REST API

For CI, scripts and imports from other tools. JSON both ways.

• Base: https://tracker.aquarela.app/api/v1
• Authentication: a personal token in the Authorization: Bearer <token> header. The person creates the token at https://tracker.aquarela.app/account/tokens, picks how long it lasts (30, 90, 180, 365 days) and whether it can create issues; the token works for the organization it was created in, is shown only once and can be revoked on the same screen (up to 20 active per person). MCP OAuth tokens don't work in the API.
• Same rules as the interface: the token sees only the person's projects and creates issues only where their role allows. A person deactivated or removed from the organization turns the token off immediately.
• Links: an issue's url is the canonical link by code, https://tracker.aquarela.app/issues/MOB-0012?org=<company slug>, which is readable, typeable and keeps working after the issue moves to another project (the old code still opens it). The prefix is unique only within a company, so org says which one: the app switches to it when the person is a member. Without org, /issues/MOB-0012 looks first in the selected company and then in the person's other companies (if the code exists in more than one, it asks which one to open); /issues/<id> also works, in any of the person's companies.
• Limit: 120 calls per minute per token (429 with Retry-After).
• Errors: {"error": "<code>", "message": "<text>"}, with 400 (invalid data, plus details per field), 401 (missing or invalid token), 403 (role or token without permission), 404 (also for a project in the trash and its issues: deleting and restoring projects happens in the app, admins only), 409 (already exists), 413, 415, 422 (refused by the project's rules), 429. message comes in the token owner's language (locale in GET /me; on Automatic, the request's Accept-Language); error doesn't change.
• GET /version (public, no token): the version of tracker that's live, {"version": "0.2.0", "commit": "5f83c7b"} (commit is the deploy, null outside one). The v<version> tag on GitHub marks each version. GET /me and whoami return the same in server.

Markdown: every long text is markdown. On an issue, description and the other long texts (preconditions, steps_to_reproduce, actual_result, expected_result, impact, suggested_solution, root_cause, fix_notes) and the text of comments; outside issues, release notes, the precondition, data, steps and expected result of test cases, the comment of each test result, the description and replies of ideas, status page incident updates, the comment on logged hours and the one on approval decisions. You can use **bold**, *italic*, ~~strikethrough~~, lists with - or 1. (sublists indented two spaces), code between backticks (one for inline, three for a block), [link](https://...), > quote and headings with ##. The API returns the text as written (raw markdown); tracker's screens (web and app) and e-mails show it formatted. HTML isn't interpreted.