API keys and REST API

API access requires Pro. Open API Keys, a tab in Meetings beside Integrations (or type API keys in ⌘K), select Create key, name the key after the program that will use it, and create it. The full secret is shown once. Store it in a password manager or secret store; Magpie cannot show it again. Revoking a key stops it immediately.

Send the key in every request:

Authorization: Bearer YOUR_SECRET_KEY

The base path is /api/v1. The API provides list, create, read, update, confirm, cancel, archive, and delete operations for bookings as applicable; create and management operations for event types and availability; issue list, read, create and update operations; the signed-in user record; and webhook subscriptions. Store orders, Products, stock, returns, customers and Store webhooks have their own routes, described in Store API and webhooks. The API reference describes bookings, event types, availability, the user record, webhooks and Store, with their fields, statuses and errors. Download OpenAPI 3.0 Spec on that page gives the OpenAPI file, which lists every route, including Notes, Documents, Contacts, Invoices, To-dos, Calendar and the other areas the Magpie app uses. A key acts as the person who created it, with their access.

To use Magpie from Claude, ChatGPT, Cursor or another app that connects to tools, see Connected apps. An API key can be sent to https://magpie.diy/mcp in the same Authorization: Bearer header.

Issue routes use the selected Personal or team context. An API key follows the website's current team; send X-Magpie-Team-Id to select another team the key's owner can view. Issue list results come a page at a time. Filter by status key, priority, project UUID, assignee user ID, or search text:

GET /api/v1/issues?project=PROJECT_UUID&status=in_progress&page=1

Read one issue with GET /api/v1/issues/ISSUE_UUID. Create an issue with a title and optional Markdown description and project UUID:

{
  "title": "Review the export flow",
  "description_markdown": "Check the downloaded CSV.",
  "project_uuid": "PROJECT_UUID"
}

API-created issues enter the selected team's Triage queue (see Triage and public issue forms). Issues created in the Magpie app go straight into the team's workflow, as on the website. Update an issue with PATCH /api/v1/issues/ISSUE_UUID; supported fields are title, description_markdown, status, priority, assignee_user_id and due_date; the OpenAPI file gives each field's maximum length. Use null to clear an assignee or due date. Issue writes require edit access to the selected team. DELETE /api/v1/issues/ISSUE_UUID moves an issue to Trash, where it can be restored for 30 days. Use GET /api/v1/issues/trash to list issues in the selected team's Trash and POST /api/v1/issues/ISSUE_UUID/restore to restore one before its restore_until time. Delete and restore require team edit access. Issues in Trash no longer appear in the ordinary issue list or detail route.

GET /api/v1/issues/options returns the selected team's statuses in workflow order, priorities, assignable members and projects, and whether you can edit issues there. GET /api/v1/issues/ISSUE_UUID/comments lists an issue's comments, oldest first, and POST to the same address with body_markdown adds one.

GET /api/v1/trash lists the selected team's Trash as the website shows it to the key's owner: a page at a time, newest first, each with its uuid, title, label, area, who moved it, moved_at, restore_until, can_restore and can_delete_forever, and areas with a count for each area. Narrow it with area (such as notes or issues), q and page. POST /api/v1/trash/ENTRY_UUID/restore restores an entry and DELETE /api/v1/trash/ENTRY_UUID deletes it forever; ENTRY_UUID is the entry's own uuid, not the note's or document's. A restore past restore_until answers 410 with restore_window_expired, and one that would go over a plan limit answers 409 with plan_limit. The DELETE routes of notes, documents, presentations, Designs, Idea Boards, forms and screen recordings move them to Trash and answer with restore_until.

Webhook deliveries include X-Magpie-Event, X-Magpie-Id, X-Magpie-Timestamp, and X-Magpie-Signature. Verify the timestamp and HMAC signature before processing the body. Store the delivery ID so a retry is not applied twice.

Repeated requests carrying a key the API rejects are limited. After about twenty, the API answers 429 with a Retry-After header giving the number of seconds to wait; a request that authenticates clears the count. Check which key the integration sends, and whether it was revoked, before retrying.

Never put a secret key in browser JavaScript, a public repository, or a URL. If a key may have been exposed, revoke it and make another. For an API response or signature that does not match the reference, Contact support.