API reference

1. Base URL and format

• Base URL: https://kanbanpesquisa.com.br, HTTPS only.
• OAuth endpoints: requests in application/x-www-form-urlencoded, responses in JSON.
• MCP endpoint: JSON-RPC 2.0 over HTTP POST (Streamable HTTP transport, without sessions), answered in JSON.
• Discovery: /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource (RFC 9728) describe the endpoints and scopes.
• Dates: YYYY-MM-DD, or an empty string when there is none. IDs are strings.

2. Authorization

OAuth 2.0 authorization code flow with PKCE (S256). The client is public: it has a client ID and no client secret. Only registered redirect URIs are accepted, compared character by character.

GET /oauth/authorize

GET https://kanbanpesquisa.com.br/oauth/authorize
  ?client_id=<client ID>
  &response_type=code
  &redirect_uri=https://zapier.com/dashboard/auth/oauth/return/App247793CLIAPI/
  &scope=kanban:read kanban:write
  &state=<random value>
  &code_challenge=<BASE64URL(SHA-256(code_verifier))>
  &code_challenge_method=S256
  &resource=https://kanbanpesquisa.com.br/api/mcp

The person signs in, chooses the projects (all of them by default) and whether to allow changes. Kanban then redirects to redirect_uri with code, state and iss. The code works once, within 2 minutes.

POST /oauth/token

POST https://kanbanpesquisa.com.br/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=<client ID>
&resource=https://kanbanpesquisa.com.br/api/mcp
&code=<code from the redirect>
&redirect_uri=<same redirect_uri>
&code_verifier=<code_verifier>

Response (200):

{
  "access_token": "<64 hexadecimal characters>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "<64 hexadecimal characters>",
  "scope": "kanban:read kanban:write"
}

• The access token lasts up to 1 hour. Send it as Authorization: Bearer <access_token>.
• Refresh tokens rotate: each one works once, and the response brings the next. Reusing a spent refresh token can end the connection.
• Errors return 400 with {"error": "invalid_request" | "invalid_grant", "error_description": "…"}, or 503 with temporarily_unavailable.

3. MCP endpoint: POST /api/mcp

Runs one tool per request. The Zapier integration only sends tools/call; MCP clients also use initialize and tools/list, which list every tool with its input schema.

POST https://kanbanpesquisa.com.br/api/mcp
Authorization: Bearer <access_token>
Content-Type: application/json
Accept: application/json, text/event-stream

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "listar_tarefas",
    "arguments": { "projectId": "<project ID>", "offset": 0, "limit": 50 }
  }
}

Response (200). The tool result is in result.structuredContent.result; result.content[0].text repeats it as text. Some tools also return _meta with display data for chat apps, which integrations can ignore.

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "structuredContent": {
      "result": {
        "revision": 42,
        "items": [{
          "id": "6f1c2a9e-5b7d-4c1e-9a3f-2d8e4b6c1a70",
          "title": "Submit the ethics committee amendment",
          "columnId": "todo",
          "stageId": "collection",
          "priority": "Alta",
          "assignees": ["<member ID>"],
          "start": "2026-10-14",
          "due": "2026-10-21",
          "tags": ["ethics"],
          "dependsOn": [],
          "documentIds": [],
          "archived": false,
          "demo": false
        }],
        "total": 1,
        "nextOffset": null
      }
    },
    "content": [{ "type": "text", "text": "<the same result as JSON text>" }]
  }
}

• Without a token, or with an expired or revoked one, the endpoint answers HTTP 401 with a WWW-Authenticate header. Refresh the token or connect again.
• When a tool refuses a request, the answer is still HTTP 200, with result.isError set and the reason as JSON text, with an HTTP-like status. See Errors and conflicts.
• A malformed request, such as an unknown tool, can instead come back with a JSON-RPC error object (code and message).

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "isError": true,
    "content": [{
      "type": "text",
      "text": "{\"error\":\"<message in Portuguese>\",\"status\":403}"
    }]
  }
}

4. Tools

The tools the Zapier integration calls. Read tools never change data. Lists of members, columns and stages use the IDs that tasks refer to.

listar_projetos: list projects

Lists the projects the person can open and included in the connection. Takes no arguments. Needs kanban:read.

consultar_projeto: look up a project

Reads the board settings and the current revision of a project. Needs kanban:read.

The result also carries the project’s other settings (currency, budget, screening, folders), which the Zapier integration does not use.

listar_tarefas: list tasks

Lists the tasks of a project, with filters and pages. Needs kanban:read.

criar_tarefa: create a task

Creates a task. Needs the kanban:write scope and a role that can edit the project. The revision must be the one returned by the last consultar_projeto or listar_tarefas call.

Result: saved (true), projectId, the new revision and taskId.

comentar_tarefa: comment on a task

Adds a comment in the name of the connected person and notifies the people assigned to the task inside Kanban. It sends no email. Needs the kanban:write scope and a role that can edit the project. The revision must be the one returned by the last consultar_projeto or listar_tarefas call.

Result: saved (true), projectId and the new revision.

incluir_referencia_por_doi: add a reference by DOI

Looks the DOI up on Crossref and adds the reference to the project library. Only the DOI is sent to Crossref. Needs the kanban:write scope and a role that can edit the project. The revision must be the one returned by the last consultar_projeto or listar_tarefas call.

Result: saved (true), projectId, the new revision, documentId and reference, with title, doi, authors, published, journal, publisher, place, volume, issue, pages and type. Fields Crossref does not have come back empty. A DOI already in the library is refused with status 409; a DOI Crossref does not know, with 404.

5. Zapier steps

Each Zapier step and the endpoints and tools it calls. Every action reads the project first to get its revision.

6. Errors and conflicts

Every change sends the project revision. If someone saved in between, the tool answers 409 and saves nothing: read the project again and decide whether to retry. The Zapier actions read again and retry once.

Error messages from the server are in Portuguese. The Zapier integration shows its own message in English for each status.

7. Limits

• Access tokens last up to 1 hour. A connection lasts 90 days; then the person connects again.
• Up to 50 tasks per listar_tarefas call, and up to 150 KB per MCP request.
• The connection never gives more access than the person has on the website. It cannot invite people, change access or delete projects.
• The example project, with fictional data, is read-only.

8. Support

Questions about the API or the integrations: suporte@kanbanpesquisa.com.br, or the Contact page. For connecting ChatGPT and Claude, see the connector guide.