Create an API key

1. 1Open Settings → Connections → API & Webhooks and choose New key.
2. 2Name it and choose its scopes: read:tasks, write:tasks, read:projects.
3. 3The Your key is ready window shows the key. It starts with kt_live_ and is shown to you once — copy it before you close the window.
4. 4Press Test connection in the same window. The key calls the API on its own, without your session, and the window says which organization it reached and with which scopes.

The first request

The base address is https://kyrotask.com/api/v1. Send the key as an X-Api-Key header, or as Authorization: Bearer kt_live_.... Start with /me: it needs no scope, so every valid key can call it, and it is the shortest way to see that yours works.

curl -H "X-Api-Key: kt_live_…" https://kyrotask.com/api/v1/me

It answers with the key’s organization and the key’s own name, prefix and scopes — never the key itself. A key that is invalid, expired or revoked gets 401.

{
  "organization": { "id": "4f6c2a0e-…", "name": "Northwind Studio" },
  "key": { "name": "Reporting", "prefix": "kt_live_AbC123", "scopes": ["read:tasks", "read:projects"] }
}

Then list your projects. This one needs the read:projects scope; without it the answer is 403.

curl -H "X-Api-Key: kt_live_…" https://kyrotask.com/api/v1/projects

The project and task lists come one page at a time, newest first, as { items, nextCursor }: 50 to a page, or limit (1 to 200). A page of two (limit=2):

{
  "items": [
    {
      "id": "4f6c2a0e-9b1d-4c8e-a3f2-6d5b7e8c9a01",
      "name": "Website relaunch",
      "key": "WEB"
    },
    {
      "id": "7a3e9c42-1f5b-4d6a-8e2c-3b9d0f1a2c47",
      "name": "Spring campaign",
      "key": "SPR"
    }
  ],
  "nextCursor": "NjM5MjQ5NzE0MDAwMDAwMDAwLjE"
}

While nextCursor is not null, send it back as cursor for the next page; null is the last page. A limit outside the range, or a cursor the API did not give you, gets 400.

curl -H "X-Api-Key: kt_live_…" "https://kyrotask.com/api/v1/projects?limit=2&cursor=NjM5MjQ5NzE0MDAwMDAwMDAwLjE"

What a key can do

• GET /projects and GET /projects/{id} — the projects, and one project with its board columns. Needs read:projects.
• GET /projects/{id}/members — who can be assigned tasks in the project: id and name, no e-mail addresses. Needs read:projects.
• GET /projects/{id}/tasks and GET /tasks/{id} — the tasks, and one task with its version. Needs read:tasks.
• POST /projects/{id}/tasks, PATCH /tasks/{id}, POST /tasks/{id}/move and POST /tasks/{id}/comments — create, change, move and comment. Needs write:tasks.

There is no separate call to complete a task: move it into a column whose isDone is true. A PATCH changes only the fields you send. Send the task’s version with it and a task somebody changed in the meantime is refused with 409, which carries the task as it now is.

The API document

The full OpenAPI 3.1 document is public at /api/v1/openapi.json — no account needed. Point Postman, Scalar, Swagger UI or a code generator straight at it.