Permissions
A token acts as its owner with their current role. API tokens work on /api/v1, MCP tokens only on /mcp. A few settings (tokens, AI keys, workspace deletion) need a signed-in session and answer 403 session_required.
REST · JSON · OpenAPI
Read and change spaces, issues, sprints, roadmaps, documentation and support requests from your own tools. Every request acts as you, with your role’s permissions.
/api/v1
From nothing to your first response in three steps.
In Backlog.pm, open Account settings → Integrations → API credentials and generate a token. It starts with bpm_pat_ and is shown once, so keep it somewhere safe.
Put it in the Authorization header as Bearer bpm_pat_…. Your workspace comes from the address, so use your own {workspace}.backlog.pm.
Press Authorize, paste the token, then Try it out on an endpoint. Requests run against the workspace this page is open on.
A token acts as its owner with their current role. API tokens work on /api/v1, MCP tokens only on /mcp. A few settings (tokens, AI keys, workspace deletion) need a signed-in session and answer 403 session_required.
Bodies are JSON only (anything else is 415) and at most 4 MB; uploads have their own limits. Ids are UUIDs, dates are YYYY-MM-DD, times are RFC 3339.
Every error has the same shape, with a stable code to switch on:
{ "error": { "code": "validation_failed",
"message": "Some fields need attention.",
"fields": { "title": "title_required" } } }
An issue is todo, progress, done or cancelled. In progress is one of the team’s working statuses: board_column_id says which, status_name what it’s called.
Grouped by what they work on. Open one to see its parameters, its responses and an example.