0.x — pre-release, no compatibility promise yet.What this means
Register an OAuth app (a confidential app's secret is shown once)
Register an app (owner / admin). A confidential app’s client_secret is in this response only — store it now.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”The request body of oauth-clients.create.
object
The organization that owns the app (you must be its owner or admin)
Shown to people on the consent screen
confidential: a server that keeps a secret. public: a native or single-page app with no secret (PKCE only).
Exact-match allow-list: https, or http on a loopback host (localhost, any port). No fragment.
The scopes the app may ask for: tasks:read, tasks:write, projects:read, projects:write, teams:read, teams:write, org:read, org:write, webhooks:read, webhooks:write, admin.
Example
{ "org_id": "string", "name": "Acme HR", "client_type": "confidential", "redirect_uris": [ "https://hr.example.com/oauth/callback" ], "allowed_scopes": [ "tasks:write", "projects:read" ], "logo_url": "string", "homepage_url": "string", "privacy_url": "string"}Responses
Section titled “ Responses ”Successful Response
Returned by oauth-clients.create and oauth-clients.rotate_secret.
object
Public identifier (tmc_…)
private: people outside your organization see an unreviewed-app warning when connecting
People connected to the app right now
Example
{ "allowed_scopes": [ "tasks:write", "projects:read" ], "client_id": "tmc_Q2x9eLr0v2Zk5n8WcHt1YpUo", "client_secret": "tmcs_Ab3xQ9eLr0v2Zk5n8WcHt1YpUo4MiGs7Fj6Da-_Bq0R", "client_type": "confidential", "created_at": "2026-09-26T12:00:00Z", "created_by": "3f1c2a9e-0b7d-4c1e-9a55-2b8f0d6e4a10", "grants_count": 3, "homepage_url": "https://hr.example.com", "last_used_at": "2026-09-26T12:00:00Z", "name": "Acme HR", "org_id": "O0020", "redirect_uris": [ "https://hr.example.com/oauth/callback" ], "registration": "developer", "review_state": "private", "status": "active", "updated_at": "2026-09-26T12:00:00Z", "use_count": 1204}Bad request — a query parameter outside what the operation accepts (invalid-parameter)
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Bad request", "status": 400, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Missing or invalid bearer token
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Missing or invalid bearer token", "status": 401, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Authenticated, but not allowed
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Authenticated, but not allowed", "status": 403, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Not found
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Not found", "status": 404, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Conflict (a duplicate, or an Idempotency-Key still in flight)
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Conflict (a duplicate, or an `Idempotency-Key` still in flight)", "status": 409, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}If-Match does not match the current ETag
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "`If-Match` does not match the current `ETag`", "status": 412, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}The body or query did not validate (validation), or an Idempotency-Key was reused
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "The body or query did not validate (`validation`), or an `Idempotency-Key` was reused", "status": 422, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}An access token over its per-minute limit (rate-limit; see Retry-After)
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "An access token over its per-minute limit (`rate-limit`; see `Retry-After`)", "status": 429, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Unexpected server error — quote request_id
An RFC 9457 problem details object — the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:tasksmate:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
Example
{ "type": "about:blank", "title": "Unexpected server error", "status": 500, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}