs up with the code is linked to that row. Such an invite never grants an access role. Without it only an owner or admin creates invites (create_app_invite)"
},
"relationColumn": {
"type": "string",
"description": "mode \"relation\" only, required there: a RELATION column on this endpoint's board. A row belongs to the caller when this column points at an item that stands for the caller (or, with viaColumn, at an item that points at one). Example: on the Trainees board, the \"Coach\" column. A column id (get_board_schema)"
},
"identityEmailColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: like identityPhoneColumn, for an email column and a user whose email was verified by a login code. A column id (get_board_schema of that board)"
},
"identityPhoneColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: a phone column on the board where the caller's own items live (the board relationColumn points to, or with viaColumn the board viaColumn points to). A user whose VERIFIED phone (sign-in by a code sent to that phone) is written in a row there stands for that row, with no invite and no link. Example: Coaches.\"Phone\", so a coach who signed in by phone is his own Coaches row at once. Whoever may write that column decides who the row is, so expose it readOnly wherever it must not move. A column id (get_board_schema of that board)"
}
},
"description": "Row-level security. Off: whoever holds the app key reads everything. On: every request must name a signed-in user, and mode decides which rows they reach. Only the keys listed here exist; an unknown key is refused, not ignored",
"additionalProperties": false
}
},
"additionalProperties": false
}| Id of the row the new user becomes (from query_items); any live row in the app's organization. Required unless role is given |
| maxUses | integer | How many people may use the code, 1 to 1000; defaults to 1 (one person) |
| expiresInDays | number | Days until the code stops working, 1 to 365; defaults to 30 |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"role": {
"enum": [
"viewer",
"editor",
"submitter"
],
"type": "string",
"description": "App-level access role granted on sign-up: viewer (reads), submitter (creates), editor (reads and writes). Omit to grant no access row. Required unless itemId is given"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"label": {
"type": "string",
"maxLength": 120,
"description": "Shown to whoever checks the code before signing up, e.g. \"Dana, trainee of coach Avi\"; up to 120 characters. Do not put anything private in it: the check is public"
},
"itemId": {
"type": "string",
"description": "Id of the row the new user becomes (from query_items); any live row in the app's organization. Required unless role is given"
},
"maxUses": {
"type": "integer",
"maximum": 1000,
"minimum": 1,
"description": "How many people may use the code, 1 to 1000; defaults to 1 (one person)"
},
"expiresInDays": {
"type": "number",
"maximum": 365,
"minimum": 1,
"description": "Days until the code stops working, 1 to 365; defaults to 30"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable name |
| actions* | array | e.g. [{ type: "http_request", config: { url: "https://api.frankfurter.app/latest?from=USD&to=ILS", method: "GET", responseMapping: [{ path: "rates.ILS", columnId: "<column id from get_board_schema>" }] } }] |
| boardId* | string | Board id (from list_boards / create_board) |
| trigger* | string | Event that starts the automation: item_created, status_changed, column_value_changed, date_approaching, or scheduled (checked hourly; an interval in hours and an optional hour of the day in UTC, not a cron expression) |
| isActive | boolean | Whether it is active |
| projectId* | string | Project id (from list_projects / create_project) |
| conditions | array | Run only for rows that match, e.g. [{ field: "<column id>", operator: "equals", value: "New seller" }] |
| triggerConfig | object | For scheduled: { intervalHours?: number (default 24), runAtHour?: 0-23 in UTC }, e.g. { intervalHours: 1 } for every hour, or { runAtHour: 5, intervalHours: 23 } for once a day at 05:00 UTC. The interval is measured from the previous run, which ends a little after the hour, so with runAtHour use 23, not 24: with 24 the next day's check falls just short and the run slips a day. A cron field is not read. For column_value_changed: { columnName } |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"name",
"trigger",
"actions"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"actions": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"config"
],
"properties": {
"type": {
"type": "string",
"description": "Action type: http_request, send_notification, send_email, send_push, change_status, set_column_value, create_cross_board_item, send_webhook, send_whatsapp, delay"
},
"config": {
