API & CLI

orboto is API-first - the web app, the CLI, the MCP server and every integration all speak the same REST API with the same permissions.

The REST API

• Discover endpoints and schemas with authenticated orboto api-search. The interactive /docs and /docs/json routes are closed by default; they are available only when the operator enables public API documentation.
• Authenticate with an API key (orb_*, minted in your profile or by an admin for bot accounts) sent as Authorization: Bearer <key>.
• List endpoints use cursor pagination: pass ?cursor=<opaque>&limit=50, read items + nextCursor from the response.
• Scoped keys. When you mint a key you can restrict it to a set of permission scopes (ticket:create, comment:create, doc:view, ...; the picker in your profile lists them, GET /api-keys/scopes returns the same vocabulary). A scoped key can do at most what its scopes allow, even when your account may do more - the API intersects your permissions with the key's scopes on every request, including the MCP server and the in-app assistant, which authenticate with the same key. A key with no scopes carries your full permissions. Unknown scopes are refused when the key is created, never silently dropped. Added in v0.230.0 The scopes also bind the key's live connections - /ws, /agent/ws and GET /sse/mcp-events - so a key without ticket:view_private or milestone:view_private receives no private ticket or comment events, and changing, revoking or expiring the key closes them (WebSocket close code 4401). See Live connections.

For LLMs

These docs are machine-readable: /llms.txt is the index, /llms-full.txt the full text, and every page has a raw Markdown twin via the page-actions menu (Copy as Markdown, Open in ChatGPT/Claude).