Align Public Developer API
Tenant-scoped REST API for the Align client-feedback & PM platform.
Authentication: send your API key as either Authorization: Bearer <key> or X-API-Key: <key>.
Permissions: every operation names the permission it checks in x-required-permission. A key without it gets 403 forbidden.
Errors: errors use { reason, message, details? }. Every operation can also return 401, 403, 423 (organisation suspended) and 429.
Rate limit: 600 requests / minute per key (sliding window). 429 responses include Retry-After and X-RateLimit-* headers.
Pagination: most list endpoints accept page and pageSize (max 100) and respond with { data, page, pageSize, total }. Endpoints that return everything in one response say so.
Idempotency: POST endpoints that list the Idempotency-Key header cache the response for 24 h on the server instance that answered. Other POSTs are not deduplicated, so do not retry them blindly.
Versioning: only additive changes within v1. Breaking changes ship under /api/v2.
Key minting: organization administrators can mint either organization-scoped or project-scoped keys from /admin/developer. Members with the developer, tech_lead, devops_engineer, or manager role can mint project-scoped keys only for projects they belong to. A project-scoped key can call only /me, /projects/{scopedProjectId}/..., /time-entries/{id}/... and /wiki-pages/{id}/... (the handlers check the record belongs to its project). It cannot call /entries/{id}, /comments/{id}, /attachments/{id}, /releases/{id} or any organisation-wide path, even with the matching permission.
Authentication
Pass your API key as Authorization: Bearer <key>.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Contact
Align Developer Support: