Tracker API

Authentication

Create a personal access token in your profile and send it as a bearer token. A token acts with its owner's role: viewers can only read, members and admins can change issues, and webhooks are for admins. Endpoints that change data also need the token's write ability.

export TRACKER=http://localhost:8100/api/v1
export TOKEN='...'
curl -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" $TRACKER/me

Conventions

Issue keys

AGENT-12, in any letter case. A leading # is ignored, and the numeric id works too.

Options

type is task, bug or feature. priority is lowest, low, medium, high or urgent. Time activity is development, review, testing, design, meeting or other.

Status categories

todo, in_progress or done. status=open means not done.

Markdown

description and comment body are Markdown, returned as written. The web interface renders them with raw HTML escaped.

Dates

ISO 8601 with offset for timestamps, YYYY-MM-DD for due dates and time entries.

Pagination

Lists return data, links and meta. per_page is 1 to 100, 25 by default.

Limits

More than 240 requests a minute per user returns 429.

Endpoints

Every path is relative to /api/v1.

Scrollable table

Filter issues

curl -H "Authorization: Bearer $TOKEN" "$TRACKER/issues?assignee=me&status=open&sort=-updated&per_page=100"
curl -H "Authorization: Bearer $TOKEN" "$TRACKER/issues?updated_since=2026-10-29T12:00:00Z&status=all"

Change issues

Create

Only project and title are required. Unknown label names are created in the project.

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" $TRACKER/issues -d '{
  "project": "AGENT",
  "title": "Saved filters in the sidebar",
  "type": "feature",
  "priority": "medium",
  "assignee": "me"
}'

Change status

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  $TRACKER/issues/AGENT-3/transitions -d '{"status": "Done"}'

Comment and log time

hours is required, above 0 and at most 24. date defaults to today, and activity to development.

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  $TRACKER/issues/AGENT-3/comments -d '{"body": "## Done\n- Filters saved"}'
curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  $TRACKER/issues/AGENT-3/time-entries -d '{"hours": 1.5, "comment": "Review", "activity": "review"}'

Webhooks

Admins add webhooks in Settings or through the API. The secret is shown once. Events are issue.created, issue.updated, issue.deleted and comment.created, and each delivery is a queued POST with up to three tries.

POST /hooks/skribly
Content-Type: application/json
X-Skribly-Event: issue.updated
X-Skribly-Signature: sha256=<hex HMAC-SHA256 of the raw body>

To verify a delivery, compute the HMAC of the raw body with the webhook secret, and compare in constant time.