---
title: "The board API: tasks, zones and transitions"
description: "Every route is scoped to a tenant and a repo. Intake is one line. The rest of the contract is still moving, and this says so rather than freezing it early."
url: https://commitcycle.com/api/
language: en
---

# The same surface the console uses

> Every route is scoped to a tenant and a repo. Intake is one line. The rest of the contract is still moving, and this says so rather than freezing it early.

API Shipped · contract still moving

There is no second implementation behind the console or the CLI — they both talk to this. Which also means it moves when the product moves, and this page is careful about what it promises.

Intake is one POST with a title and a board credential, so a small bridge you write can file work from whatever you use today.

## What is stable

```
POST /v1/<tenant>/<repo>/tasks
{ "title": "one line", "requested_by": "you@example.com" }
```

- **A board is a pair.** Every route is scoped by path — `/v1/<tenant>/<repo>/…` — and a board is that pair, nothing more.
- **Intake is one line.** A title lands in Triage. A request that has not been scoped is not work in progress, here as everywhere else.
- **State is the gate's to change.** The scoping route silently drops a `state` field, so nothing can start work by writing to it sideways.

## What is still moving

The full payload reference is filed and unwritten, and that is a deliberate order rather than a backlog accident: the shapes are still moving, and **documenting a moving contract produces documentation that lies**. What exists is marked pending; what is written above is what has held.

If you are building against this now, the version handshake is the part to wire first — a stale client is told so in one line instead of discovering it as a rule disagreement later.

## Where it stops

- **It is not the enforcement path.** The hook never calls the network to decide, so an API outage cannot open a zone — it was never in the deny path.
- **It cannot read your branch.** A close needs a change manifest: `cycle verify --close` builds it on the machine with the branch, and the API receives it. The one diff the board reads for itself is a merged pull request's file list, from GitHub, where its App is installed (CC-1346, CC-1352).

The routes as they stand are in [the API reference](https://commitcycle.com/docs/reference/api/). For most work the [CLI](https://commitcycle.com/cli/) and the [MCP server](https://commitcycle.com/mcp/) are the shorter path.

## Questions this page answers

### Is the CommitCycle API stable enough to build against?

The addressing and intake are: a board is a tenant/repo pair, and POST /tasks with a title lands in Triage. The richer payloads are still moving with the phases, so anything beyond those is documented as pending rather than published and then broken.