API and webhooks

Connect your other software to Projects with the REST API, and be told the moment something happens with webhooks.

Both are under Settings > API & webhooks (admins), in the Professional plan and above. The Professional plan has 2,000 API calls a day and 5 webhook addresses; the Business plan has 25,000 calls a day and no limit on webhook addresses.

API keys

Click New key, name it and choose Read only or Read & write. Copy the key at once - it is shown only once. A key works as you: it sees and changes only what your Projects role allows. Revoke a key you no longer use.

Using the API

The address is https://www.ellibo.com/projects/api.php/v1. Send the key in the header Authorization: Bearer <key>. Bodies are JSON.


`GET /me`, `/users`	You, and the team
`GET /projects`, `/projects/{id}` · `POST /projects` · `PATCH /projects/{id}`	Projects
`GET /tasks?project_id=&open=1&owner_id=&updated_since=` · `GET /tasks/{id}` · `POST /tasks` · `PATCH /tasks/{id}` · `DELETE /tasks/{id}`	Tasks
`GET /tasks/{id}/comments` · `POST /tasks/{id}/comments`	Task comments
`GET /issues?project_id=` · `GET /issues/{id}` · `POST /issues` · `PATCH /issues/{id}` · `DELETE /issues/{id}`	Issues
`GET /milestones?project_id=`	Milestones
`GET /timelogs?project_id=&from=&to=` · `POST /timelogs`	Time

Lists come in pages: page, per_page (up to 200) and has_more. Errors look like {"error": {"code": "...", "message": "...", "field": "..."}} (422 when a field needs fixing). Blueprints, plans and roles apply to the API just as on the screens. Each business has a number of calls a day (UTC); the page shows how many are used.

Example - add a task:

curl -X POST -H "Authorization: Bearer pjk_..." -H "Content-Type: application/json" \
     -d '{"project_id": 12, "name": "Call the supplier", "due_date": "2026-11-20"}' \
     https://www.ellibo.com/projects/api.php/v1/tasks

Webhooks

Click New webhook, enter your https:// address and pick the events: tasks added, changed, closed or deleted; issues reported, changed, resolved or deleted; projects added, changed or deleted; comments; time logged. Copy the signing secret - it is shown only once.

Each event is a JSON POST with the headers X-Ellibo-Event, X-Ellibo-Delivery, X-Ellibo-Timestamp and X-Ellibo-Signature: sha256=<HMAC-SHA256 of "timestamp.body" with the secret>. Check the signature before you trust the data.

Answer with a 2xx status. If the address doesn't, the delivery is tried again after 1, 5, 30, 120 and 720 minutes; admins are told when one is given up. Test sends a ping; Recent deliveries shows what went and what came back.