Introduction

Welcome to the reference for the Quire REST API!

The Quire REST API provides a broad set of operations and resources that:

• Consistently do repetitive or tedious tasks.
• Chain a process together for your team’s process and workflow.
  • Pull information from other locations such as email and Evernote into Quire.
  • Push information from Quire to other locations such as email and Zapier.

Want to share your thoughts on how Quire API works for you? Tell us how you feel about using our API and what we can do to make it better.

REST is a web-service protocol for rapid development by using HTTP and JSON technology.

API Changelog

You can find the Changelog of the API Reference in the Quire Community.

Authentication

For full setup instructions, see our Complete Setup Guide on the Quire blog.

OAuth v2.0

Quire uses OAuth v2.0 to authenticate your app and access the Quire REST API on a user’s behalf—without requiring the user’s password.

Authenticating via OAuth2 requires the following steps:

1. Register Your Application on Quire
2. Ask a Quire User to Grant Access to Your Application
3. Retrieve an Access Token
4. Make Authenticated Requests

Register Your Application on Quire

1. Give your app a cool name

Your app deserves a cool name that lives up to its broad range of great features.

All of the app users will see this name in public, so think carefully!

2. Choose the Quire Organization that your app belongs to

You can choose an organization in Quire that your app belongs to.

If one day you decide to leave the organization, you will lose the authority to manage the app.

3. Redirect URL

When users grant your app authorization request, users will be directed to the configured URL that you’ve set.

4. Choose permission scopes

You can set permission on what your app can do with Quire. There are several options for you to choose from.

Note: If none of the options is selected, the app can only read user’s data.

5. Development Client ID and Client Secret

The Client ID and Client secret will be automatically generated as you create an app.

The Client ID is a unique ID to identify your app.

You should keep your client secret safe, which means you should never share your client secret with anyone. If you choose to regenerate the client secret, the old one will immediately become invalid.

6. Update your App

If your app hasn't been published to Quire App Directory, it will remain as unpublished status. You can still use the configured shareable link in the Developer App Console Distribution to share the app with other users for testing or integration.

When you make changes to the app, you can use the shareable link to access the development copy as well. Working on your development copy will not affect your live App Directory app. When your updated app is ready to be published and replaced the old version on Quire App Directory, your published app will have a different Client ID to the unpublished one.

There are two sets of Client ID and Client Secret.

• Development set - should be used during developing and testing internally of the app.
• Production set - should be used once your app is ready and published on Quire App Directory.

Fulfill Authorization Request

Ask a Quire User to Grant Access to Your Application

Once registering your application, you can ask your user to grant access to your application.

The authorization endpoint lets users grant your app access to the requested permissions.

The authorization endpoint should look like this:

https://quire.io/oauth?client_id=your-client-ID&redirect_uri=your-redirect-uri

After your user clicks Allow, the access will be granted, and he will be redirected to the URL you specified in the redirect_uri parameter with an authorization code provided as a query parameter called code.

After your app is granted, you can have an authorization code to exchange access token for access Quire API. The redirect_uri is optional. If not being specified, we will automatically use the one that is previously detected in the app. If specified, the redirect URL must start with the prefix of the one that was previously detected in the app.

Parameter	Value
client_id	{your-client-ID}
redirect_uri	Optional. The redirect URL after granted. If specified, it must match the redirect URL specified in your app's config. Otherwise, the configured URL will be used.
state	Optional. A random string generated by your app to protect from XSRF.

Retrieve Access Token

To retrieve the access token, you have to post a request to https://quire.io/oauth/token with the following data:

Parameter	Value
grant_type	authorization_code
code	{your-authorization-code}
client_id	{your-client-ID}
client_secret	{your-client-secret}

curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=Your_code_from_previous_step&client_id=Your_app_client_id&client_secret=Your_app_client_secret" \
  https://quire.io/oauth/token

Then, the access token will be returned in the response's body.

