API & integrations

The REST API

Veqsio exposes a Jira-compatible REST API (version 2 endpoints and a Jira-style agile API), so most existing Jira scripts and libraries work with a different base address. The full, always-current reference is generated from the running server: open REST API reference in the Administration menu (or /api-docs), or fetch the OpenAPI 3.1 document at /rest/api/2/openapi.json and use it with Swagger UI, Postman, Bruno or a code generator.

First calls

# with a personal access token (preferred for scripts)
curl -H "Authorization: Bearer $TOKEN" https://your-host/rest/api/2/myself

# search with JQL
curl -G -H "Authorization: Bearer $TOKEN" \
  --data-urlencode 'jql=project = DEMO AND status != Done ORDER BY created DESC' \
  https://your-host/rest/api/2/search

• Errors are JSON: {"errorMessages": ["…"]}. A resource you may not see answers 404, not 403.
• Requests are rate limited per user and per address; a 429 carries Retry-After.
• Every response has an X-Request-Id; quote it in bug reports, or send your own (8–64 characters).
• Browsers use a cookie session instead (POST /rest/auth/1/session).

Personal access tokens

Create tokens under Profile → Access tokens. Give each a name, the narrowest scopes that do the job and an expiry (default 90 days, at most 365). The secret is shown once. Scopes:

Scope	Allows
read:issues / write:issues	issues, comments, worklogs, attachments, links, search
read:projects / write:projects	projects, versions, components, boards, sprints, the agile API
read:* / write:*	every non-admin endpoint (write includes read)
* or admin	everything the user may do, including administration

A token never exceeds its owner’s permissions, and a limited token can’t create a stronger one.

Outgoing webhooks

Under Administration → Notifications → Webhooks register a URL and the events to send. Each call is signed (HMAC) so the receiver can verify it came from Veqsio, retries on failure, and is recorded in a delivery log.

Inbound webhooks (alerts, CI, scripts)

Let another system open and update issues. In Project settings → Inbound webhooks add a source: an unguessable URL, a secret and a mapping.

• Authentication — HMAC signature of the body (default; GitHub-style headers work), a shared-secret header, or Sentry’s signature. The secret is shown once; New secret replaces it immediately.
• Mapping — a small JSON template turns the payload into a summary, description, priority, labels and a dedup key. Example: "summary": "[{{alerts[0].labels.alertname}}] {{alerts[0].annotations.summary}}", with filters such as default, upper, truncate 80. Templates can’t run code.
• Behaviour — no open issue for the dedup key: create one. An open issue exists (the alert fired again): add a comment. The payload says “resolved”: move it to a done status. A retried delivery with the same idempotency key never duplicates.
• Test — Preview (dry run) shows what a sample payload would do with no side effects; Send as test delivery really processes it. Deliveries keeps the last 100 per source with secrets redacted.

A ready-made Sentry source maps level to priority.

Slack and Microsoft Teams

Send project events to a channel: Project settings → Slack & Teams per project, or Administration → Integrations for an instance default. Messages use Slack blocks and Teams cards, are rate limited, retried and logged.

Git integrations

In Project settings → Repositories link a GitHub, GitLab, Gitea (self-hosted too) or Bitbucket Cloud repository: enter owner/name, the server URL for self-hosted systems, the default branch and optionally an access token. Veqsio then shows a payload URL and a secret once — paste them into the provider’s webhook settings (GitHub/Gitea: JSON content type, push, pull request, workflow events; GitLab: secret token; Bitbucket: the URL carries a token, keep it private).

• Any branch, commit or pull request mentioning an issue key (DEMO-12) of the project appears in the issue’s Development panel with pull request status, branches, commits and latest build.
• Smart commits: DEMO-12 #comment fixed the typo #done adds a comment and runs the matching transition — if the commit author’s e-mail matches a user allowed to do it.
• Create branch on an issue makes DEMO-12-summary-slug from the default branch (needs an access token on the repository).
• Release notes for a version: GET /rest/api/2/project/DEMO/versions/<id>/release-notes.

MCP server for AI assistants

The Model Context Protocol server lets Claude and other assistants search with JQL, read, comment on, assign, link and transition issues and read sprints and release notes — using your access token, so permissions and scopes apply. It is read-only by default; set VEQSIO_MCP_READONLY=false to allow writes. Start it with VEQSIO_URL and VEQSIO_TOKEN set; the repository documents client configuration for Claude Desktop and Claude Code. Text written by users is passed to the assistant labelled as untrusted.

AI agents as users

Administration → AI agents creates service accounts that can be assigned issues and @mentioned. A signed webhook triggers the agent, which receives a short-lived scoped token; each issue shows a run log with a Stop button, and rate and loop limits protect you from runaway agents.

Plugins and application links

Plugins run outside the server, are described by a manifest, receive signed webhook events, use scoped tokens and show panels in sandboxed iframes. Manage them under Plugins. Application links connect Veqsio to other applications you run.

Small helpers

• Copy as prompt in the issue menu copies the issue as text for an AI assistant.
• Peek: ?peek=KEY opens an issue in a side panel anywhere.
• A public API at /rest/public serves read-only data for projects that are public.