REST API, tokens and audit export

API

The API is versioned under /api/v1 and is the same API the product's own screens use. Errors share one shape and are returned in the caller's language (English, Latvian or German). The API is described as OpenAPI, generated from the code itself. The product's own API page lists the calls and offers the description as OpenAPI (JSON); the link What the API offers beside your API tokens opens it. The same description answers at /api/v1/openapi to anybody signed in or holding a token. Calls to the REST API are not rate-limited per token.

Service accounts

For another system that has to talk to GoProject, without anybody's password. Administration, Service accounts, New account: a name and what it is for. The account has no password and cannot use the sign-in screen. Add it to project roles like a person; that decides what it may do.

Then Issue a key:

• Shown once; only a hash is stored. Lost means issue a new one and take the old one back
• Options: Only these projects and May only read only narrow what the account may do; May read the audit export opens the audit export described below and nothing else of the administration; Opens the MCP server lets an AI agent use the key
• Expiry is required. The ceiling for all keys is 365 days by default; lowering it shortens keys that already outlive it
• Each key shows its expiry, number of uses and last use. The audit log records which key did what, and the system warns when a live key has less than 14 days left

Personal API tokens

Profile, Security, API tokens, New token. A token acts as its owner, less what its scope takes away (read-only, some projects), with an expiry up to the administrator's limit. At most ten live tokens per person, not for external accounts, and the owner is told by mail when one is created. Administrators see every personal token and can revoke them or switch personal tokens off under Administration, Service accounts.

Using a token

curl -H "Authorization: Bearer gop_..." https://goproject.example.com/api/v1/spaces

A token request creates no session and needs no CSRF token. A wrong, revoked, expired or switched-off key answers 401 without detail. Tokens never open /api/v1/admin/, whatever the account holds; the one exception is the audit export, for a service account's key issued with May read the audit export.

Webhooks

There is no webhook subscription screen. Outgoing calls are made by automation rules, with the send web request action or a Slack or Teams message; incoming calls wake automation rules through their secret incoming webhook addresses, Git servers call the development webhooks, and where Microsoft Teams is connected directly, Teams calls the product's bot. See Automation and its safeguards and Git integrations.

Audit export for your SIEM

GET /api/v1/admin/audit/export?afterId=0&limit=1000

Returns newline-delimited JSON (application/x-ndjson), oldest first, up to 10,000 entries per call. The X-Last-Id response header is the cursor: pass it as afterId on the next call. The export is called with a service account's key issued with May read the audit export, or from a system administrator's signed-in session (Administration, Audit trail, Export (JSONL)). The same screen can also pass every event on as it is written, to a syslog server or into a daily file of JSON lines. The log is append-only: entries are never edited or removed.