Skip to main content
Every request carries a credential in an Authorization header, answers with JSON, and says what happened with an HTTP status code.

​
What it does today

It reads and it writes. Reads need nothing beyond the credential. Writes need the write scope and an Idempotency-Key — moving a card runs Git, and a retry that cannot tell “it failed” from “the answer got lost” must not be able to merge twice. See Writing. Two writes are deliberately absent: approving an agent’s proposal, and handing out access to a board. Both belong to a person with a session, for reasons that page explains.

​
The shape of a call

​
header
required
Bearer followed by the secret, which starts with tyl_sk_. See Authentication.
​
header
The id of the board the call is about. Optional when the credential reaches one. See Choosing a board.
​
query
Which product inside that board. Optional when the board has one project, required when it has several — the board’s columns belong to a project, so “the board of the whole team” is not a thing that can be drawn.

​
Everything is addressed by id

Ids are strings, not numbers. They are 64-bit values, and a JSON parser that reads them as numbers loses the low digits silently — so they are sent quoted, and should stay quoted on the way back. There is no slug or name anywhere in the request. A name is a thing somebody renames on a Tuesday and a slug is a thing two organizations can share; either would let an integration go quietly wrong. /v1/me is where the ids come from. Card numbers are the exception and are plain integers, because they are per-board counters rather than ids: #7 on one board and #7 on another are different cards, and a credential only ever reaches its own.

​
Rate limit

120 requests per minute, per caller. Over it, 429. There is no per-plan tier. If you need more for something real, say so rather than spreading calls across credentials — the limit is a guard against runaways, not a lever.

​
Versioning

The path carries the version. /v1 will not change shape under you: new fields may appear, and anything that would break a reader gets a new version rather than a quiet edit.