"type": "object",
"description": "Action-specific config, e.g. { url, method, headers, responseMapping } for http_request, { title, body, recipientsFromRelation, includeRowOwner, userIds, data, sound, badge, dataOnly } for send_push, or { to, subject, body, kind: \"transactional\" | \"marketing\", attachments: [\"<file column id>\"] } for send_email",
"additionalProperties": {}
}
},
"additionalProperties": false
},
"description": "e.g. [{ type: \"http_request\", config: { url: \"https://api.frankfurter.app/latest?from=USD&to=ILS\", method: \"GET\", responseMapping: [{ path: \"rates.ILS\", columnId: \"<column id from get_board_schema>\" }] } }]"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"trigger": {
"enum": [
"item_created",
"status_changed",
"column_value_changed",
"date_approaching",
"scheduled"
],
"type": "string",
"description": "Event that starts the automation: item_created, status_changed, column_value_changed, date_approaching, or scheduled (checked hourly; an interval in hours and an optional hour of the day in UTC, not a cron expression)"
},
"isActive": {
"type": "boolean",
"description": "Whether it is active"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"conditions": {
"type": "array",
"items": {
"type": "object",
"required": [
"field",
"operator"
],
"properties": {
"field": {
"type": "string",
"description": "A column id on this board (from get_board_schema), or status, priority, title"
},
"value": {
"description": "The value to compare with"
},
"operator": {
"type": "string",
"description": "equals, not_equals, contains, not_contains, is_empty, is_not_empty, greater_than, less_than"
}
},
"additionalProperties": false
},
"description": "Run only for rows that match, e.g. [{ field: \"<column id>\", operator: \"equals\", value: \"New seller\" }]"
},
"triggerConfig": {
"type": "object",
"description": "For scheduled: { intervalHours?: number (default 24), runAtHour?: 0-23 in UTC }, e.g. { intervalHours: 1 } for every hour, or { runAtHour: 5, intervalHours: 23 } for once a day at 05:00 UTC. The interval is measured from the previous run, which ends a little after the hour, so with runAtHour use 23, not 24: with 24 the next day's check falls just short and the run slips a day. A cron field is not read. For column_value_changed: { columnName }",
"additionalProperties": {}
}
},
"additionalProperties": false
}| string |
| Project id (from list_projects / create_project) |
| isRequired | boolean | Require a non-blank value on every App API create |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"name",
"type"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"type": {
"type": "string",
"description": "Action type: http_request, send_notification, send_email, send_whatsapp, change_status, set_column_value, create_cross_board_item, send_webhook or delay"
},
"force": {
"type": "boolean",
"description": "Create the column even when the name suggests a different type"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"settings": {
"type": "object",
"description": "Type-specific settings. For dropdown/status/priority: options, either as labels [\"A\",\"B\"] or as full objects [{value,label,color}], labels are expanded server-side, and colors are assigned if you do not supply them.",
"additionalProperties": {}
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"isRequired": {
"type": "boolean",
"description": "Require a non-blank value on every App API create"
}
},
"additionalProperties": false
}| description |
| string |
| Free-text description |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"title"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags as an array of strings"
},
"cells": {
"type": "object",
"description": "Cell values keyed by column id: { \"<columnId>\": value }. Scalars, { amount, currency } for currency, { relatedItemIds: [...] } for relations",
"additionalProperties": {}
},
"title": {
"type": "string",
"description": "Item title, shown as the row name"
},
"status": {
"type": "string",
"description": "Task status of the row on a task board: todo, in_progress, review or done. Refused on a data board, where it would only write a hidden task field: set that board's status column with cells (create_item) or set_cell (update_item) instead"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"dueDate": {
"type": "string",
"description": "ISO date"
},
"priority": {
"type": "string",
"description": "Priority: low, medium, high or urgent"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"description": {
"type": "string",
"description": "Free-text description"
}
},
"additionalProperties": false
}| fromAppId | string | Deploy a version that is already hosted, copied on the server: another app in the same organization (start a new app from it), or this same app (bring an old version back as a new one). Nothing passes through the conversation, so any size works |
