Quick start

REST at /api/v1: read projects, specs, components, milestones, tasks, documentation pages, documents and meetings, and write documentation, tasks and meeting minutes. Plus optional HMAC-signed HTTPS webhooks.

Official modules (openrocket, github, kicad, calendar, Outline) are first-party UI already in the app: /projects/:slug/rockets, /repos, /boards.

Community listings have no in-app UI. No iframe, no nav slot, no settings panel you render. Operator surfaces are the catalog, install row, and Admin → Integrations (tokens, webhooks). Your UI is whatever you ship: Slack, CLI, CI, your own site.

OpenAPI: /developers/openapi.json. Each HTML page has a .md twin.

In Prototype: Admin → Integrations → API tokens → New token.

For a first request, grant projects:read. Add components:read / specs:read when you need those collections.

Copy ptk_live_… now. It is shown once.

export PROTOTYPE_URL="https://<your-host>"
export PROTOTYPE_TOKEN="ptk_live_…"

curl -s \
  -H "Authorization: Bearer $PROTOTYPE_TOKEN" \
  "$PROTOTYPE_URL/api/v1/me"

You should see ok: true and the org the token belongs to. Then:

curl -s \
  -H "Authorization: Bearer $PROTOTYPE_TOKEN" \
  "$PROTOTYPE_URL/api/v1/projects"

Same call in JavaScript:

const res = await fetch(`${process.env.PROTOTYPE_URL}/api/v1/projects`, {
  headers: { Authorization: `Bearer ${process.env.PROTOTYPE_TOKEN}` },
});
const json = await res.json();
if (!json.ok) throw new Error(json.error);
console.log(json.data);

Next: REST API for every endpoint, or the Slack example for a full script.

If you want a push when a spec is published: Admin → Integrations → Webhooks, URL https://your-host/prototype/hooks, event spec.published. Copy whsec_… once.

Verify the signature on the raw body before you trust the payload. See Webhooks.