Developer API

Thicket API Overview

Thicket exposes a versioned REST API at /api/v1. It's the same surface the web app is built on, so anything you can do in the product has a corresponding API route: projects, to-dos, messages, documents, calendar events, cards, chats, people, search, and more.

The Basics

• Base path: /api/v1. Routes that belong to an organization include its slug: /api/v1/{org-slug}/...
• Format: JSON with snake_case keys
• Errors: returned as { "error": { "code": "...", "message": "..." } } with conventional HTTP status codes
• Tenancy: every request is scoped to your organization; you can never read another organization's data

Authentication

The API authenticates with personal access tokens. Create one under My settings → API tokens, then send it with every request as Authorization: Bearer <token>. The token works exactly as you: same workspaces, same project access, same permissions.

• Any member can create tokens for themselves; there is nothing to ask an admin for
• Pick read-only (the default) or read and write when you create one
• The token is shown once at creation. Store it somewhere safe
• Revoke a token any time from the same page; revocation takes effect immediately
• The web app's own session cookie also works on every route

The Command Line

Prefer a terminal? Install the official CLI with npm install -g thicket-cli, then run thicket auth login: it opens Thicket in your browser, you approve the device, and a personal access token is created for you. No password ever touches the CLI. From there, thicket projects, thicket todos --in "Project", and the rest of the commands cover the same API; thicket commands lists them all. The CLI is open source at github.com/thicket-hq/thicket-cli.

MCP for AI Apps

AI apps that speak MCP don't need you to copy a token: Thicket runs a remote MCP connector at https://www.thickethq.com/api/mcp. You approve the connection in your browser and manage it under My settings → Connected apps. See Connect ChatGPT and AI Apps to Thicket with MCP.

Using an AI Tool Through the API or CLI

An AI tool can send the content it reads to its operator and AI providers. Their retention, review, training, and processing locations follow your or your organization's provider agreement and settings. Read-only access still shares information. Use only access you are authorized to grant, keep tokens in secure credential configuration, and review consequential actions. Revoking a token stops future requests using it; it does not erase external copies or undo earlier changes. See our Privacy Policy.

Full Reference

The endpoint-by-endpoint reference lives at thickethq.com/developers/api, covering authentication, projects, content, people, calendar, search, and billing routes.