API Reference

Base URL: http://localhost:4000/api

All endpoints (except auth, health, and pending invitations) require Authorization: Bearer <access_token>.

Swagger UI is available at http://localhost:4000/api/docs.

Authentication

Method	Path	Auth	Description
POST	/api/auth/register	No	Create account
POST	/api/auth/login	No	Login
POST	/api/auth/refresh	No	Refresh access token
GET	/api/auth/profile	Yes	Current user profile
POST	/api/auth/forgot-password	No	Send password reset email
POST	/api/auth/reset-password	No	Reset password with token
GET	/api/auth/permissions	Yes	Current user permissions

Social Auth

Method	Path	Auth	Description
GET	/api/auth/social/yandex	No	Login with Yandex ID
GET	/api/auth/social/yandex/callback	No	Yandex ID callback
GET	/api/auth/social/vk	No	Login with VK ID
GET	/api/auth/social/vk/callback	No	VK ID callback

Users

Method	Path	Auth	Description
GET	/api/users/me	Yes	Current user profile
PATCH	/api/users/me	Yes	Update profile
POST	/api/users/me/avatar	Yes	Upload avatar
GET	/api/users/me/quota	Yes	Quota information
PATCH	/api/users/me/plan	Yes	Change plan
POST	/api/users/me/change-password	Yes	Change password
GET	/api/users	Yes	List users
GET	/api/users/search	Yes	Search users (?q=)

Organizations

All resource endpoints use slug instead of ID.

Method	Path	Auth	Permissions
GET	/api/organizations	Yes	—
POST	/api/organizations	Yes	—
GET	/api/organizations/by-slug/:slug	Yes	org:view
PATCH	/api/organizations/by-slug/:slug	Yes	org:edit
DELETE	/api/organizations/by-slug/:slug	Yes	org:delete
GET	/api/organizations/by-slug/:slug/quota	Yes	org:view
PATCH	/api/organizations/by-slug/:slug/plan	Yes	org:edit
GET	/api/organizations/by-slug/:slug/members	Yes	org:members.view
POST	/api/organizations/by-slug/:slug/members	Yes	org:members.invite
PATCH	/api/organizations/by-slug/:slug/members/:userId	Yes	org:members.roles
DELETE	/api/organizations/by-slug/:slug/members/:userId	Yes	org:members.remove

Organization Avatar

Method	Path	Auth	Description
POST	/api/organizations/by-slug/:slug/avatar	Yes	Upload org avatar

Teams

Most resource endpoints use slug instead of ID.

Method	Path	Auth	Permissions
GET	/api/teams	Yes	—
GET	/api/teams/by-org/:slug	Yes	—
POST	/api/teams	Yes	—
GET	/api/teams/by-slug/:teamSlug	Yes	team:view
PATCH	/api/teams/by-slug/:teamSlug	Yes	team:settings:edit
DELETE	/api/teams/by-slug/:teamSlug	Yes	team:delete
GET	/api/teams/by-slug/:teamSlug/members	Yes	team:view
POST	/api/teams/by-slug/:teamSlug/members	Yes	team:member:add
DELETE	/api/teams/by-slug/:teamSlug/members/:userId	Yes	team:member:remove
GET	/api/teams/by-slug/:teamSlug/tasks	Yes	task:view

Team Quota & Plan

Method	Path	Auth	Description
GET	/api/teams/by-slug/:teamSlug/quota	Yes	Team quota
PATCH	/api/teams/by-slug/:teamSlug/plan	Yes	Change team plan

Projects

Method	Path	Auth	Permissions
GET	/api/projects	Yes	—
POST	/api/projects	Yes	—
GET	/api/projects/:id	Yes	project:view
PATCH	/api/projects/:id	Yes	project:edit
DELETE	/api/projects/:id	Yes	project:delete
GET	/api/projects/:id/members	Yes	project:members.view
POST	/api/projects/:id/members	Yes	project:members.add
DELETE	/api/projects/:id/members/:userId	Yes	project:members.remove

