Docs

Public API

The public API and MCP are on every plan — Free included. Bring the tools you already trust; we don't ship a chatbot, and we never train on your work.

Auth is a personal access token, minted in account settings. Prefix sng_, shown once. Send it as Authorization: Bearer sng_…. Session cookies are ignored on this tree — a browser session is not an API credential. New tokens require a workspace and a grants matrix (projects / tasks / comments × view / create / update). The workspace id is stored on the token metadata, never in the secret.

Coarse scopes read / write remain as a derived summary (write implies read). Grants are the live ACL. Legacy tokens with an empty workspace allow-list still mean every workspace the owner is an active member of. Every call still runs the same permission check as the app: viewers read, guests stay project-scoped, a token cannot escalate. Writes show as the token name.

Rate limits are abuse protection, not a meter. A 429 includes Retry-After. There is no usage UI and no plan cap.

Files, chat, whiteboards, billing, member admin and automations composers stay in the app. Webhooks fire task.created, task.updated, task.completed, comment.created with X-Sahnga-Signature: sha256=….

Endpoints

  • GET
    /api/v1/workspaces/{wsId}/projects

    List projects the token owner can see.

  • GET
    /api/v1/workspaces/{wsId}/projects/{projectId}

    One project.

  • GET
    /api/v1/workspaces/{wsId}/projects/{projectId}/tasks

    Tasks in a project (open by default).

  • GET
    /api/v1/workspaces/{wsId}/tasks/{taskId}

    One task.

  • POST
    /api/v1/workspaces/{wsId}/tasks

    Create a task. Requires tasks.create.

  • PATCH
    /api/v1/workspaces/{wsId}/tasks/{taskId}

    Update a task. Requires tasks.update.

  • GET
    /api/v1/workspaces/{wsId}/tasks/{taskId}/comments

    Comments on a task. Requires comments.view.

  • POST
    /api/v1/workspaces/{wsId}/tasks/{taskId}/comments

    Add a comment. Requires comments.create.

  • GET
    /api/v1/workspaces/{wsId}/me/tasks

    Tasks assigned to the token owner.

  • GET
    /api/v1/workspaces/{wsId}/search?q=

    Title prefix search.

  • GET
    /api/v1/workspaces/{wsId}/webhooks

    List outbound webhooks. Write scope to create.

  • POST
    /api/v1/workspaces/{wsId}/webhooks

    Create an HMAC-signed HTTPS webhook.

Prefer an AI client? See MCP. Same services, same token, no second write path.