Move for developers

The Move API

A REST API over a Move task list, described by an OpenAPI 3.1 specification. Keys are self-serve — no sales call, no application form.

Free tier Self-serve API keys OpenAPI 3.1

Move machine-readable resources

Every document an agent needs to work with Move, at a predictable URL.

Resource	URL
OpenAPI 3.1 specification (JSON)	https://m0ve.app/openapi.json
OpenAPI 3.1 specification (YAML)	https://m0ve.app/openapi.yaml
Protected resource metadata (RFC 9728)	https://m0ve.app/.well-known/oauth-protected-resource
Site index for language models	https://m0ve.app/llms.txt
Sitemap	https://m0ve.app/sitemap.xml
Crawler policy	https://m0ve.app/robots.txt
Product documentation	https://docs.m0ve.app
Service status	https://status.9th.app

Move API endpoints

The API covers a task list — the Kanban-style board that lives on a Move calendar. It reads and writes tasks, their columns, their people and their comment threads. Base URL https://m0ve.app/api/v1/task-list.

Method	Path	Operation	Scope	What it does
GET	`/api/v1/task-list`	`getTaskList`	`tasks:read`	Get the task list this API key belongs to
GET	`/api/v1/task-list/tasks`	`listTasks`	`tasks:read`	List the tasks on the task list
POST	`/api/v1/task-list/tasks`	`createTask`	`tasks:write`	Create a task
GET	`/api/v1/task-list/tasks/{id}`	`getTask`	`tasks:read`	Get one task in full
PATCH	`/api/v1/task-list/tasks/{id}`	`updateTask`	`tasks:write`	Update a task (PATCH)
PUT	`/api/v1/task-list/tasks/{id}`	`replaceTask`	`tasks:write`	Update a task (PUT)
POST	`/api/v1/task-list/tasks/{id}/move`	`moveTask`	`tasks:write`	Move a task to another column
POST	`/api/v1/task-list/tasks/{id}/comments`	`createTaskComment`	`tasks:write`	Comment on a task

Each operation's parameters, request body and response schema are in the OpenAPI specification.

Getting a Move API key

Keys are self-serve. Open a task list in Move, go to its Integrations page and switch on API access. Move mints a key that looks like move_….

Authenticating

The key is the whole credential and it names exactly one task list, which is why no list id appears in any path. A key that leaks can be rotated from the same page without touching the calendar it belongs to.

Authorization: Bearer move_xxxxxxxxxxxxxxxx

Or, for clients that can only send a fixed custom header:

X-Move-Api-Key: move_xxxxxxxxxxxxxxxx

Scopes

A key is read-only until writes are enabled on the list. Every write from a read-only key returns 403 read_only.

tasks:read: Read the task list, its columns and its tasks, including comments and signed attachment links.
tasks:write: Create, update, move and comment on tasks. Granted only to a key whose task list has writes switched on.

The same names are published as scopes_supported in the protected resource metadata, and each operation in the spec carries the scope it needs as x-required-scope.

Your first request

curl -s https://m0ve.app/api/v1/task-list \
  -H "Authorization: Bearer move_xxxxxxxxxxxxxxxx"

The reply carries the list's sections — its columns. Those are the only valid values for status anywhere else in the API, and each comes with an id, a readable slug and a display name. Anywhere a column is named you may use any of the three, so status=verify and status=section_2845be76 are the same request.

Move API error codes

Every error is JSON with the same shape, whatever went wrong. error is a stable machine-readable code — branch on it rather than on the status code. message says how to fix the request, and details carries per-field validation errors when the failure was a validation failure.

{
  "error": "read_only",
  "message": "This API key is read-only. Allow writes on the task list's Integrations page.",
  "documentation_url": "https://m0ve.app/developers"
}

Code	Status	Meaning
`missing_key`	401	No API key was sent.
`invalid_key`	401	The key is unrecognised, or its list has API access switched off.
`read_only`	403	The key may read but not write.
`task_not_found`	404	No task with that id on this list.
`invalid_status`	422	The column named is not a column on this list.
`invalid_comment`	422	The comment had no body.
`too_many_files`	422	Too many files on one comment.
`invalid`	422	The record failed validation; see details.
`body_too_large`	413	The JSON body is over 512KB.
`server_error`	500	Something went wrong on Move's side.

A 401 also carries a WWW-Authenticate challenge naming the scopes and pointing at the protected resource metadata, per RFC 9728.

Markdown for agents

Move's homepage and this page serve a Markdown representation through content negotiation. Ask for it with an Accept header:

curl -s https://m0ve.app/ -H "Accept: text/markdown"

The reply is text/markdown; charset=utf-8 and carries Vary: Accept, Accept-Encoding, so a cache between you and Move cannot hand you the HTML variant by mistake.

OAuth 2.0

Move does not run an OAuth 2.0 authorization server for this API, so there is no authorize or token endpoint to call — the key is minted in the app and sent as a bearer token. /.well-known/oauth-authorization-server therefore returns a 404 that says so, rather than a document pointing at endpoints that do not exist. What Move does publish is RFC 9728 protected resource metadata, which declares the supported scopes and how to present a token.

Support

Email [email protected] with API questions. Service status is published at status.9th.app, and product documentation at docs.m0ve.app.