Tasks

Method	Path	Auth	Permissions
GET	/api/tasks/my	Yes	—
GET	/api/tasks/my/calendar	Yes	— (?from=&to=)
GET	/api/projects/:id/tasks	Yes	task:view
POST	/api/projects/:id/tasks	Yes	task:create
GET	/api/projects/:id/tasks/:taskId	Yes	task:view
PATCH	/api/projects/:id/tasks/:taskId	Yes	task:edit
PATCH	/api/projects/:id/tasks/:taskId/status	Yes	task:edit
DELETE	/api/projects/:id/tasks/:taskId	Yes	task:delete

Task Comments

Method	Path	Auth	Description
GET	/api/projects/:id/tasks/:taskId/comments	Yes	List comments
POST	/api/projects/:id/tasks/:taskId/comments	Yes	Create comment
PATCH	/api/projects/:id/tasks/:taskId/comments/:commentId	Yes	Edit comment
DELETE	/api/projects/:id/tasks/:taskId/comments/:commentId	Yes	Delete comment
POST	/api/projects/:id/tasks/:taskId/comments/attachments	Yes	Upload attachments

Task History

Method	Path	Auth	Permissions
GET	/api/projects/:id/tasks/:taskId/history	Yes	task:view

Task Reorder & Bulk

Method	Path	Auth	Description
POST	/api/projects/:id/tasks/reorder	Yes	Reorder tasks ({ taskId, position }[])
POST	/api/projects/:id/tasks/bulk	Yes	Bulk operations (status/assign/delete/priority)

Task Attachments

Method	Path	Auth	Description
POST	/api/projects/:id/tasks/:taskId/attachments	Yes	Upload task attachments
POST	/api/projects/:id/tasks/:taskId/attachments/remove	Yes	Remove attachment

Task Dependencies

Method	Path	Auth	Description
GET	/api/tasks/:taskId/dependencies	Yes	List dependencies
POST	/api/tasks/:taskId/dependencies	Yes	Create (dependsOnId, type?)
DELETE	/api/tasks/:taskId/dependencies/:id	Yes	Remove dependency

Tags

Method	Path	Auth	Description
GET	/api/orgs/:orgId/tags	Yes	Org tags
GET	/api/teams/:teamId/tags	Yes	Team tags
GET	/api/tasks/:taskId/tags	Yes	Task tags
POST	/api/tags	Yes	Create tag
PATCH	/api/tags/:id	Yes	Update tag
DELETE	/api/tags/:id	Yes	Delete tag
POST	/api/tasks/:taskId/tags	Yes	Assign tags (tagIds: string[])

Chat

Method	Path	Auth	Description
GET	/api/chats	Yes	List conversations
POST	/api/chats	Yes	Create conversation
POST	/api/chats/direct/:userId	Yes	Direct conversation
POST	/api/chats/task/:taskId	Yes	Task conversation
GET	/api/chats/:id/messages	Yes	List messages (?before=&limit=)
POST	/api/chats/:id/messages	Yes	Send message
POST	/api/chats/:id/messages/attachments	Yes	Upload attachments (up to 10 files)
POST	/api/chats/:id/read	Yes	Mark as read

Notifications

Method	Path	Auth	Description
GET	/api/notifications	Yes	List notifications
GET	/api/notifications/unread-count	Yes	Unread count
PATCH	/api/notifications/:id/read	Yes	Mark as read
PATCH	/api/notifications/read-all	Yes	Mark all as read
DELETE	/api/notifications/:id	Yes	Delete notification

Invitations

Method	Path	Auth	Description
POST	/api/invitations	Yes	Create invitation
GET	/api/invitations/my	Yes	List my invitations
GET	/api/invitations/pending	No	Find pending (?teamSlug=&orgSlug=)
POST	/api/invitations/:id/accept	Yes	Accept invitation
POST	/api/invitations/:id/decline	Yes	Decline invitation
DELETE	/api/invitations/:id/cancel	Yes	Cancel invitation

Events (Calendar)

