API & webhooks
Updated 18 May 2026
For pipelines, automations, and integrations we haven't built yet, Tyto exposes a REST API designed for "I have a small script and I want to either create or react to tasks." Outgoing webhooks are coming next.
Who gets API access
API keys are available on the Medium and Enterprise plans. (Solo and Pro don't include API access today — talk to us if you're on a smaller plan and have a real use case; we'll usually find a path.)
Generating an API key
- Settings → API Keys in the web app.
- Click "New key." Name it ("zapier-bridge", "data-export-script") so you'll know what to revoke later.
- Pick the scopes. Read-only is safe for most scripts; write is needed if you're creating tasks. Scopes are listed in the create dialog — the names map directly to resources and verbs (e.g.
tasks:read,tasks:write). - Copy the key. We show it once. Store it somewhere safe — a password manager is fine.
Where the reference lives
The Rust API is mid-migration from the older Express one, so the docs cover what's been ported across so far rather than every endpoint. If you need an endpoint that isn't there yet, hit the thumbs-down on this article and tell us which one — that's how we prioritise the migration order.
Basic shape
Same pattern across the API — JSON in, JSON out, bearer auth in an Authorization header:
POST https://api.tyto.me/v1/tasks
Authorization: Bearer <your-api-key>
Content-Type: application/json
{
"title": "Send weekly report",
"projectId": "abc-123",
"assigneeId": "user-456",
"dueDate": "2026-05-25T17:00:00Z"
}
Endpoints currently live at two hosts during a migration: api.tyto.me (older Express) and api-rs.tyto.me (newer Rust, with the live docs page ↗). The docs page tells you the right host for each endpoint — check there rather than guessing.
Rate limits
Per API key, per minute (sliding 60-second window). When you exceed, we return 429s — back off and retry.
| Plan | Per minute | Roughly per day if sustained |
|---|---|---|
| Medium | 60 | ~86,000 |
| Enterprise | 300 | ~432,000 |
These are starting defaults that fit nearly every legitimate scripted use case. If you genuinely need more for a real integration, talk to us — limits are easy to raise on a per-workspace basis.
The limit isn't split by verb — reads and writes both count against the same bucket.
Webhooks Coming
Outgoing webhooks — per-project URLs that get a POST whenever something happens (task created, status changed, comment added, workflow step transitioned) — are next on the API roadmap. The shape we're aiming at:
- Per-project subscription with selectable event types
- JSON payload with
type+objectfields - Signed verification headers so you can confirm requests came from Tyto
Until they ship, the pattern people use is polling the relevant endpoint at whatever frequency the rate limit allows. Hit the thumbs-down with your use case if you'd find webhooks valuable — that helps us prioritise.
Need something the API can't do?
Tyto's sister company M2North handles company-to-company wiring across the procure-to-pay cycle — order integration, invoice integration, accounts payable, order consolidation, and most things in between. The back-office plumbing that keeps enterprise supply chains running.
Tyto handles the last mile, between the computers and the humans actually doing the work.
When the job needs both halves — the system-to-system pipes and the human-facing workflow on top — M2North is the team to talk to.