Developer API

The Orangescrum Developer API lets your own systems create and update the same records your team works with in the browser. It covers projects, tasks, timelogs, users, the test-case manager, defects and checklists — 59 endpoints in total, all documented in this reference and published as an OpenAPI 3.0 specification.

#Base URL

All requests go to a single production host:

https://v4-api.orangescrum.com

Every endpoint lives under /api/v1/partner/ and is called with POST, including the read operations. Filters, identifiers and pagination all travel in the request body rather than the query string, because the body is encrypted — see Conventions.

#What a request looks like

Three things happen on every call:

1. Encrypt the payload

   Your parameters are serialised to JSON and encrypted with AES-256-CBC, then sent as a single encrypted_data field.

2. Sign the request

   You compute an HMAC-SHA256 signature over the method, path, timestamp, nonce and body hash, and send it in X-SIGNATURE.

3. Read the response

   Responses come back as plain JSON with a success flag, a message, and a data object or array.

Both steps are covered in full — with copy-paste code — in Authentication.

#A first call

/api/v1/partner/validate exists purely so you can prove your credentials work before writing any real integration. It takes no payload.

curl -X POST 'https://v4-api.orangescrum.com/api/v1/partner/validate' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: pk_your_api_key' \
  -H 'X-TIMESTAMP: 1704806400' \
  -H 'X-NONCE: b7f91c2e5a8d3f1e' \
  -H 'X-SIGNATURE: <hmac-sha256>'

A success response confirms the key, its scopes and the server's clock:

{
  "success": true,
  "message": "Authentication successful",
  "data": {
    "partner_id": 42,
    "api_key_id": 7,
    "scopes": ["*"],
    "timestamp": 1704806400
  }
}

#What you can reach

#Prefer an AI assistant?

The same API is exposed as a Model Context Protocol server, so Claude, Cursor, GitHub Copilot and the Codex CLI can call it directly with the key you already have. See MCP / AI Connect.

#Next steps