--- title: "Orangescrum Developer Documentation | Orangescrum" description: "Build on Orangescrum. 59 Partner API endpoints for projects, tasks, time logs, test management, and defects, plus an MCP server with 72 tools for AI clients." canonical: https://www.orangescrum.com/developer --- # Orangescrum Developer Documentation | Orangescrum > For the complete documentation index, see [llms.txt](https://www.orangescrum.com/llms.txt). Developer docs Getting started - [Overview](/developer) - [Get API credentials](/developer#credentials) - [Make your first call](/developer#first-call) Partner API - [Introduction](/developer/api) - [Authentication](/developer/api#authentication) - [Encrypting requests](/developer/api#encryption) - [Responses and errors](/developer/api#responses) - [Rate limits](/developer/api#rate-limits) - [Endpoint reference](/developer/api#reference) MCP server - [Overview](/mcp) - [Connect a client](/mcp#connect) - [Tool reference](/mcp#tools) More - [Self-Hosted edition](/self-hosted) - [Community Edition](/open-source/free-download) - [Talk to us](/contact-sales) [Home](/)Developer # Developer documentation Orangescrum exposes your project data two ways: a REST Partner API with 59 endpoints, and an MCP server with 72 tools that lets AI clients such as Claude work in your workspace directly. Both use the same credentials and the same permissions as the user they belong to. ## What you can build[](#what-you-can-build) The API covers the objects teams actually automate around, not just projects and tasks. If you can do it on a work item in the product, there is usually an endpoint for it. - **Reporting and BI.** Pull projects, tasks, and time logs into a warehouse or a dashboard, on your schedule rather than by export. - **Payroll and finance.** Sync approved time logs into payroll or billing without anyone rekeying them. - **Intake automation.** Create tasks from a CRM, a form, an HRMS, or an internal portal, so requests arrive as tracked work. - **QA pipelines.** Drive test cases, scenarios, steps, and defects from CI, and raise a defect the moment a test fails. - **AI assistants.** Point Claude or another MCP client at your workspace and let it answer questions and file work for you. ## Two ways to integrate[](#surfaces) [ ### Partner API A REST API over HTTPS. 59 endpoints across 13 resource groups. Payloads are encrypted with your secret, so data is protected beyond the transport layer. Read the API reference](/developer/api)[ ### MCP server Connect an AI client over the Model Context Protocol and it gets 72 tools plus read-only resources. No integration code to write. Authenticated with OAuth. Set up MCP](/mcp) Which one should I use? Use the Partner API when your own software is doing the calling and you need predictable, scriptable behaviour. Use MCP when a person is working through an AI assistant and you want it to read and act without you building anything. They are not alternatives, and plenty of teams run both. ## Get API credentials[](#credentials) API access is available on the Premium plan and in the Self-Hosted edition. Credentials are issued per company and carry the permissions of the user they are created for, so an integration can never see more than that person can. 1. Ask us for Partner API access from the [contact page](/contact-sales), or through your account manager. 2. We issue an **API key** and an **API secret**. The key identifies you. The secret encrypts your payloads and is never sent over the wire. 3. Store both as environment variables. Do not commit them, and do not put them in front-end code. The secret is not recoverable We do not display the secret again after it is issued. If it is lost or you think it has leaked, ask for a rotation and update your integrations. A leaked secret lets someone decrypt and forge request payloads. ## Make your first call[](#first-call) Every endpoint is a `POST`, and the body is always a single `encrypted_data` field holding your encrypted JSON. The `/validate` endpoint exists exactly for this moment: it confirms your key works and your encryption is correct before you write anything real. ``` # 1. Encrypt your JSON payload with your API secret (see the API reference). # 2. Send it as the single "encrypted_data" field. curl -X POST https:///api/v1/partner/validate \ -H "X-API-KEY: your_api_key" \ -H "Content-Type: application/json" \ -d '{"encrypted_data":""}' ``` Point at your own host if you run the Self-Hosted edition. If that returns successfully, your credentials and your encryption both work. The [encryption section](/developer/api#encryption) of the API reference explains the format in full, and the [endpoint reference](/developer/api#reference) lists every call with its parameters. ## Limits and support[](#limits) Rate limits are 120 requests per minute and 5000 per day, counted per API key. Going over returns `429`. If your integration needs more than that, tell us what you are building and we will look at it. Found something wrong in these docs, or an endpoint behaving differently from what is written here? Tell us at [support@orangescrum.com](mailto:support@orangescrum.com) and we will fix it. [API reference](/developer/api) [Request access](/contact-sales)