Create a GanttFather API token, call the v1 REST API safely, handle quotas and idempotency, and choose between REST and MCP.
The GanttFather REST API exposes versioned project, task, dependency, member, and resource operations for scripts and integrations. Authenticate with a GanttFather token, send a non-empty User-Agent header, start with read calls, and use an Idempotency-Key when creating a task or resource that may be retried.
API behavior verified August 7, 2026. Treat the live API reference as the endpoint-level contract.
What can you automate with the GanttFather API?
The v1 API supports common schedule-integration workflows:
- list accessible projects and inspect one project
- list and read tasks, members, resources, and dependencies
- create, partially update, reorder, and delete tasks
- add or remove task dependencies
- create, update, and delete resources
- attach your own mapping between an external record and a GanttFather id
The public API is not the same surface as the browser’s internal API. Use only documented v1 endpoints and response fields.
How do you create and use an API token?
Open GanttFather, go to Settings → AI Agents & API, and create a token with the smallest useful scope and permission. Copy the raw token when it is shown and store it in a secret manager; GanttFather does not store the raw value for later display.
Then follow this sequence:
- Read the authentication guide.
- Call list projects to find an accessible project id.
- Read tasks before attempting a write.
- Create one disposable test task.
- Add pagination, retry, and quota handling before a bulk job.
Every request must include the Bearer token and a non-empty User-Agent that identifies the client. A missing User-Agent is rejected before normal endpoint handling.
Which safety rules matter for writes?
Use partial updates only for fields your integration owns. Read the current state before changing it, log stable ids and trace information, and do not turn every external field into an unconditional overwrite.
For task and resource creation, send an Idempotency-Key when a timeout or network failure may cause a retry. Reusing the key with the same request returns the prior result; reusing it with a different request is a conflict. Updates and deletes have their documented semantics and do not accept that create-only key as a universal deduplication mechanism.
Dependencies and hierarchy are separate concerns. Reordering is the sanctioned way to change parent placement; dependency endpoints model predecessor relationships. Validate both rather than deriving one from the other.
What are the rate and daily quota limits?
The default protection is 60 requests per minute per authenticated token and 5,000 requests per day per token. A limited response uses HTTP 429 and provides retry information. Check the current rate limits and quotas documentation before planning a production workload because operational limits can change.
Reduce request volume by paginating correctly, reading in batches, caching stable ids, and sending one partial update instead of a sequence of per-field updates. A retry loop should respect Retry-After and use bounded exponential backoff with jitter.
When should you use REST instead of MCP?
Use REST when deterministic application code needs versioned HTTP resources, explicit error responses, and controlled retry behavior. Use the MCP server when an AI client such as Claude should invoke higher-level project tools through the Model Context Protocol.
Both can use GanttFather’s token lane, but their operations and idempotency inputs are not interchangeable. An API integration should follow the REST reference; an agent should follow the MCP tool descriptions.
What is a safe first integration pattern?
Start with one direction and one owner for each field:
| Step | Recommended behavior |
|---|---|
| Discover | List projects and record the selected project id |
| Read | Page through current tasks and build an id map |
| Compare | Compute a change set without writing |
| Review | Log intended creates, updates, and deletes |
| Write | Apply the smallest supported mutation |
| Verify | Read the result and record the returned id |
Do not claim “sync” until conflict ownership, deletion rules, retries, and recovery are defined.
When should you build on the GanttFather API?
Use the API when a form, deployment pipeline, customer portal, or internal system needs repeatable access to the same project data your team sees in GanttFather. The most reliable first use case is narrow—for example, create a release milestone after deployment—then expand after observing real failures and retries.
The API does not decide which system owns a field or make a multi-system workflow conflict-free. Your integration must define those rules.
Create a GanttFather project, issue a least-privilege token, and test against disposable data before connecting production records.
Frequently asked questions
Is API access included on the free tier?
API access is currently available across GanttFather plans. Capacity and protection limits still apply; verify the pricing page and API quota documentation for the current terms.
What does a GanttFather API token look like?
Tokens use the GanttFather token format and are presented as Bearer credentials. Never commit a token to source control or include it in a public log.
Is User-Agent optional?
No for normal v1 requests. Send a non-empty value that identifies your integration, such as a product name and version.
Should every request include an Idempotency-Key?
No. Use it for documented create operations when the same request may be retried. It is not a general-purpose version or concurrency header.
Can the API configure Azure DevOps integration sources?
The public v1 project-data API and the product’s Azure DevOps integration are separate surfaces. Do not assume an undocumented integration endpoint exists.
Where is the OpenAPI documentation?
Start from the GanttFather API introduction and follow the reference links for authentication, endpoints, schemas, and errors.
