Edworking API

Overview

Get started

The Edworking API is a single GraphQL endpoint. Send all queries and mutations as POST requests to:

Every request must include a valid access token in the Authorization header. See Authentication to obtain one.

What is GraphQL?

GraphQL lets you request exactly the data you need, and nothing more, in a single call. Instead of stitching together multiple REST endpoints, you describe the shape of the response and the server returns it.

All operations are validated against the Edworking schema. Use this reference to discover the available queries, mutations, and types.

Authentication

Send a scoped personal API token as Authorization: Bearer <token>. Tokens start with edw_pat_ and are bound to the workspace where you create them.

• In Edworking, open your profile settings and select API tokens.
• Choose a name, the permissions your integration needs, and a lifetime of 7, 30 or 90 days.
• Select Create and reveal and complete reauthentication, including MFA when required.
• Copy the secret once into your integration's secret store. It cannot be retrieved again.

Permissions

Reading message attachments also requires files:read; attaching existing files to a new task also requires files:write. Read and write permissions are independent. Resource membership and message-history limits still apply. Workspace cookies cannot change the token's workspace.

Expiry, rotation and revocation

Rotate or revoke from API tokens after reauthentication. Rotation immediately revokes the previous credential and keeps its permissions and original expiry. Update your integration's stored secret when rotating; create a new token to extend its lifetime. Revocation blocks subsequent requests, although an already-running operation may finish.

Query example

Once you have a token, include it in the Authorization header and send your query:

Copy// Server-side JavaScript. Store a token with tasks:read in your secret manager.
const token = process.env.EDWORKING_API_TOKEN
if (!token) throw new Error('Set EDWORKING_API_TOKEN')

const response = await fetch('https://gateway.edworking.com/', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer ${token}`,
  },
  body: JSON.stringify({
    query: `query Tasks($after: ID) {
      apiTasks(after: $after, limit: 50) {
        id name projectId stateProjectId createdAt updatedAt
      }
    }`,
    variables: { after: null },
  }),
})
if (!response.ok) throw new Error(`Edworking HTTP ${response.status}`)
const result = await response.json()
// GraphQL errors may arrive with HTTP 200. Never log credentials or headers.
if (result.errors?.length) throw new Error('Edworking rejected the request; check token permissions and expiry')
const tasks = result.data.apiTasks
// Request the next page with after set to the last task's id.

Send a message

Use a token with messages:write. POST this mutation and its variables to the same endpoint with the same authorization header:

Copymutation SendMessage($chat: ChatMessageScope!, $body: String!) {
  apiSendMessage(chat: $chat, body: $body) {
    id body authorId createdAt
  }
}

Variables

Copy{"chat":{"id":"<PROJECT_ID>","kind":"project"},"body":"The report is ready."}

Pagination and chat IDs

Lists default to 50 records and allow 1 through 100. Pass the last returned ID as after until a page contains fewer records than requested. Keep filters and ordering unchanged between pages.

Tasks, messages, projects and files accept order: CREATED_DESC or UPDATED_DESC with an ID tie-breaker. Default order is ID_ASC. Project statuses use position order; private chats use ID order. For polling, request the newest page again and deduplicate by record ID (or ID plus update timestamp for changes). A saved cursor is not a durable change feed.

ChatMessageScope needs an existing chat’s id and exact kind: project, task, privat or meetingroom. Discover projects, tasks and private chats with the matching read permission.

Migration and automation

Scoped tokens only accept the operations in this reference. Older session-token examples such as getTask, getTasksNew, setTask, ediTask, getMessages and setMessage cannot be used with a new token.

Adapt task lists to apiTasks, task creation to apiCreateTask, name and due-date changes to apiUpdateTask, and message reads and sends to apiMessages and apiSendMessage. Use apiProjects, apiCreateProject, apiFiles and apiUploadFile for projects and files. Match the arguments and selected response fields below; these are not drop-in replacements.

Account data, editing an existing task’s status, ordinary REST endpoints and WebSocket subscriptions are outside the token permissions. HTTP polling is available; webhooks are not.

For custom integrations, replace password-based login or copied session credentials with scoped tokens. Handle HTTP failures and GraphQL errors, including responses with HTTP 200. Permission or resource access denials can use FORBIDDEN; renew expired credentials and check scopes rather than repeatedly retrying a denied write.