The API is a product feature

The public REST contract replaced the shared task engine that was rejected. How cheaply integrators can connect to it decides whether one list of work across all products ever appears.

What is built into the contract

Versioning by path

Every controller lives under /api/v1. A breaking change requires the previous version to stay supported through a transition period, and old paths remain aliases for two releases.

Idempotent writes

Write operations accept an idempotency key. A repeated call after a network drop updates the record instead of creating a second one. This is the most common mistake in integrations of this kind.

The same permissions as the interface

Authentication through A3.ID, access checks identical to the interface. Economic fields are not returned to an external participant rather than hidden on the client.

A separate limit for the ecosystem

Integration traffic is bursty by nature and customer traffic is even. One limit across both would either strangle integrations or fail to stop abuse.

Method groups

GET/api/v1/tasksTask list with pagination, filters and sorting
POST/api/v1/tasksCreate a task, change status, assign, run bulk operations
POST/api/v1/assignmentsAn external assignment with an idempotency key
PUT/api/v1/assignments/{key}Update and close by external key
GET/api/v1/projectsProjects, members, milestones and budget
POST/api/v1/time-entriesLog time, read entries, approve them
GET/api/v1/views/overdueReady views: my tasks, overdue, by project
POST/api/v1/exportOrganisation data export under the caller permissions

An external assignment

The source product passes its entity and a link to it. A repeated call with the same externalKey updates the task instead of creating a second one.

POST /api/v1/assignments

{
  "externalKey": "legal-case-8421",
  "sourceProduct": "lawyer",
  "sourceEntityType": "LegalCase",
  "sourceEntityId": "8421",
  "deepLink": "https://app.lawyer.a3.solutions/cases/8421",
  "title": "Подготовить исковое заявление",
  "assigneeId": "u-2f9c",
  "dueDate": "2026-10-02"
}

Webhooks

A subscription to events so that the source product never has to poll A3.Projects on a schedule.

task.createdA task was created in the interface or through the API

task.status_changedA task changed state, including a send back for rework

task.closedA task was completed or cancelled with a stated reason

time_entry.loggedTime was logged, including through the embedded widget

project.status_changedA project was paused, completed or cancelled

budget.threshold_reachedA budget threshold was reached, firing once per threshold

Personal access tokens

A token is created for one integration and limited to an explicit list of scopes no wider than the permissions of its owner. Only a hash is stored, and the lifetime never exceeds 180 days.

Scopes come from an explicit list rather than being granted wholesale
Only a SHA-256 hash is stored, and a token cannot be shown a second time
The lifetime is at most 180 days, renewal means issuing a new token
Tokens are managed by session rather than by the token itself

Access for an AI agent

The same public API serves as the entry point for the ecosystem agent over MCP. The agent acts on behalf of the user and under the same access checks.

A permission refusal comes back as a tool error rather than an empty list. Otherwise the agent would say you have no tasks where the tasks are simply not visible.

The contract is open

The schema, request examples and error codes are published. A sandbox follows the first reference integration: without a first consumer it would serve an imaginary scenario.

Get started Integrations