TRACE DEVELOPER PLATFORM · API V1

Build defect and task workflows without crossing tenant boundaries.

Each API key is tied to one workspace and explicit scopes. Create operations use idempotency keys, updates use record versions, and every response includes a request ID.

01

Create an API key

Workspace owners and admins create scoped keys in Platform & API. The token is shown once and only its SHA-256 hash is stored.

02

Authenticate

curl https://trace.oronzo.io/api/v1/me \
  -H "Authorization: Bearer $TRACE_API_KEY"
03

Create safely

curl -X POST https://trace.oronzo.io/api/v1/work-items \
  -H "Authorization: Bearer $TRACE_API_KEY" \
  -H "Idempotency-Key: import-row-184" \
  -H "Content-Type: application/json" \
  -d '{"type":"task","title":"Review import","description":"Validate the imported records","status":"backlog","priority":"medium","assignee":"API","tags":[]}'

Operational contract

Keys are limited to 600 requests per minute and workspaces to 3,000. A suspended or delinquent workspace remains readable but public writes are rejected. Never send an organization ID—the credential owns the tenant context.

MODEL CONTEXT PROTOCOL

Connect Claude, Codex, or another MCP client

Use the Streamable HTTP endpoint https://trace.oronzo.io/api/mcp. Codex, Claude, and compatible clients discover Trace OAuth automatically, then ask you to sign in, choose a workspace, and approve scopes. Public clients use CIMD or dynamic registration with PKCE and do not need a client secret. Direct clients may still send a workspace API key as an Authorization: Bearer header.

codex mcp add trace --url https://trace.oronzo.io/api/mcp
codex mcp login trace --scopes work:read,work:write,projects:read

Trace stores only hashed access and refresh tokens. Codex stores the resulting OAuth credentials locally and refreshes them after restart. Review or revoke your grants under Settings → Connected apps.

Grant work:read for search and work-item context, projects:read for projects, and work:write for duplicate-aware creation, updates, and comments. Deletion, security administration, budgets, and critical-defect closure are not exposed to MCP.