Developer API

The Orangescrum Developer API lets your own systems create and update the same records your team works with in the browser. It covers projects, tasks, timelogs, users, the test-case manager, defects and checklists: 59 endpoints in total, all documented in this reference and published as an OpenAPI 3.0 specification.

#Base URL

All requests go to a single production host:

https://v4-api.orangescrum.com

Every endpoint lives under /api/v1/partner/ and is called with POST, including the read operations. Filters, identifiers and pagination all travel in the request body rather than the query string, because the body is encrypted, see Conventions.

#What a request looks like

Three things happen on every call:

1. Send your API key

   Your key goes in the X-API-KEY header. It identifies your company and user, so every request runs as that user, inside that company's workspace.

2. Encrypt the payload

   Your parameters are serialized to JSON and encrypted with AES-256-CBC using your secret, then sent as a single encrypted_data field.

3. Read the response

   Responses come back as plain JSON with a success flag, a message, and a data object or array.

Both are covered in full, with copy-paste code, in Authentication.

#A first call

/api/v1/partner/validate exists purely so you can prove your credentials work before writing any real integration. Send it any small encrypted payload, for example {"ping": "hello"}; it decrypts it and echoes it back.

curl -X POST 'https://v4-api.orangescrum.com/api/v1/partner/validate' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: osk_your_api_key' \
  -d '{"encrypted_data":"<base64-aes-256-cbc-payload>"}'

A success response proves the key is valid and your encryption is right, because the server could only echo your payload by decrypting it:

{
  "success": true,
  "message": "Request validated successfully",
  "data": {
    "ping": "hello"
  }
}

Without encrypted_data the call returns 422; with a payload that does not decrypt it returns 401.

#What you can reach

#Prefer an AI assistant?

Orangescrum also runs a Model Context Protocol server, so Claude, ChatGPT, Cursor, GitHub Copilot and the Codex CLI can work with your projects directly, 342 tools across projects, tasks, sprints, Test Lab, releases, Scaled Agile, the Knowledge Base, risk management, attendance, leave, resources and checklists. It authenticates with its own OAuth flow rather than a partner key. See MCP / AI Connect.

#Next steps