Method	Path	Auth	Description
GET	/api/events	Yes	List events (?from=&to=)
POST	/api/events	Yes	Create event
GET	/api/events/:id	Yes	Event details
PATCH	/api/events/:id	Yes	Update event
DELETE	/api/events/:id	Yes	Delete event

Plans

Method	Path	Auth	Description
GET	/api/plans	Yes	List available plans

Sprints

Method	Path	Auth	Description
GET	/api/projects/:projectId/sprints	Yes	List project sprints
GET	/api/projects/:projectId/sprints/velocity	Yes	Velocity data
GET	/api/sprints/:id	Yes	Sprint details
POST	/api/sprints	Yes	Create sprint
PATCH	/api/sprints/:id	Yes	Update sprint
DELETE	/api/sprints/:id	Yes	Delete sprint
POST	/api/sprints/:id/tasks	Yes	Add tasks to sprint
DELETE	/api/sprints/:sprintId/tasks/:taskId	Yes	Remove task from sprint

Custom Fields

Method	Path	Auth	Description
GET	/api/custom-fields/:entityType	Yes	List fields for entity type
POST	/api/custom-fields	Yes	Create field definition
PATCH	/api/custom-fields/:id	Yes	Update field
DELETE	/api/custom-fields/:id	Yes	Delete field
GET	/api/custom-field-values/:entityId	Yes	Get entity field values
POST	/api/custom-field-values/:entityId	Yes	Set entity field values

Time Tracking

Method	Path	Auth	Description
GET	/api/tasks/:taskId/time-entries	Yes	List time entries
GET	/api/tasks/:taskId/time-total	Yes	Total minutes
POST	/api/tasks/:taskId/time-entries	Yes	Log time entry
DELETE	/api/time-entries/:id	Yes	Delete time entry

Favorites

Method	Path	Auth	Description
GET	/api/favorites	Yes	List favorites
POST	/api/favorites	Yes	Add to favorites
DELETE	/api/favorites/:entityType/:entityId	Yes	Remove from favorites

Templates

Method	Path	Auth	Description
GET	/api/orgs/:orgId/templates	Yes	List org templates
POST	/api/templates	Yes	Create template
PATCH	/api/templates/:id	Yes	Update template
DELETE	/api/templates/:id	Yes	Delete template
POST	/api/templates/:templateId/apply/:projectId	Yes	Apply template to project

Webhooks

Method	Path	Auth	Description
GET	/api/orgs/:orgId/webhooks	Yes	List org webhooks
POST	/api/webhooks	Yes	Create webhook
PATCH	/api/webhooks/:id	Yes	Update webhook
DELETE	/api/webhooks/:id	Yes	Delete webhook
GET	/api/webhooks/:id/logs	Yes	Delivery logs

Trash

Method	Path	Auth	Description
GET	/api/trash	Yes	List deleted items
POST	/api/trash/:entityType/:entityId/restore	Yes	Restore item
DELETE	/api/trash/:entityType/:entityId	Yes	Permanent delete

Search

Method	Path	Auth	Description
GET	/api/search	Yes	Global search (?q=) — returns tasks, projects, teams, orgs

Reports

Method	Path	Auth	Description
GET	/api/projects/:id/report	Yes	Project report
GET	/api/projects/:id/export/csv	Yes	Export tasks as CSV

Two-Factor Authentication

Method	Path	Auth	Description
POST	/api/auth/2fa/generate	Yes	Generate 2FA secret + QR code URL
POST	/api/auth/2fa/enable	Yes	Enable 2FA (verify TOTP code)
POST	/api/auth/2fa/disable	Yes	Disable 2FA (verify TOTP code)