{
  "access_token":"ACCESS_TOKEN",
  "token_type": "bearer",
  "expires_in":2592000,
  "refresh_token":"REFRESH_TOKEN"
}

The token should be kept carefully and permanently since you need it to access every Quire API.

PKCE Support

Quire supports PKCE (RFC 7636) for public clients such as single-page apps. To use it:

1. Add code_challenge and code_challenge_method=S256 to the authorization request.
2. Send code_verifier instead of client_secret when exchanging the authorization code for a token.

Note: Only S256 is supported. PKCE tokens do not include a refresh_token.

Use Access Token to Access Quire API

In each request, the access token must be put in the header. The header name is Authorization and the value is Bearer your_token.

After you exchange the access token, your app can make requests to Quire API on behalf of the authorized users.

curl -H 'Authorization: Bearer {access_token}' \
https://quire.io/api/user/id/me

{
  "email": "[email protected]",
  "website": "https://coolwebsites.com",
  "id": "My_ID",
  "description": "This is *cool*!",
  "url": "https://quire.io/u/My_ID",
  "nameText": "My Name",
  "nameHtml": "My Name",
  "descriptionText": "This is cool!",
  "descriptionHtml": "This is <i>cool</i>!",
  "image": "https://quire.s3.amazonaws.com/oid/image.jpg",
  "iconColor": "37",
  "name": "My Name",
  "oid": "Dyh2YkFcu9uLgLFIeN1kB4Ld"
}

Token Expiration

A refresh token might stop working for one of these reasons:

• The user has revoked your app's access.
• The refresh token has not been used for 6 months.

Publish App

By default, your app will be set as Private. You can change the app distribution to Public so that other Quire users can install your app to their workspace as well.

If your app is made available on Quire App Directory and you want to delete the app, you should communicate with your users first before depreciating the app.

WebHook

When one event on Quire is triggered, the system will send a payload to the webhook's configured URL.

A webhook is used by Quire to call an app, while Quire API is used by an app to call Quire. To receive these events, you have to specify a valid URL for Webhooks when configuring your app.

For a complete guide, see our blog post.

System Events

A system event is used to notify your app about system or app's activities.

Token Expiration

When the token has been expired or revoked, an event will be sent to your app. You can clean up your storage if necessary.

{
  "type": "system",
  "token": "hook-token-defined-by-you",
  "secret": "secret-defined-by-you",
  "data": {
    "type": "token-revocation",
    "token": "the-refresh-token"
  }
}

Host Revocation

When the user revokes the grant to a host (either a project or an organization), an event will be sent to your app. You can clean up your storage if necessary.

{
  "type": "system",
  "token": "hook-token-defined-by-you",
  "secret": "secret-defined-by-you",
  "data": {
    "type": "host-revocation",
    "token": "the-refresh-token",
    "host": "host-oid",
    "otype": "host-type",
  }
}

Notification Events

A notification is the information about an update (aka., an activity). Here is an example:

{
  "type": "notification",
  "token": "hook-token-defined-by-you",
  "secret": "secret-defined-by-you",
  "projectSummary": {
    "oid": "project-oid-where-event-occurred",
    "id": "project-id"
  },
  "organizationSummary": {
    "oid": "organization-where-event-occurred",
    "id": "organization-id"
  },
  "data": {
    "type": 0, //activity's type
    "when": "2019-09-30T08:20:12.000Z",
    "what": {
      "oid": "YxjapXXRCOYxoaiCT4tT3OQm", //OID of a task, project, or organization depending on type
      "id": 101,
      "name": "Brand new start",
      "parent": {
        "oid": "parent-oid",
        "id": "parent-id",
        "parent": {
          "oid": "grand-parent-oid",
          "id": "grand-parent-id",
        }
      }
    },
    "user": {
      "oid": "1AbDEFed2A5031BEDDweqmde", //OID of the user
      "id": "john.doer",
      "name": "John Doer"
    },
    "message": "<a href=\"https://quire.io/u/john.doer\">John Doer</a> added <a href=\"https://quire.io/w/MyProjects/101\">Brand new start</a>",
    "text": "John Doer added Brand new start",
    "url": "https://quire.io/w/MyProjects/101"
  } 
}

• The data map may also include an optional value field, which provides detailed information as a map. For example, for an assignment notification, value includes the assignee’s ID, name, and URL.

