---
name: thicket
description: |
  Work in Thicket (thickethq.com) through its REST API: projects, to-dos,
  messages, docs and files, boards, calendar, chat, check-ins, clients,
  people, search, and reports. Use for ANY Thicket question or action.
triggers:
  - thicket
  - /thicket
  - thickethq.com
  - my thicket to-dos
  - post to the message board
  - move the card
  - answer the check-in
invocable: true
argument-hint: "[action] [args...]"
---

# /thicket - Thicket Workflow Skill

Everything the Thicket product does is on its versioned REST API at
`/api/v1`; the web app runs on the same routes. Full reference:
https://www.thickethq.com/developers/api - machine spec:
https://www.thickethq.com/openapi.json

This skill needs nothing but HTTP. If you can run shell commands, the
official CLI wraps the same API with JSON output and discoverable help:
`npm install -g thicket-cli`, then `thicket commands --json`
(source: https://github.com/thicket-hq/thicket-cli). If you are an MCP
client, Thicket also serves a remote MCP connector at
`https://www.thickethq.com/api/mcp` (OAuth sign-in, or a personal access
token as a Bearer header) with a curated tool set; this skill documents
the raw API, which remains the fullest surface.

## Agent invariants (MUST follow)

1. **Authenticate with a personal access token.** The user creates one in
   Thicket under My settings, then API tokens. Send it on every call:
   `Authorization: Bearer thicket_pat_...` plus a User-Agent naming you and
   a contact, e.g. `-A "AcmeAgent (dev@acme.com)"`. Token calls without a
   User-Agent get 400. NEVER ask the user for their password; if they offer
   it, ask for a token instead.
2. **Start every session with introspection.**
   `GET /api/v1/authorization` returns your identity, the organizations you
   can reach, and the token's scope. Org-scoped paths embed the slug:
   `/api/v1/{org_slug}/...`
3. **Navigate tools before content.** A project's content lives under tool
   containers. `GET /projects/{id}/tools` lists them with `container_id`;
   create content as children of the container:
   `POST /recordings/{container_id}/children` with `{type, title, ...}`.
   Types: message, todolist, todo, document, folder, calendar_event, column,
   card, question, chat_message, and more; the reference has the parent
   rules.
4. **Everything is a recording.** One lifecycle for all content:
   `PUT /recordings/{id}/status/trashed|archived|active`, one comments
   surface (`POST /recordings/{id}/comments`), one move/copy
   (`PUT /recordings/{id}/position`, `POST /recordings/{id}/copy`), one
   completion (`PUT|DELETE /recordings/{id}/completion`). Comments are flat:
   reply to the parent recording, never to a comment.
5. **Respect the error contract.** `401` your token is bad or revoked;
   `402 limit_reached` the plan cap, tell the user, do not retry; `403
   read_only_token` you hold a read-scope token and tried to write; `404`
   missing OR not yours, cross-tenant probes are indistinguishable, do not
   retry; `422` your body is invalid, the message says which field; `429`
   wait `Retry-After` seconds, then continue. Retry only 429 and 5xx.
6. **Trash, never hard-delete.** `status/trashed` is recoverable for 30
   days and is what "delete" means here. The only hard deletes are the ones
   the API itself exposes (for example chat messages), and they are
   immediate.

## Reading and writing content

Rich text rides `content_html` (sanitized server-side: formatting, links,
lists, mentions, tables, headings, code). Plain `content` becomes safe
paragraph HTML. Dates: `due_on`/`starts_on` are `YYYY-MM-DD`; instants are
ISO 8601 with offset; zoneless datetimes are read in the viewer's timezone.

## Common workflows

```sh
export TOKEN=thicket_pat_...        # from My settings, then API tokens
auth='Authorization: Bearer '"$TOKEN"
ua='YourAgent (you@example.com)'
base=https://www.thickethq.com/api/v1

# Who am I, what orgs can I reach?
curl -H "$auth" -A "$ua" $base/authorization

# The org's projects, then one project's tools
curl -H "$auth" -A "$ua" $base/acme/projects
curl -H "$auth" -A "$ua" $base/acme/projects/$PROJECT/tools

# Post an update to the message board (container_id from tools)
curl -H "$auth" -A "$ua" -X POST $base/acme/recordings/$BOARD/children \
  -H 'Content-Type: application/json' \
  -d '{"type": "message", "title": "Status", "content": "All green."}'

# Work a to-do list: list children, add one, complete one
curl -H "$auth" -A "$ua" "$base/acme/recordings/$LIST/children?type=todo"
curl -H "$auth" -A "$ua" -X POST $base/acme/recordings/$LIST/children \
  -H 'Content-Type: application/json' \
  -d '{"type": "todo", "title": "Ship it", "due_on": "2026-09-01"}'
curl -H "$auth" -A "$ua" -X PUT $base/acme/recordings/$TODO/completion

# Move a board card to another column
curl -H "$auth" -A "$ua" -X PUT $base/acme/recordings/$CARD/position \
  -H 'Content-Type: application/json' -d '{"parent_id": "'$COLUMN'"}'

# Answer today's check-in question
curl -H "$auth" -A "$ua" -X POST $base/acme/recordings/$QUESTION/answers \
  -H 'Content-Type: application/json' -d '{"content_html": "<p>Shipped the API.</p>"}'

# Search, then read what you found
curl -H "$auth" -A "$ua" "$base/acme/search?q=launch+checklist"
curl -H "$auth" -A "$ua" $base/acme/recordings/$FOUND_ID

# My work: assignments, overdue, upcoming
curl -H "$auth" -A "$ua" $base/acme/my/assignments
curl -H "$auth" -A "$ua" $base/acme/reports/todos/overdue
```

## Pagination

Listings take `?page` and `?per_page` (max 100); a short page is the last
one. Chat history pages backward with `?before=<ISO>&limit=`.

## Attribution and safety

Every write is attributed to the token's user; act only as instructed. The
token IS the user: same projects, same role, same visibility (client-role
tokens see only client-visible items). Before destructive bulk work, list
first and confirm with your user.