API

CardBoard exposes four integration surfaces with different audiences and stability commitments.

REST API

A small, stable REST surface over five resources. Authentication is HTTP Basic (username is your email, password is your API key), and your organization must have API access enabled.

Path	Verbs
`/api/maps`	GET, POST
`/api/maps/:id`	GET, PUT, DELETE
`/api/maps/:map_id/cards`	GET, POST
`/api/maps/:map_id/cards/:id`	GET, PUT, DELETE
`/api/maps/:map_id/cards/:id/badge`	GET
`/api/maps/:map_id/cards/:card_id/card_comments`	POST, PATCH
`/api/users`, `/api/users/:id`	GET

Card groups, release slices, connections, reactions, and stickers are not exposed via REST today. Use the MCP server for those. Results are paginated (default 10 per page; page_length=0 returns everything).

MCP server

For AI agents to read maps, propose changes, and answer when they’re summoned. Authenticated with OAuth 2.0 (mcp scope) at POST /mcp; clients register themselves, and access tokens refresh. Connect from Settings → Agents (/my/agents), which has setup guides for Claude (Desktop, Code, and claude.ai), ChatGPT, Cursor, and GitHub Copilot. Any MCP client works. MCP is free on every plan.

Read tools

Tool	What it returns
`list_maps`	Maps you can open
`get_map`	A map’s cards, connections, card groups, release slices, tracker links, and its map type’s rules and anti-patterns
`get_cards`	A map’s cards, in full or summary, optionally scoped to a subtree or a slice
`get_card`	One card with its parents, children, connections, groups, citations, and proposal history
`search`	Matches across your workspaces, as pointers (use `get_card` for the content)
`get_mentions`	Your open summons: cards where someone @mentioned an agent for you

Write tools

Tool	What it does
`create_map`	Creates a map from a map type or from Mermaid (`flowchart`, `mindmap`, `sequenceDiagram`). Direct, not a proposal.
`propose_card` / `propose_cards`	One card, or up to 50 in one batch with up to 10 new release slices on a story map
`propose_card_update`	Title, description, acceptance criteria, status, type, or color
`propose_card_move`	Moves a card to a new lane, slice, parent, or position
`propose_card_delete`	Deletes a card when accepted
`propose_connection` / `propose_connection_delete`	Adds or removes a connection
`propose_group`	Names a release slice or groups cards
`propose_comment`	Posts a comment as the agent. Direct, not a proposal. This is how an agent answers a summon.

Proposals follow a ghost model: they don’t change the map until a person accepts them, on the canvas or in the Activity drawer. Each ghost shows the connecting tool and the person driving it; accepted work is credited to the person who accepted it.

Summons. Mentioning @Claude (or another connected agent) in a card comment summons that member’s agent to the card. MCP is pull-based, so the summon waits until the agent calls get_mentions. The agent replies once with propose_comment and can propose up to 25 changes per summon.

Directing an agent requires workspace member identity. The agent acts in your name, so the same accountability rule as tracker writes applies: a guest can’t drive one. Workspace admins can turn agent access off from the Security settings.

Marketplace, extension & connector APIs

Specialized endpoints used by CardBoard’s own integrations (the Atlassian/Microsoft marketplace apps, the ADO extension UI, and connector status checks). Not intended for general third-party use.

Webhooks

CardBoard receives inbound webhooks: Stripe (billing) and tracker events from ADO and Jira. Outbound webhooks (CardBoard notifying your systems of card or comment events) are not available today.