Video Rooms

Method	Path	Auth	Description
GET	/api/video-rooms	Yes	List rooms
POST	/api/video-rooms	Yes	Create room
GET	/api/video-rooms/:id	Yes	Room details
PATCH	/api/video-rooms/:id	Yes	Update room
DELETE	/api/video-rooms/:id	Yes	End/delete room
POST	/api/video-rooms/:id/join	Yes	Join room
POST	/api/video-rooms/:id/leave	Yes	Leave room
GET	/api/video-rooms/:id/participants	Yes	List participants
POST	/api/video-rooms/:id/token	Yes	Get LiveKit token
POST	/api/video-rooms/:id/recording/start	Yes	Start recording
POST	/api/video-rooms/:id/recording/stop	Yes	Stop recording
GET	/api/video-rooms/:id/recording/status	Yes	Recording status

Health

Method	Path	Auth	Description
GET	/api/health	No	Service health check
GET	/api/docs	No	Swagger UI (interactive API documentation)
GET	/uploads/*	No	Static files (local uploads)

Administration

Dashboard

Method	Path	Auth	Description
GET	/api/admin/stats	Yes	Aggregate statistics

Users

Method	Path	Auth	Description
GET	/api/admin/users	Yes	List users (?page=&limit=)
GET	/api/admin/users/:id	Yes	User details with roles
POST	/api/admin/users	Yes	Create user
PATCH	/api/admin/users/:id	Yes	Update user
DELETE	/api/admin/users/:id	Yes	Delete user
POST	/api/admin/users/:id/roles	Yes	Assign role
DELETE	/api/admin/users/:id/roles/:roleId	Yes	Remove role
POST	/api/admin/users/:id/resend-verification	Yes	Resend email verification
POST	/api/admin/users/:id/send-password-reset	Yes	Send password reset email

Organizations

Method	Path	Auth	Description
GET	/api/admin/organizations	Yes	List organizations (?page=&limit=)
DELETE	/api/admin/organizations/:id	Yes	Delete organization

Teams

Method	Path	Auth	Description
GET	/api/admin/teams	Yes	List teams (?page=&limit=)
DELETE	/api/admin/teams/:id	Yes	Delete team

Roles

Method	Path	Auth	Description
GET	/api/admin/roles	Yes	List roles (?scope=)
GET	/api/admin/roles/:id	Yes	Role details
POST	/api/admin/roles	Yes	Create role
PATCH	/api/admin/roles/:id	Yes	Update role
DELETE	/api/admin/roles/:id	Yes	Delete role

Groups

Method	Path	Auth	Description
GET	/api/admin/groups	Yes	List groups (?scope=&organizationId=)
POST	/api/admin/groups	Yes	Create group
PATCH	/api/admin/groups/:id	Yes	Update group
DELETE	/api/admin/groups/:id	Yes	Delete group
GET	/api/admin/groups/:id/members	Yes	Group members
POST	/api/admin/groups/:id/members	Yes	Add member
DELETE	/api/admin/groups/:id/members/:userId	Yes	Remove member
GET	/api/admin/groups/:id/roles	Yes	Group roles
POST	/api/admin/groups/:id/roles	Yes	Assign role to group
DELETE	/api/admin/groups/:id/roles/:roleId	Yes	Remove role from group

Plans

Method	Path	Auth	Description
GET	/api/admin/plans	Yes	List all plans
PATCH	/api/admin/plans/:id	Yes	Update plan

Files

Method	Path	Auth	Description
GET	/api/admin/files	Yes	List files (?page=&limit=)
DELETE	/api/admin/files/:id	Yes	Delete file

Permissions

Method	Path	Auth	Description
GET	/api/admin/permissions	Yes	List all permissions

Error Responses

All errors return a unified JSON structure:

{
  "statusCode": 400,
  "message": "Error description",
  "error": "Bad Request"
}

Common status codes:

• 200 — Success
• 201 — Created
• 400 — Bad Request (validation error)
• 401 — Unauthorized
• 403 — Forbidden
• 404 — Not Found
• 409 — Conflict
• 500 — Internal Server Error

Pagination

List endpoints support pagination via query parameters:

Parameter	Type	Default	Description
page	number	1	Page number
limit	number	20	Items per page

{
  "data": [...],
  "total": 50,
  "page": 1,
  "limit": 20
}