API usage

Everything the web app does goes through the same REST API you can call directly — from a script, a Power Automate flow, or any HTTP client that can send a bearer token.

Authenticate

1. Create a personal access token

   Open Settings › Personal tokens and create a token. Copy it immediately — it’s shown once.

2. Send it with every request

   Add an Authorization: Bearer <token> header. A legacy-compatibility alternative, X-API-Key: <token>, is also accepted.

3. Scope your calls to a project

   Most endpoints take a project id in the path. A token can only act on projects its owner belongs to.

Endpoint layout

• REST endpoints live under /api/v2/... — the same paths the web app calls.
• Interactive API documentation (OpenAPI/Swagger UI) is served at /api/docs, with the raw spec at /api/openapi.yaml and /api/openapi.json. Both are public — no token needed to read the spec.
• The MCP server is at /app/{projectID}/mcp (see Elitea MCP server) — the same bearer token authenticates it.
• SCIM provisioning, for identity providers that push users and groups, is at /api/v2/scim/v2. It authenticates with a dedicated SCIM client credential that you create under Authentication; a personal access token is refused.

Call the API from Power Automate (or any HTTP client)

1. Add an HTTP action

   In your flow, add a generic HTTP (or “HTTP with Azure AD” if you prefer a service account) action.

2. Set the method and URL

   Point it at the /api/v2/... path for the operation you need — check /api/docs for the exact path, parameters and body shape.

3. Add the Authorization header

   Set the header to Bearer <your personal access token>, stored as a secret in your flow, not inline in plain text.

Common issues

Note

A token only reaches projects its owner belongs to — a 403 on an otherwise-correct call usually means the token owner isn’t a member of the project id in the path, not a malformed request.

Note

Webhooks (both directions) have a UI now: a pipeline’s inbound trigger is configured from the pipeline editor’s Triggers & schedules panel, and the project’s outbound webhook registry has its own Settings › Webhooks page — see Webhooks and pipeline triggers. Both APIs still work with a personal access token if you’d rather script registration.