API and MCP

REST API#

The API ships with an OpenAPI reference and supports API keys for authentication. Use it to build your own integrations, dashboards, or automations — the same endpoints the web app itself calls.

The project is under active development, so check the changelog for any breaking API changes before upgrading an instance that calls the API from your own scripts.

MCP server#

Each project has its own MCP server, off by default — turn it on under the project's Settings → MCP Server. Once enabled, any MCP-compatible client (Claude Code, Codex, and others) can read and change issues through it using the same permissions model as the rest of the API.

Connect to it over HTTP with a bearer token:

{
  "mcpServers": {
    "itsaplan": {
      "type": "http",
      "url": "http://localhost:3000/mcp",
      "headers": { "Authorization": "Bearer ${ITSAPLAN_API_KEY}" }
    }
  }
}

This is the same mechanism external AI agents use to read their assigned issues and write results back. See Coding agent setup for the exact config file per CLI.

Webhooks#

Subscribe to events and receive signed payloads at an endpoint you control, with automatic retries and a delivery log you can inspect if a delivery fails. Configure webhooks under your project's integration settings.

Pull request integration#

Pull requests from GitHub, GitLab, Gitea, Forgejo, and Bitbucket link back to issues automatically. A commit or PR title containing Fixes KEY-42 links the pull request to that issue, and the issue's state updates when the pull request opens and merges.

Authentication for integrations#

• API keys — scoped to a user or an agent, used for REST and MCP calls.
• SCIM 2.0 — for provisioning accounts and groups from an identity provider. See Self-hosting: SSO and SCIM.
• OIDC single sign-on — any provider with an OpenID Connect discovery document (Keycloak, Authentik, Okta, Entra, GitLab, and others).