| fromVersion | integer | With fromAppId: which version to copy (from list_deployments). Default: the live one |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"dir": {
"type": "string",
"description": "Local path to the BUILD OUTPUT directory (the one containing index.html), not the project root. Only where the MCP runs on the same machine as the files"
},
"appId": {
"type": "string",
"description": "App UUID or slug (app-xxxxxx), see list_apps"
},
"files": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"content"
],
"properties": {
"path": {
"type": "string",
"description": "Path inside the site, e.g. \"index.html\", \"app.js\", \"css/style.css\""
},
"content": {
"type": "string",
"description": "File content. Text as-is; binary as base64 with encoding \"base64\""
},
"encoding": {
"enum": [
"utf8",
"base64"
],
"type": "string",
"description": "Default utf8"
}
},
"additionalProperties": false
},
"maxItems": 500,
"description": "The site files inline. Must include index.html. Up to 500 files / 8MB decoded, right for a frontend written in the conversation"
},
"zipUrl": {
"type": "string",
"format": "uri",
"description": "Public https URL of a zip of the BUILD OUTPUT (index.html at the root, or inside a single top-level folder). Up to 50MB"
},
"fromAppId": {
"type": "string",
"description": "Deploy a version that is already hosted, copied on the server: another app in the same organization (start a new app from it), or this same app (bring an old version back as a new one). Nothing passes through the conversation, so any size works"
},
"fromVersion": {
"type": "integer",
"description": "With fromAppId: which version to copy (from list_deployments). Default: the live one",
"exclusiveMinimum": 0
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"paths": {
"type": "array",
"items": {
"type": "string"
},
"description": "Only these files, as listed by a previous call, e.g. [\"index.html\", \"css/site.css\"]"
},
"version": {
"type": "integer",
"description": "Version to read (from list_deployments). Default: the live version",
"exclusiveMinimum": 0
},
"includeContent": {
"type": "boolean",
"description": "false lists the files without their text, a cheap first look at a large site. Default true"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}| boardId* | string | Board id (from list_boards / create_board) |
| archived | string | Which rows to include. Default active |
| priority | string | Only rows with one of these priorities, comma separated (task boards only) |
| projectId* | string | Project id (from list_projects / create_project) |
| excludeStatus | string | Only rows whose status is NOT one of these, comma separated, resolved like status. The way to ask for everything that is not done: excludeStatus "done" (task board) or "Completed" (a data board with that option). Rows with no status at all are kept. A board without a status column is handled as for status: an error, or a filter here on a dropdown named status/סטטוס/מצב |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId"
],
"properties": {
"page": {
"type": "integer",
"description": "1-based page, only with limit",
"exclusiveMinimum": 0
},
"sort": {
"type": "string",
"description": "Sort by title, createdAt, updatedAt or status; prefix with \"-\" for descending, e.g. \"-createdAt\" for newest first. Anything else keeps the board order"
},
"limit": {
"type": "integer",
"maximum": 500,
"description": "Page size; omit to fetch all items",
"exclusiveMinimum": 0
},
"search": {
"type": "string",
"description": "Free text; matches the row title and its text cells"
},
"status": {
"type": "string",
"description": "Only rows whose status is one of these, comma separated. Matched against the board's status column by option value or label, case-insensitive: \"todo,in_progress\" on a task board, \"Received,In Repair\" on a data board whose status column lists those (get_board_schema shows the options). Needs a status column. A board with none (no column of type status) gets an error that lists its dropdown columns, instead of unfiltered rows. A board whose status is a dropdown named status/סטטוס/מצב is filtered here on that dropdown, after fetching, so an explicit limit can give a page with fewer rows (the answer says so)"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"archived": {
"enum": [
"active",
"archived",
"all"
],
"type": "string",
"description": "Which rows to include. Default active"
},
"priority": {
"type": "string",
"description": "Only rows with one of these priorities, comma separated (task boards only)"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"excludeStatus": {
"type": "string",
