REST API

Build integrations against your organization's tickets, comments, and boards with a versioned REST API. Every endpoint returns JSON and lives under https://dev-api.litosflow.com/api/v1. This reference is generated from the live API, so it always matches what's deployed.

Machine-readable

Point your tools (Postman, Insomnia, openapi-generator) or an AI agent straight at the source. The OpenAPI document and a plain-text llms.txt are generated on every request.

OpenAPI 3.1 (JSON) llms.txt

Authentication

Requests are authenticated with a personal access token sent as a bearer token. Create one from your profile — the secret is shown exactly once at creation. A token belongs to your membership in one organization: it acts as you, in that organization only, and its scopes can never exceed what your role already allows. If your role is later restricted, existing tokens are restricted with it. API access is included on the Business plan; an organization on a lower plan can view and revoke existing tokens but not mint new ones.

Authorization: Bearer ltf_xxxxxxxxxxxxxxxxxxxx

Treat tokens like passwords: store them in a secrets manager, never commit them, and revoke any token you no longer use. Tokens can optionally expire (recommended), and revocation takes effect immediately.

Scopes

Each token carries an explicit set of scopes chosen at creation, drawn from the same permission catalog as workspace roles. A request succeeds only when the token has the endpoint's scope and your role still grants that permission.

Endpoints

Errors & limits

  • List endpoints paginate with page and perPage (max 100) and return a meta block with the total count and page count.
  • Errors are JSON with a message: 401 for a missing, revoked, or expired token, 403 for a missing scope, 404 for resources outside your organization or visibility, and 422 for validation failures (with an errors map).
  • Requests are rate-limited to 60 per minute per token; a 429 response includes a Retry-After header.