Vibeflow
Start free

The Vibeflow API.
v0, documented live.

A REST API over your tasks, boards, comments and files — every endpoint under /api/v0, authenticated with a Bearer token you create yourself. This page is the tour: the full reference lives in the hosted API viewer, rendered from the served contract, so it can never drift from what the server actually does.

Live contract

Read the contract, not a copy of it.

The viewer below renders the exact OpenAPI document the hosted app serves — contract version 0.1.0. When this page and the viewer disagree, the viewer wins.

  • Hosted API viewer — every endpoint, parameter and schema, in your browser.
  • Raw OpenAPI JSON — the same bytes the viewer renders; point your code generator at this URL.

Base URLs

One path prefix, two places it lives.

The API surface is always under /api/v0. Against your own machine it is the board you already run; against the cloud it is your workspace.

Start local with vibeflow kanban (or vibeflow serve in API-only mode) and the API answers on the same port as the board. Local requests carry no quota; cloud requests carry per-token quotas (see errors).

  • Local — http://localhost:3700/api/v0 (port 3700 is the default; use yours if you changed it).
  • Cloud — https://app.vibeflow.tools/api/v0 (Bearer token required).
who am I (cloud)
curl -s https://app.vibeflow.tools/api/v0/me \
  -H "Authorization: Bearer vbf_pat_..."

Authentication

One token, carried as a Bearer.

Cloud calls authenticate with a personal access token sent as an HTTP Bearer token. Create one in the app under Settings → API tokens — the screen links straight to the API reference so the next step is obvious — or programmatically with POST /api/v0/tokens, which takes a name and a scopes array (both required).

The secret is shown exactly once, at creation — after that only the prefix (e.g. vbf_pat_9f2c…) is stored and listed. Lose it and there is nothing to recover: revoke the token with DELETE /api/v0/tokens/{id} and create a new one.

  • Send it every time — Authorization: Bearer vbf_pat_… on each request.
  • Scope it down — each endpoint declares the scope it needs (see the table below); a token without it gets 403.
  • Expiry is optional — pass expiresAt at creation if you want the token to die on its own.
create a token
curl -s -X POST https://app.vibeflow.tools/api/v0/tokens \
  -H "Authorization: Bearer vbf_pat_..." \
  -H 'Content-Type: application/json' \
  -d '{"name": "ci", "scopes": ["tasks:read"]}'

Scopes you will see. tasks:read / tasks:write, boards:read / boards:write, comments:read / comments:write, files:read / files:write, settings:read / settings:write, profile:read and tokens:manage. One endpoint is public without any token: GET /api/v0/changelog.

Endpoint groups

What the API covers.

The groups below are the whole v0 surface. Parameters, bodies and schemas for each live in the viewer — what follows is the map, not the territory.

Vibeflow API v0 endpoint groups
Group Endpoints Scope
Tasks GET / POST /api/v0/tasks, GET / PATCH / DELETE /api/v0/tasks/{id}, open / expand / links sub-resources tasks:read / tasks:write
Boards GET / POST /api/v0/boards, GET / PATCH / DELETE /api/v0/boards/{id} boards:read / boards:write
Agent POST …/tasks/claim-next, POST …/tasks/{id}/verify, POST …/tasks/{id}/prompt, POST …/tasks/{id}/auth-state tasks:read / tasks:write
Comments GET / POST …/tasks/{id}/comments, PATCH / DELETE …/comments/{commentId} comments:read / comments:write
Files GET / POST …/tasks/{id}/files (+ {fileId} fetch/delete), screenshot, baseline and baseline-page captures files:read / files:write
Meta GET /api/v0/project, GET /api/v0/me, GET / PATCH /api/v0/settings, GET /api/v0/changelog (public) varies — see viewer
Auth GET / POST /api/v0/tokens, DELETE /api/v0/tokens/{id} tokens:manage
MCP GET / POST /mcp — the Streamable HTTP endpoint (see the MCP setup guide) token scopes

Example

List your todo tasks.

The shapes below are real: the query parameters, the { items, nextCursor } envelope and the summary fields come straight from the contract.

Filter with status (one of backlog, todo, in-progress, review, done, cancelled), page with limit and cursor. Creating a task is the mirror image: POST /api/v0/tasks with at least a title.

request
curl -s 'https://app.vibeflow.tools/api/v0/tasks?status=todo' \
  -H "Authorization: Bearer vbf_pat_..."
200 response
{
  "items": [
    {
      "id": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
      "externalId": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
      "title": "Annotate the checkout button",
      "status": "todo",
      "commentCount": 2,
      "fileCount": 1,
      "createdAt": "2026-10-10T09:00:00.000Z"
    }
  ],
  "nextCursor": null
}

Errors and quotas

One error shape, three quota buckets.

  • Every failure is { "error": "…" } — the message is required; code and details appear when there is more to say. 401 means the token is missing or invalid, 403 means it lacks the scope.
  • Cloud quotas are per token — reads 300/min, writes 60/min, token creation 10/hour. Past the limit the API answers 429 with a Retry-After header: wait, then retry.
  • Local has no quotas — against localhost the limits above do not apply.

Versioning

v0 means pre-stable. Plainly.

The API is v0 and the contract is version 0.1.0: paths, fields and quotas can change without notice, and breaking changes are allowed until v1. Build against the live contract rather than this page, and expect to adapt your integration when it moves. When v1 lands, that stability commitment will be written here — not before.

If something looks wrong

Common questions.

Is the v0 API stable?

No — v0 is pre-stable. Paths, fields and quotas can change without notice until v1, so pin your integration to the live contract and expect to adapt it.

Where is the full endpoint reference?

In the hosted viewer, rendered from the served OpenAPI document at /api/openapi.json (contract version 0.1.0). This page is the tour; the viewer is the truth.

I lost my token secret. Can I see it again?

No — the secret is shown once at creation and only the prefix is stored afterwards. Revoke the token (DELETE /api/v0/tokens/{id}) and create a new one.

Related pages

Ten seconds to your
first annotated task.

No account, no cloud, no browser extension.

Get started free Star it on GitHub

Apache-2.0 · Node.js 22+ · tasks stay in your repository