"description": "Only rows whose status is NOT one of these, comma separated, resolved like status. The way to ask for everything that is not done: excludeStatus \"done\" (task board) or \"Completed\" (a data board with that option). Rows with no status at all are kept. A board without a status column is handled as for status: an error, or a filter here on a dropdown named status/סטטוס/מצב"
}
},
"additionalProperties": false
}| clientPhone |
| string |
| Recorded with the request |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"itemId"
],
"properties": {
"itemId": {
"type": "string",
"description": "Item (row) the files belong to, from query_items / create_item. Make the row first if the material has no home yet"
},
"message": {
"type": "string",
"description": "What to upload, in the words the recipient will read: \"the four room photos and the price list\""
},
"maxFiles": {
"type": "integer",
"maximum": 50,
"minimum": 1,
"description": "How many files the link accepts before it stops. Default 10"
},
"clientName": {
"type": "string",
"description": "Who is being asked, shown on the upload page"
},
"expiryDays": {
"type": "integer",
"maximum": 90,
"minimum": 1,
"description": "How long the link lives. Default 7 days"
},
"clientEmail": {
"type": "string",
"format": "email",
"description": "Send the link to this address. Omit to get the link back and pass it on yourself"
},
"clientPhone": {
"type": "string",
"description": "Recorded with the request"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId"
],
"properties": {
"role": {
"enum": [
"viewer",
"editor",
"submitter"
],
"type": "string",
"description": "App-level access role: editor (reads and writes), viewer (reads), submitter (creates). Omit to keep the current one"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"userId": {
"type": "string",
"description": "The user's id (userId from list_app_users), a UUID; not their externalId"
},
"isActive": {
"type": "boolean",
"description": "false switches the user off, true switches them back on. Omit to keep the current state"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}| Argument | Type | Description |
|---|---|---|
| appId* | string | App id or slug (from list_apps / create_app) |
| policy* | object | The policy document as an object (not a string), e.g. { "schemaVersion": 1, "rows": { ... } } |
| boardId* | string | Board id (from list_boards) |
| organizationId | string | Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"boardId",
"policy"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"policy": {
"type": "object",
"description": "The policy document as an object (not a string), e.g. { \"schemaVersion\": 1, \"rows\": { ... } }",
"additionalProperties": {}
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}| organizationId |
| string |
| Organization id; defaults to the credential organization when omitted |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"userId",
"endpoint"
],
"properties": {
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"action": {
"type": "string",
"description": "Name of a policy action to try on itemId (needs itemId) instead of a plain method"
},
"itemId": {
"type": "string",
"description": "The row the request is about (PATCH, DELETE, single GET)"
},
"method": {
"enum": [
"GET",
"POST",
"PATCH",
"PUT",
"DELETE"
],
"type": "string",
"description": "HTTP method of the request. Pass this or action"
},
"userId": {
"type": "string",
"description": "The app user the request is made as (from list_app_users)"
},
"bodyKeys": {
"type": "array",
"items": {
"type": "string"
},
"description": "Field or column keys the request body would write"
},
"endpoint": {
"type": "string",
"description": "Endpoint slug (from list_app_endpoints)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
}
},
"additionalProperties": false
}{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appId",
"endpointId"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"slug": {
"type": "string",
"description": "URL slug: lowercase letters, digits and dashes"
},
"appId": {
"type": "string",
"description": "App id or slug (from list_apps / create_app)"
},
"isActive": {
"type": "boolean",
"description": "Whether it is active"
},
"endpointId": {
"type": "string",
"description": "Endpoint id (from list_app_endpoints)"
},
"allowedMethods": {
"type": "array",
"items": {
"enum": [
"GET",
"POST",
"PATCH",
"DELETE"
],
"type": "string"
},
"description": "HTTP methods the endpoint accepts: GET, POST, PATCH, DELETE"
},
"exposedColumns": {
"type": "array",
"items": {
"type": "object",
"required": [
"columnId"
],
"properties": {
"alias": {
"type": "string",
"description": "JSON key exposed for this column: letters, digits, underscore. Never one of the reserved item fields id, title, description, status, priority, dueDate, assignedTo, createdAt, updatedAt, order, appUserId, a business status column becomes repairStatus or orderStatus, not status."