• If the notification is about a start or due change, the data map will include an additional due field. This value is a date/time formatted in the user’s locale and time zone.

• If the event notifies a task update and the task has a parent, the parent information is included in the parent field. The parent field is a map containing the task’s oid and id. If the task’s parent also has a parent, the map includes a nested parent field as well.

• The projectSummary and organizationSummary fields provide information about the project and organization where the event occurred.

• There is an additional field, taskSummaries, for activities that can affect multiple tasks (for example, removing a task that has subtasks). This field is a list of map instances. Each map represents a task that was changed. If any of that task's subtasks were also changed, they are included in the map’s tasks field.

  • Please refer to Activity Types | taskSummaries.

Registration for Notifications

For instructions on updating a project, see Update a project by OID.

If the app wants to receive notifications of a specific projects or tasks, it can follow the projects or apps by sending a PUT request to the URL. To add a follower, the body of the request can be:

Syntax 1

{
  "addFollowers": ["app"]
}

where app is a keyword. It indicates that the app would like to receives the notifications about the given target (a project or a task). That is, it'll add the app into the target's followers.

Syntax 2

In additions, you can specify additional information that will be passed as part of a notification in the following syntax.

"app|team|channel"

where app is a keyword while team and channel are application specific. That is, you can pass any value to team and channel.

Note: team and channel can not contain '|'.

For example,

{
  "addFollowers": ["app|extra101"]
}

Then, the notification will carry additional field called team with the value "extra101":

{
  "type": "notification",
  "team": "extra101",
  "data": {
    //refer the Notifications section for details
  }
}

Another example:

{
  "addFollowers": ["app|extra101|channel9"]
}

You'll get:

{
  "type": "notification",
  "team": "extra101",
  "channel": "channel9",
  "data": {
    //refer the Notifications section for details
  }
}

Syntax 3

"app|team|channel|mine"

where both app and mine are keywords. It is similar to Syntax 2, except it receives only notifications that match the notification setting of the user.

If you don't need both team and channel, you can specify: "app|||mine.

The notification setting can be found at https://quire.io/w/YourProject?view=setting&tab=options#notifications

Syntax 4

"app|/path"

where app is a keyword, and /path is application specific. The path will be appended to the app's hook URL. For example, assume the app's hook URL is "https://super.app/hooks/standard", and the follower "app|/soc/id279/channel51". Then, the notification will be posted the following URL: "https://super.app/hooks/standard/soc/id279/channel51".

Syntax 5

If you'd like to pass additional information in this syntax, you can append it as follows.

"app|/path|channel"

For example, app|/soc/id8|box51. Then, box51 will be part of the JSON object sent to the hook URL.

{
  "type": "notification",
  "channel": "box51",
  "data": {
    //refer the Notifications section for details
  }
}

Responding and Retries

When receiving the notification, your Web Hook shall return a status code between 200 and 299 to indicate success.

If a status code other than above is returned, we will retry 15 minutes later, then 1 hour later and 1 day later.

Activities Types

• Activity Types

Rate Limits

To protect the stability of the API and keep it available to all users, Quire enforces multiple kinds of rate limiting. Requests that hit any of our rate limits will receive a 429 Too Many Requests response. We may change these quotas or add new quotas in the future.

Here are the limits for free plans.

Plan	Maximum requests per organization, per minute	Maximum requests per organization, per hour
Free	25	120

Note: the limit is per-organization. It sums up the total number of all accesses from all applications for each organization. For more quota, please refer to Pricing.

When a rate limit is exceeded, the response includes a standard Retry-After header whose value is the number of seconds to wait before retrying. The value reflects the time until the offending per-minute or per-hour counter resets, so clients can back off precisely instead of guessing.

