Connect Wabi.do
to your other tools —
over HTTP.

Getting a token #

1. Open Wabi and click your avatar, at the bottom of the sidebar.
2. Choose API Tokens, then Create new token.
3. Pick a scope — Read only unless it needs to change things.
4. Copy it. It is shown once and cannot be read again afterwards.

Authentication #

One header, on every request.

Authorization: Bearer wabi_1a2b3c…

Without it, or with a token that has been revoked, you get 401 and nothing else. Tokens do not expire on their own; they last until you delete them.

Scopes

A scope cannot be changed after the fact. Widening one silently would mean a credential you already handed out quietly gaining powers, so instead you create a new token and delete the old one.

Rate limit

120 requests per minute per account. Over it you get 429 with a Retry-After header in seconds. It is set well above what an integration needs and is really there to stop a polling loop that forgot to sleep.

How the token is stored

It is not. We keep a SHA-256 of it and the first few characters, which is why the value is shown once when you create it and never again — and why nobody here can read it back to you. If you lose it, delete the token and create another.

Conventions #

Errors #

Every failure is the same object, so you can handle it in one place.

{ "error": { "code": "invalid_request", "message": "A task needs a title", "field": "title" } }

Versioning & stability #

Every route lives under /api/v1 — the version is in the path.

Build defensively: read the fields you need and ignore the ones you don't, so a new field in a response never breaks your integration.

Idempotency & retries

GET reads nothing and PATCH lands the same result every time, so both are safe to repeat. POST creates a new resource on each call — retry it only after a network error where no response came back, never after a 4xx.

Rate limits

The budget is 120 requests per minute per account. Past it, calls return 429 with a Retry-After header telling you how many seconds to wait — back off for that long rather than retrying immediately.

Objects #

The three resources this API returns. Ids are integers; timestamps are ISO 8601 in UTC.

List

Task

Comment

Member — id (integer), name (string), email (string). Appears inside members, assignee and author.

Lists #

What the product calls a list is a workspace in the database. This layer says list, because that is the word on the screen.

{
  "data": [
    {
      "id": 3,
      "name": "Important and urgent",
      "image": null,
      "created_at": "2026-03-11T08:12:00.000Z",
      "updated_at": "2026-08-05T17:40:00.000Z",
      "task_count": 28,
      "members": [
        { "id": 5, "name": "Noa Barak", "email": "noa@example.com" }
      ]
    }
  ],
  "pagination": { "limit": 50, "offset": 0, "total": 12, "has_more": false }
}

{ "name": "Q3 launch" }

{
  "data": {
    "id": 41,
    "name": "Q3 launch",
    "image": null,
    "created_at": "2026-08-05T18:02:11.000Z",
    "updated_at": "2026-08-05T18:02:11.000Z",
    "task_count": 0,
    "members": [ … ]
  }
}

{ "data": { "id": 3, "name": "Important and urgent", "task_count": 28, "members": [ … ] } }

{ "name": "Q3 launch — shipped" }

{ "data": { "id": 41, "name": "Q3 launch — shipped", … } }

Tasks #

A task belongs to exactly one list. Moving it between lists is a field on the task, not a separate call.

{
  "data": [
    {
      "id": 902,
      "list_id": 3,
      "title": "Send the quote to Dana",
      "status": "open",
      "due_date": "2026-08-09T21:00:00.000Z",
      "is_private": false,
      "assignee": { "id": 5, "name": "Noa Barak", "email": "noa@example.com" },
      "tags": [ { "id": 2, "name": "urgent", "color": "#ee1c4e" } ],
      "created_by": 5,
      "created_at": "2026-08-02T06:30:00.000Z",
      "updated_at": "2026-08-05T11:20:00.000Z"
    }
  ],
  "pagination": { "limit": 50, "offset": 0, "total": 28, "has_more": false }
}

{
  "title": "Send the quote to Dana",
  "due_date": "2026-08-10T00:00:00+03:00",
  "assignee_id": 5,
  "is_private": false
}

{ "data": { "id": 902, "list_id": 3, "title": "Send the quote to Dana", … } }

{ "data": { "id": 902, "list_id": 3, "status": "open", … } }

{ "status": "complete" }

{ "data": { "id": 902, "status": "complete", "updated_at": "2026-08-05T18:14:02.000Z", … } }

Comments #

The conversation on a task. Wabi's own entries — “status changed to complete” — are not comments and do not appear here.

{
  "data": [
    {
      "id": 5512,
      "task_id": 902,
      "content": "Sent it this morning.",
      "author": { "id": 5, "name": "Noa Barak", "email": "noa@example.com" },
      "created_at": "2026-08-05T09:02:00.000Z",
      "updated_at": "2026-08-05T09:02:00.000Z"
    }
  ],
  "pagination": { "limit": 50, "offset": 0, "total": 3, "has_more": false }
}

{ "content": "Sent it this morning." }

{ "data": { "id": 5512, "task_id": 902, "content": "Sent it this morning.", … } }

{ "content": "Sent it this morning, quote #4471." }

{ "data": { "id": 5512, "content": "Sent it this morning, quote #4471.", … } }

Webhooks #

Have us POST to you when something changes, instead of asking. Set one up under your avatar → Webhooks: a URL, the events you want, and a signing secret you can copy.

Events

An endpoint only ever receives events about lists you belong to, and a private task stays with whoever wrote it — the same boundary the API enforces.

What arrives

A POST with a JSON body and three headers.

X-Wabi-Event:     task.created
X-Wabi-Delivery:  evt_9f2c4a1b7e3d5064
X-Wabi-Signature: sha256=8c1f…

{
  "id": "evt_9f2c4a1b7e3d5064",
  "type": "task.created",
  "created_at": "2026-08-07T09:14:02.000Z",
  "data": {
    "task": {
      "id": 902,
      "list_id": 3,
      "title": "Send the quote to Dana",
      "status": "open"
    },
    "internal_event": "task_created"
  }
}

internal_event is a hint, not part of the contract — it names the specific change behind a broad type, so you can tell a rename from a due-date change without us minting an event per field. Build against type.

Check the signature before you trust the body

Every request is signed with your endpoint's secret, over the exact bytes we sent. Without this check, anyone who learns your URL can post whatever they like to it — and a webhook URL leaks easily, through logs, screen shares and debugging tools.

const crypto = require("crypto");

function verify(rawBody, header, secret) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// rawBody must be the raw request body, NOT a re-serialised object —
// JSON.stringify(JSON.parse(body)) can reorder keys and change the signature.
app.post("/hooks/wabi", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.body, req.get("X-Wabi-Signature"), process.env.WABI_SECRET)) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body);
  res.sendStatus(200);   // answer first, do the work after
});

Answering

Any 2xx means received. Anything else — or a timeout after 10 seconds — is a failure and we try again, backing off: roughly 10 seconds, then a minute, 5 minutes, 25 minutes, 2 hours. After 6 attempts that delivery is abandoned.

Answer quickly and do the work afterwards. If you finish your processing before replying, a slow job turns into a timeout and then into duplicate deliveries of something you already handled.

An endpoint that fails 10 times in a row is switched off, and you will see it paused on the settings screen. Fix the receiver and press resume.

Two requirements