Thicket
Thicket

Developer API

Build on Thicket’s REST API: connect with OAuth or a personal access token, learn the conventions and limits, and find the full reference.

Thicket has a versioned REST API at /api/v1. The web app is built on the same service layer, so projects, to-dos, messages, docs and files, calendar events, cards, chat, people, search, reports, and more are all available to your scripts and integrations. The API is included on every plan, and you don't need to register or ask for approval to use it.

Authentication

For the CLI, run thicket auth login and approve access in your browser. The CLI uses OAuth, refreshes credentials automatically, and appears in My settings > Connected apps. A read-and-write connection still follows your role and project access. Use --scope read to approve read-only access.

Other integrations can use OAuth with PKCE and the resource https://www.thickethq.com/api/v1. See the authentication reference.

Scripts without a browser can use personal access tokens:

  1. In Thicket, open My settings > API tokens
  2. Create a token, choosing Read-only or Read and write, and copy it. It's shown only once
  3. Send it with every request as Authorization: Bearer <token>

A token works exactly as you: the same organizations, the same project access, the same permissions. Along with the token, every request must send a User-Agent header naming your app and a way to contact you, such as Acme Reports (ops@acme.example). Without one, the API answers 400 user_agent_required.

This example reads the token from a THICKET_TOKEN environment variable, so the token itself never appears in the command:

curl https://www.thickethq.com/api/v1/orgs \
  -H "Authorization: Bearer $THICKET_TOKEN" \
  -H "User-Agent: Acme Reports (ops@acme.example)"
  • A read-only token can only read. Requests that change something get 403 read_only_token.
  • Tokens can only be created and revoked while signed in to the web app, never with another token.
  • GET /api/v1/authorization describes the token you sent: who it belongs to, its access, when it expires, and the organizations it reaches, with your membership id and role in each.
  • Revoking a token in My settings > API tokens takes effect immediately.

For managing tokens, see Connected Apps and API Tokens.

The basics

  • Base URL: https://www.thickethq.com/api/v1. Routes that belong to an organization include its slug: /api/v1/{org-slug}/.... GET /api/v1/orgs lists your organizations and their slugs, and the slug is also in the address bar when you use Thicket (/o/{org-slug}).
  • Format: JSON with snake_case keys and no envelope.
  • Errors: { "error": { "code": "...", "message": "..." } } with conventional HTTP statuses. 401 means no valid credentials, 402 limit_reached means a plan limit, 403 means not allowed, 404 means missing or not yours, 422 means a validation problem, and 429 and 503 mean try again after the Retry-After seconds.
  • Tenancy: every request is scoped to an organization you belong to. Data from another organization answers 404, the same as something that doesn't exist.
  • Rich text: content fields take plain text. content_html fields take HTML, which Thicket cleans of anything it doesn't allow.
  • Attribution: anything created with a token shows your name with a small "via API" label in Thicket.

Limits

  • Rate limit: 50 requests every 10 seconds per token, and 50 every 10 seconds across all the tokens used from one network address. Over either, you get 429 rate_limited with a Retry-After header in seconds. Build retries for 429 and 5xx responses into your integration from the start.
  • Pages: listings such as activity, search and chat history answer with a Link header naming the next page, and leave it off on the last page. Follow that URL instead of building your own: it keeps your filters and holds your place, so nothing is skipped or repeated while new activity arrives. ?per_page= sets the page size (up to 100).
  • Uploads: up to 50 MB per file sent in one request. A file attached to a post can be up to 10 GB: reserve it on POST /attachments with JSON, upload the bytes straight to storage with the URLs it answers, then complete it. See the API reference.
  • Plan limits: the API can't create more than your plan allows; it answers 402 limit_reached instead.

Tools that save you work

Building an integration for others

If you're building a product or tool for other Thicket customers, use OAuth so each person can review and approve access in Thicket. Request the API resource with PKCE, store credentials securely, and support refresh and disconnection. The connection follows that person's current permissions. When your integration is live and you'd like it listed for other customers to find, email support@thickethq.com with what it does and a link.

Using an AI tool through the API or CLI

An AI tool can send the content it reads to its operator and AI providers. Their retention, review, training, and processing locations follow your or your organization's provider agreement and settings. Read-only access still shares information. Use only access you're authorized to grant, keep tokens in secure credential configuration, and review consequential actions. Revoking a token stops future requests using it; it doesn't erase external copies or undo earlier changes. See our Privacy Policy.

Full reference

The route-by-route reference is at thickethq.com/developers/api. It covers authentication, projects, content, people, the calendar, search, reports, and account routes.

Was this article helpful?