Orangescrum
Documentation index for AI agents (llms.txt). A markdown version of this page is available at /developer.md or by requesting this URL with the header Accept: text/markdown.

Developer documentation

Orangescrum exposes your project data two ways: a REST Partner API with 59 endpoints, and an MCP server with 72 tools that lets AI clients such as Claude work in your workspace directly. Both use the same credentials and the same permissions as the user they belong to.

What you can build

The API covers the objects teams actually automate around, not just projects and tasks. If you can do it on a work item in the product, there is usually an endpoint for it.

  • Reporting and BI. Pull projects, tasks, and time logs into a warehouse or a dashboard, on your schedule rather than by export.
  • Payroll and finance. Sync approved time logs into payroll or billing without anyone rekeying them.
  • Intake automation. Create tasks from a CRM, a form, an HRMS, or an internal portal, so requests arrive as tracked work.
  • QA pipelines. Drive test cases, scenarios, steps, and defects from CI, and raise a defect the moment a test fails.
  • AI assistants. Point Claude or another MCP client at your workspace and let it answer questions and file work for you.

Two ways to integrate

Partner API

A REST API over HTTPS. 59 endpoints across 13 resource groups. Payloads are encrypted with your secret, so data is protected beyond the transport layer.

Read the API reference

MCP server

Connect an AI client over the Model Context Protocol and it gets 72 tools plus read-only resources. No integration code to write. Authenticated with OAuth.

Set up MCP

Get API credentials

API access is available on the Premium plan and in the Self-Hosted edition. Credentials are issued per company and carry the permissions of the user they are created for, so an integration can never see more than that person can.

  1. Ask us for Partner API access from the contact page, or through your account manager.
  2. We issue an API key and an API secret. The key identifies you. The secret encrypts your payloads and is never sent over the wire.
  3. Store both as environment variables. Do not commit them, and do not put them in front-end code.

Make your first call

Every endpoint is a POST, and the body is always a single encrypted_data field holding your encrypted JSON. The /validate endpoint exists exactly for this moment: it confirms your key works and your encryption is correct before you write anything real.

# 1. Encrypt your JSON payload with your API secret (see the API reference).
# 2. Send it as the single "encrypted_data" field.

curl -X POST https://<your-orangescrum-host>/api/v1/partner/validate \
  -H "X-API-KEY: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"encrypted_data":"<base64 iv + ciphertext>"}'
Point at your own host if you run the Self-Hosted edition.

If that returns successfully, your credentials and your encryption both work. The encryption section of the API reference explains the format in full, and the endpoint reference lists every call with its parameters.

Limits and support

Rate limits are 120 requests per minute and 5000 per day, counted per API key. Going over returns 429. If your integration needs more than that, tell us what you are building and we will look at it.

Found something wrong in these docs, or an endpoint behaving differently from what is written here? Tell us at support@orangescrum.com and we will fix it.

API reference Request access