Drive boards from the API, or from an AI assistant

Boards are fully drivable from outside the dashboard. Two routes, one permission model, and the same behaviour as the screens — because they call the same code.

The REST API

Every operation is in our public OpenAPI specification, with generated clients in TypeScript, Python, PHP and Go, and the CLI is generated from the same spec. Boards, columns, cards, comments, questions, labels, members and share links are all covered.

The endpoints you will use most:

• GET /v1/agency/boards — your boards
• GET /v1/agency/boards/{id} — one board with its columns and cards
• POST /v1/agency/boards/{id}/cards — add work
• POST /v1/agency/boards/{id}/cards/{id}/move — move it
• POST /v1/agency/boards/{id}/invites — mint a share link

The share link's token comes back on that last call and only on that call. We store a fingerprint of it, so there is no endpoint that can read it back — if your script needs the link, keep it from the response.

The MCP server

If you use an AI assistant that speaks MCP, connect it and it gets board tools directly: list boards, read one in full, create a board, add a card, move a card, comment, create a share link and revoke one. That turns "summarise this week and send Acme a link" into one instruction instead of two systems and a copy-paste.

Two things worth knowing about the tools:

• A new card is internal unless you say otherwise. An assistant summarising your internal

work must not publish that summary to your client because nobody said not to, so visibility defaults to internal and has to be set to client deliberately.

• Revoking a link asks for confirmation, because it also removes anybody who joined

through that link — and the tool tells you how many people that was, rather than reporting a tidy success.

What it needs

API and MCP access is included in Boards Business and in every Agency hosting plan. On Boards Free and Boards Pro the board endpoints answer with a message saying so.

An API key or MCP connection can only do what the person who created it can do, in the organisations they can do it in. A share link an assistant creates is bounded the same way: it cannot grant a role the authorising human does not hold themselves.