Skip to content
Onplana Docs

API terms

All plansDeveloper or integrator

These terms cover every programmatic way into Onplana: the REST API, webhooks, the OData reporting feed and the MCP server. They sit alongside the Terms of service and the Acceptable use policy, which apply in full.

The token is the person

Section titled “The token is the person”

A personal access token acts as the person who created it, in the one organization it was created in, and can never do more than that person can. Everything a token does is recorded as that person’s action.

  • Keep tokens secret. Do not put them in client-side code, public repositories or shared documents.
  • Give a token only the scopes and projects it needs, and an expiry.
  • Revoke a token the moment it is no longer needed or may have leaked. See Create API tokens.
  • When a person leaves an organization, their tokens stop working there.

Acceptable use

Section titled “Acceptable use”
  • Use the API to work with data your organization holds and you are allowed to see.
  • Do not scrape, enumerate or try to reach other workspaces, or data you have not been given access to. Probing for another organization’s ids counts.
  • Do not resell or redistribute the API itself, or use it to build a service that copies Onplana.
  • Stay within the rate limits. Limits are set per route family; when a request is refused with 429, wait for the Retry-After time before trying again, and do not spread load across tokens to get around a limit.
  • Do not send malware, spam or content the Acceptable use policy forbids through webhooks, the API or an agent.

We may suspend a token or an integration that breaks these terms, and will tell the token’s owner why.

Changes to the API

Section titled “Changes to the API”
  • Adding fields, routes, events or optional parameters is not a breaking change. Build your client to ignore fields it does not know.
  • A breaking change (removing or renaming a route or field, changing a type, or tightening a rule an existing request passed) is announced at least 90 days before it takes effect, in What’s new and by email to the owners of organizations whose tokens used the route in the last 30 days.
  • A change needed to fix a security problem may come with less notice. We will say so when it does.
  • The OpenAPI spec at https://api.onplana.com/api/openapi.json describes the API as it is today.

Support

Section titled “Support”

Write to support@onplana.com. Include the requestId from the error response and the time of the request; never send the token itself.