},
"columnId": {
"type": "string",
"description": "Column id (from get_board_schema)"
},
"readOnly": {
"type": "boolean",
"description": "Expose the column for reading only; writes to it are refused with 400"
}
},
"additionalProperties": false
},
"description": "Replacement list of exposed columns (same shape as create_app_endpoint)"
},
"organizationId": {
"type": "string",
"description": "Organization id; defaults to the credential organization when omitted"
},
"rowLevelSecurity": {
"anyOf": [
{
"type": "object",
"required": [
"enabled"
],
"properties": {
"mode": {
"enum": [
"owner",
"shared",
"phone",
"relation",
"policy"
],
"type": "string",
"description": "\"owner\" (default): each user sees and edits only the rows they created. \"shared\": every user authorized on the app (on its access list, or an owner, admin or editor of the organization) sees and edits every row; the mode for an admin screen or a team system. Anyone else who signs in is refused with 403, so put the people who run the app on the list with add_app_user (their phone and a role; it works before their first sign-in). \"phone\": a user signed in with a code sent to their phone sees and edits only the rows whose phoneColumn holds that phone, e.g. a directory where each person keeps their own card, or the Coaches board itself in a coaching app (each coach reads and edits his own row; a POST writes his verified phone into the row whatever the body says). \"relation\": each user reaches the rows whose relationColumn points at the row that stands for them, e.g. a Trainees board whose \"Coach\" relation column points at the Coaches board: a coach sees only his trainees. A relation endpoint never returns the row that IS the user, only rows pointing at it, so expose the identity board itself through a second endpoint in mode \"phone\". In relation mode a new row is linked to the caller by the server, the link cannot be moved with PATCH, and a user who stands for no row gets an empty list on GET and 403 on POST. \"policy\": the endpoint follows the access policy of its board (set_board_policy): business roles (define_app_role and grant_app_role, or set_policy_identity), row scope per role, per-column read and write rules. It takes no other rowLevelSecurity field; the board needs a policy and the users need roles, so test with explain_access and simulate_request"
},
"enabled": {
"type": "boolean",
"description": "true: every request must carry a signed-in user (the token from sign-in, or the app key with X-App-User)"
},
"viaColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: one more hop. A RELATION column on the board that relationColumn points to, leading to the board of the caller's own items. Example: a Weigh-ins endpoint with relationColumn = Weigh-ins.\"Trainee\" and viaColumn = Trainees.\"Coach\" lets a coach reach the weigh-ins of all his trainees. For the trainee herself, make a second endpoint on the same board with relationColumn = \"Trainee\" and no viaColumn. A column id (get_board_schema of that other board)"
},
"singleLink": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true gives each row of this endpoint's board to ONE linked user. Once someone is linked to a row, another person redeeming an invite code for the same row is refused (the sign-up answers inviteRedeemed: false with inviteError \"INVITE_ROW_TAKEN\"), so a coach cannot become a trainee's row from a second account. Whoever is already linked is not affected, and the app owner can still link by hand (link_app_user). Set it on the endpoint of the board whose rows are invited to, e.g. Trainees"
},
"editOwnOnly": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true lets everyone the relation reaches READ a row, while only the user who created it may PATCH or DELETE it, or change its files (others get 403 with code ROW_NOT_YOURS). For rows two people both see but only one of them owns, e.g. a trainee's own log that her coach reads"
},
"emailColumn": {
"type": "string",
"description": "mode \"phone\" only, optional, next to phoneColumn: a column that holds each row's email. A user whose email was proved by a login code also reaches the rows that carry that address; for people whose number takes no SMS (outside Israel the code goes by email, which proves the email, not the phone). A column id (get_board_schema)"
},
"phoneColumn": {
"type": "string",
"description": "mode \"phone\" only, required there: the column that holds each row's phone number. A column id (get_board_schema)"
},
"allowInvites": {
"type": "boolean",
"description": "mode \"relation\" only, default false: true lets a user of the app mint an invite code for a row they reach through this endpoint (POST /apps/{appSlug}/api/{endpointSlug}/{itemId}/invites with body { maxUses?, expiresInDays?, label? }; the endpoint must also allow POST). A coach invites a trainee to the trainee's own row; whoever signs up with the code is linked to that row. Such an invite never grants an access role. Without it only an owner or admin creates invites (create_app_invite)"
},
"relationColumn": {
"type": "string",
"description": "mode \"relation\" only, required there: a RELATION column on this endpoint's board. A row belongs to the caller when this column points at an item that stands for the caller (or, with viaColumn, at an item that points at one). Example: on the Trainees board, the \"Coach\" column. A column id (get_board_schema)"
