Thicket API

• Base path: /api/v1. Org-scoped routes embed the organization slug: /api/v1/{org-slug}/…
• JSON uses snake_case keys, with no response envelope. Resources are returned directly.
• Errors come back as a consistent error object with conventional status codes: 400 malformed JSON, 401 not authenticated, 402 plan limit reached (limit_reached), 403 forbidden, 404 missing or not yours (cross-tenant probes are indistinguishable from missing), 422 validation, 429 rate limited (token traffic; honor Retry-After).
• Rich text: content fields accept plain text (stored as safe paragraph HTML); content_html fields accept rich HTML that is sanitized server-side: formatting, links, lists, @-mention spans, tables, headings h1–h4, code blocks, and inline images/audio restricted to Thicket's own attachment routes. Responses return the stored HTML.
• @-mentions: a mention span can name a person or a group; group mentions expand server-side into the group's current members. Mentions subscribe and notify only people with access to the project.
• Roles: owner, admin, member, client. Clients only see projects they were explicitly added to and, inside them, only recordings shared with clients (visible_to_clients: true).
• Tenancy. Every org-scoped request runs in a database transaction with row-level security set after membership verification. A valid session in one organization returns zero rows or 404 for anything in another.

HTTP/1.1 402 Payment Required

{
  "error": {
    "code": "limit_reached",
    "message": "Your plan's project limit has been reached."
  }
}

export THICKET_TOKEN=thicket_pat_...   # from My settings, then API tokens

# 1. Who am I, and which workspaces can I reach?
curl -H "Authorization: Bearer $THICKET_TOKEN" \
  -A "AcmeSync (dev@acme.com)" \
  https://www.thickethq.com/api/v1/authorization

# 2. Create a project (the slug comes from step 1)
curl -H "Authorization: Bearer $THICKET_TOKEN" \
  -A "AcmeSync (dev@acme.com)" \
  -X POST https://www.thickethq.com/api/v1/acme/projects \
  -H "Content-Type: application/json" \
  -d '{"name": "Website redesign"}'

• Endpoint: https://www.thickethq.com/api/mcp (Streamable HTTP; protocol revisions 2026-07-28 and 2025-11-25 are served statelessly, with no sticky sessions).
• OAuth 2.1: Authorization Code with PKCE. Discovery at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server; clients identify with a Client ID Metadata Document or dynamic registration (POST /api/oauth/register). Short-lived access tokens, rotating refresh tokens, and a consent screen that names the client and what it may do.
• Scopes: thicket.read and thicket.write. A read-only connection never sees the write tools at all.
• Tools: a curated set of 21 covering organizations, projects, search and fetch, to-dos, messages and comments, docs, schedule, boards, chat, and people. Writes require an idempotency key and updates carry a freshness precondition, so a retried or stale agent call cannot double-post or overwrite newer work. No billing, people-management, deletion, or file transfer tools, deliberately.
• Identity & audit: the connection is you: your organizations, project access, and role, enforced by the same row-level security as every other surface. Changes are attributed to your account, and each connection appears in My settings under Connected apps with its scope and last use. After you disconnect it, the next request is refused.
• PAT path: send Authorization: Bearer thicket_pat_... (with a User-Agent) to the same endpoint from clients that support custom headers, the MCP Inspector, or scripts. The token's read/full scope maps to the same tool visibility.
• Setup guide: Connect AI apps with MCP in the help center covers consent, permissions, data flow, troubleshooting, and revocation.

• OpenAPI spec: thickethq.com/openapi.json (OpenAPI 3.1, date-versioned) covers every route on this page, for code generation in any language.
• TypeScript SDK: github.com/thicket-hq/thicket-sdk (npm install thicket-sdk): bearer auth, retries with Retry-After, pagination, and types generated from the spec.
• Command line: github.com/thicket-hq/thicket-cli (npm install -g thicket-cli): the thicket command for terminals and agents. thicket auth login signs in through your browser and mints a personal access token; every command takes --json, and thicket commands --json is the machine-readable catalog.
• AI agents: the skill file at thickethq.com/thicket-SKILL.md teaches an agent the API's patterns up front. No SDK required; see Thicket for AI agents.
• MCP connector: compatible remote MCP clients connect at https://www.thickethq.com/api/mcp with OAuth or a personal access token; see the MCP connector section above.

• Page-numbered lists: timeline and report-style listings (project events, the account activity feed, search) take ?page= and ?per_page= (capped at 100; search defaults to 50).
• Cursor paging. Chat history pages backwards with a created-before cursor: ?before=<ISO timestamp>&limit= on the children listing.
• Sorting: children listings accept ?sort=created_at|updated_at with ?direction=asc|desc, plus filters ?type=, ?status=, ?completed=. Default order is position, then creation.
• Positions. Ordered surfaces (to-do lists, board columns, project tools) persist fractional position values; drop an item between two neighbors by sending the midpoint.

• Plan limits. Exceeding your plan returns 402 { code: "limit_reached" }. Free: 1 project, 20 people (clients included), 1 GB storage, 30-day chat history. Starter ($25/mo or $240/yr): 3 active projects, 20 people, 10 GB. Pro ($49/mo or $468/yr): unlimited projects and people, 50 GB. Pricing is per organization, never per seat.
• Uploads: files up to 50 MB per upload (multipart).
• Batch operations run through the bulk recordings endpoint, which accepts 1–100 ids per call.
• List sizes: per_page caps at 100 on paged listings.
• Rate limit: token traffic allows 50 requests per 10 seconds per token. Over the line you get 429 { code: "rate_limited" } with a Retry-After header in seconds. Build graceful 429 and 5xx retries into your integration from the start.

Access model: nobody, including owners and admins, has implicit access to a non-all-access project's content; membership or all_access is required. Owners alone may list everything and self-add. Tool keys: message_board, todos, folder (docs & files), schedule, board (Boards), chat. Move a project in or out of a folder via PATCH /projects/{id} with folder_id.

Correspondence threads are plain children: POST …/recordings/{clients_id}/children with type: client_correspondence.

Lines are children of the room: POST …/recordings/{chat_id}/children with type: chat_message; history pages back with the ?before= cursor. Only the author may edit a line (admins may delete, never rewrite); lines hard-delete and never enter the trash. Posting a public URL attaches a fetched link preview. Room subscribers are notified once per burst when a quiet room becomes active; @-mentions always notify.

Datetimes: starts_at/ends_at accept ISO 8601 with an explicit offset (meaning exactly that instant) or a zoneless wall clock interpreted in your time zone. Recurrence supports intervals, weekday sets, day-of-month or nth-weekday monthly modes, end dates, and an anchoring time zone so "every week at 10 PM" survives DST.

Templates never appear in project listings and don't count against the plan's project limit, but instantiating one enforces it.

"Stop notifications" for one thread is DELETE /recordings/{id}/subscription. Notification emails carry per-thread unsubscribe links, and quiet hours hold email (and mobile push) outside your working windows.

curl -b cookies.txt \
  "https://www.thickethq.com/api/v1/acme/search?q=homepage&type=todo"

Plans: Free ($0; 1 project, 20 people (clients included), 1 GB), Pro ($49/mo or $468/yr; unlimited projects and people, 50 GB). Per-organization pricing; no per-seat fees. Every new organization starts with a 30-day Pro trial, no card required.

Password, two-factor (TOTP + backup codes), and session management go through the auth endpoints (/api/auth/two-factor/*, /api/auth/change-password).