HTTP/1.1 429 Too Many Requests
            Retry-After: 37
            Content-Type: application/json
            
            {"code": 429, "message": "..."}
            

Size limits

The size of each request can't be larger than 1MB. Requests that hit this limit will receive a 413 Content too large response.

Status Codes

Code	Meaning	Description
200	Success	Request successful
400	Bad Request	You're using a wrong parameter, or passing incorrect data.
401	Unauthorized	Invalid or expired token.
402	Payment required	The organization’s subscription does not permit use of this app.
403	Forbidden	Not authorized to access the resource.
404	Not Found	The specified resource could not be found.
405	Method not allowed	Method not allowed or supported.
409	Conflict	There is already a resource with the same criteria.
413	Content too large	The request's content is larger than 1MB.
418	Not valid JSON content	The request's content doesn't appear to be JSON.
429	Too Many Requests	Exceeded the rate limit for API calls
500	Internal Server Error	There is an unexpected error.
503	Service Unavailable	Server is down for maintenance.

Error Responses

The following JSON data is returned in the response body when an error occurs.

{
    "code": a_number,
  "message": "an error message here"
}

Error Code	Meaning
100	General authentication error.
400	Bad request including wrong request body, wrong parameter and so on.
401	Invalid or expired token.
403	Forbidden.
404	Resource not found.
405	Method not allowed.
413	Request too large.
429	Too many invocations.
469	Quota exceeded, such as number of projects and number of members.
500	General invocation error. Most likely, an internal error.

Quire MCP Server

Quire offers an MCP (Model Context Protocol) server that lets AI assistants — Claude, ChatGPT, Cursor, VS Code, and other MCP-compatible clients — work with your Quire workspace through natural language.

Once connected, the assistant can list and search your projects, create or update tasks and subtasks, post comments, manage tags, sublists, statuses, documents, chats, insights, and more — all on your behalf and within the permissions you grant.

Quire MCP is built on top of the same Quire REST API documented here, so anything an integration can do via REST is reachable from an AI assistant once it is connected.

Server URL

The Quire MCP server is hosted at:

https://mcp.quire.app/mcp

Authentication is handled by OAuth 2.1 — your AI assistant walks you through the standard authorization screen, you approve access for the workspaces you choose, and the assistant receives a token scoped to your account. No client ID or client secret needs to be configured by the end user.

The server speaks the Streamable HTTP transport and supports Dynamic Client Registration (RFC 7591) and PKCE (RFC 7636), so any compliant MCP client can connect with just the URL above.

What you can do

The Quire MCP server exposes the full Quire object model as MCP tools. At a high level:

Category	What the AI can do
User & Organizations	Identify the current user, look up users, list and update organizations
Projects	List, search, and inspect projects; manage members, custom fields, and approval categories
Tasks	Create, update, move, transfer, complete, approve, and delete tasks; manage dates, peekaboo, and time logs; search across a project, folder, or organization
Bulk operations	Create, update, move, transfer, approve, or delete many tasks in one call
Subtasks & Sublists	Build task hierarchies, group tasks into sublists, and reorder within sublists
Comments & Attachments	Read and post comments on tasks and chats; attach files to tasks or comments
Tags & Statuses	Manage the project's tag library and workflow statuses
Documents	Create, read, update, and delete project documents
Chats & Insights	Start chat threads, post chat comments, and manage insight reports and their fields
Partners	List and inspect partner workspaces
URL resolver	Turn any pasted Quire URL (task, project, document, …) into the underlying object

For the authoritative, always-up-to-date list of tools and their parameters, run tools/list from your MCP client after connecting.

Connect your AI assistant

You only need the server URL — the authorization flow is started by the client and completed in your browser.

Claude Desktop

1. Open Settings → Connectors.
2. Click Add custom connector.
3. Enter a name (for example, Quire) and the URL https://mcp.quire.app/mcp.
4. Save and click Connect. Claude Desktop will open a browser window where you can sign in to Quire and grant access.

Claude Code

Add the server with one command:

claude mcp add --transport http quire https://mcp.quire.app/mcp

Then trigger the OAuth flow from inside Claude Code:

/mcp

Pick quire, follow the link to authorize, and you're done.