},
"identityEmailColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: like identityPhoneColumn, for an email column and a user whose email was verified by a login code. A column id (get_board_schema of that board)"
},
"identityPhoneColumn": {
"type": "string",
"description": "mode \"relation\" only, optional: a phone column on the board where the caller's own items live (the board relationColumn points to, or with viaColumn the board viaColumn points to). A user whose VERIFIED phone (sign-in by a code sent to that phone) is written in a row there stands for that row, with no invite and no link. Example: Coaches.\"Phone\", so a coach who signed in by phone is his own Coaches row at once. Whoever may write that column decides who the row is, so expose it readOnly wherever it must not move. A column id (get_board_schema of that board)"
}
},
"additionalProperties": false
},
{
"type": "null"
}
],
"description": "Replacement row-level security (same shape as create_app_endpoint); null turns it off. The object replaces the stored one whole, it is not merged: to change one field, read the current value with list_app_endpoints and send every field again (enabled, mode and the columns of that mode), or the ones left out are lost"
}
},
"additionalProperties": false
}| object |
| New trigger config, same shape as in create_automation (scheduled: { intervalHours, runAtHour in UTC }, no cron) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"automationId"
],
"properties": {
"name": {
"type": "string",
"description": "New name"
},
"actions": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"config"
],
"properties": {
"type": {
"type": "string",
"description": "Action type, as in create_automation"
},
"config": {
"type": "object",
"description": "Action-specific config",
"additionalProperties": {}
}
},
"additionalProperties": false
},
"description": "The full new list of actions (replaces the old one)"
},
"boardId": {
"type": "string",
"description": "Board id the automation belongs to"
},
"isActive": {
"type": "boolean",
"description": "false switches it off, true on"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"conditions": {
"type": "array",
"items": {
"type": "object",
"required": [
"field",
"operator"
],
"properties": {
"field": {
"type": "string",
"description": "A column id on this board (from get_board_schema), or status, priority, title"
},
"value": {
"description": "The value to compare with"
},
"operator": {
"type": "string",
"description": "equals, not_equals, contains, not_contains, is_empty, is_not_empty, greater_than, less_than"
}
},
"additionalProperties": false
},
"description": "Run only for rows that match, e.g. [{ field: \"<column id>\", operator: \"equals\", value: \"New seller\" }]"
},
"automationId": {
"type": "string",
"description": "Automation id (from list_automations)"
},
"triggerConfig": {
"type": "object",
"description": "New trigger config, same shape as in create_automation (scheduled: { intervalHours, runAtHour in UTC }, no cron)",
"additionalProperties": {}
}
},
"additionalProperties": false
}| boolean |
| Require a non-blank value on every App API create |
| description | string | Free-text description |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"columnId"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name"
},
"type": {
"type": "string",
"description": "New column type (same list as create_column)"
},
"force": {
"type": "boolean",
"description": "Skip the name/type sanity check"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"columnId": {
"type": "string",
"description": "Column id (from get_board_schema)"
},
"isHidden": {
"type": "boolean",
"description": "Hide the column in the TaskLite UI"
},
"settings": {
"type": "object",
"description": "Replaces the column settings, e.g. { options: [...] } for dropdown/status",
"additionalProperties": {}
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"isRequired": {
"type": "boolean",
"description": "Require a non-blank value on every App API create"
},
"description": {
"type": "string",
"description": "Free-text description"
}
},
"additionalProperties": false
}| string |
| Free-text description |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"boardId",
"itemId"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tags as an array of strings"
},
"title": {
"type": "string",
"description": "Item title, shown as the row name"
},
"itemId": {
"type": "string",
"description": "Item (row) id"
},
"status": {
"type": "string",
"description": "Task status of the row on a task board: todo, in_progress, review or done. Refused on a data board, where it would only write a hidden task field: set that board's status column with cells (create_item) or set_cell (update_item) instead"
},
"boardId": {
"type": "string",
"description": "Board id (from list_boards / create_board)"
},
"dueDate": {
"type": "string",
"description": "Due date, ISO 8601 (YYYY-MM-DD or full timestamp)"
},
"priority": {
"type": "string",
"description": "Priority: low, medium, high or urgent"
},
"projectId": {
"type": "string",
"description": "Project id (from list_projects / create_project)"
},
"description": {
"type": "string",
"description": "Free-text description"
}
},
"additionalProperties": false
}