Gemini CLI

Edit ~/.gemini/settings.json (user scope) or .gemini/settings.json (project scope):

{
  "mcpServers": {
    "quire": {
      "httpUrl": "https://mcp.quire.app/mcp",
      "authProviderType": "dynamic_discovery"
    }
  }
}

Restart Gemini CLI, then trigger OAuth:

/mcp auth quire

dynamic_discovery makes the CLI auto-detect the OAuth requirement, register a client, and open a browser to authorize. (OAuth requires that your local machine can receive a redirect on http://localhost:7777/oauth/callback.)

ChatGPT

ChatGPT supports remote MCP servers as Connectors (available on Plus, Pro, Business, Enterprise, and Edu plans).

1. Open chatgpt.com and go to Settings → Connectors.
2. Click Add connector.
3. Enter a name (for example, Quire) and the URL https://mcp.quire.app/mcp.
4. Sign in to Quire when prompted and approve access.

Perplexity

Perplexity supports remote MCP servers as Custom Connectors on paid plans (Pro, Max, Enterprise).

1. Open perplexity.ai and go to Settings → Connectors.
2. Click Add Connector → Advanced (or Add custom connector).
3. Enter a name (for example, Quire), set the URL to https://mcp.quire.app/mcp, and choose Streamable HTTP as the transport with OAuth as the authentication method.
4. Save, then click Connect and sign in to Quire to approve access.

Cursor

Add the following entry to your MCP settings (~/.cursor/mcp.json or Settings → MCP):

{
  "mcpServers": {
    "quire": {
      "url": "https://mcp.quire.app/mcp"
    }
  }
}

Reload Cursor and complete the OAuth flow when prompted.

VS Code (GitHub Copilot Chat)

Create or edit .vscode/mcp.json in your workspace (or the user-level equivalent):

{
  "servers": {
    "quire": {
      "type": "http",
      "url": "https://mcp.quire.app/mcp"
    }
  }
}

Open the Command Palette and run MCP: List Servers, select quire, and start it. VS Code will open a browser to authorize.

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "quire": {
      "serverUrl": "https://mcp.quire.app/mcp"
    }
  }
}

Restart Windsurf and authorize when prompted.

Other MCP clients

Any client that supports Streamable HTTP MCP servers with OAuth can connect — just point it at https://mcp.quire.app/mcp. For clients that only speak the older stdio transport, use a bridge such as mcp-remote:

{
  "mcpServers": {
    "quire": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.quire.app/mcp"]
    }
  }
}

Authorization scopes

The first time you connect, Quire shows the standard authorization screen. You can choose:

• Which organizations and projects the assistant may access.
• What it may do — the same permission scopes that apply to regular Quire OAuth apps (see Authentication).

You can revoke access at any time from your Quire account settings, or by removing the connector from your AI client.

Privacy and rate limits

• Quire MCP requests count against the same per-organization API quotas as direct REST calls — see Rate Limits.
• Conversations with your AI assistant are not stored on Quire's servers; the MCP server only sees the individual tool calls the assistant makes on your behalf.
• All traffic is encrypted in transit (HTTPS); access tokens are never exposed to model output.

Troubleshooting

• "Connection refused" or "Failed to authenticate" — make sure the URL is exactly https://mcp.quire.app/mcp (with the /mcp path) and that your client supports the Streamable HTTP transport.
• Authorization screen never appears — some clients require you to manually trigger the OAuth flow (for example, /mcp in Claude Code). Check the client's MCP server panel for an "authorize" button or status message.
• The assistant can't see a project — confirm the project belongs to an organization you authorized, and that your Quire role on that project allows the action you're asking for.
• Tool calls return 429 Too Many Requests — you have hit the per-organization rate limit. The assistant will receive a Retry-After value; wait that many seconds before retrying.

If a problem persists, contact Quire support with the timestamp of the failing request and (if shown) the request ID surfaced by the MCP client.

https://quire.io/api