1. Get started
  3. API changelog
  • Quickstart
  • Data Model
  • Errors
  • Webhook events — payloads, headers and signatures
  • API versions and changes
  • API changelog

API changelog

Dated changes to the endpoints an API key or OAuth token can reach, their fields, webhooks, and authentication.

Changes to the public API: the endpoints an API key or OAuth token can reach, their request and response fields, webhooks, and authentication. Newest first.

  • Paths are relative to https://<subdomain>.corteksa.info/api/v1.
  • Dates are when a change was completed. It reaches your workspace with the release that follows; see Release notes.
  • Labels: Added is new, Changed alters existing behaviour, and Breaking removes, renames or reshapes something a working integration can depend on. See API versions and changes.

2026-09-13

  • Added Workspace tag endpoints: GET /object/field/tag, POST /object/field/tag, PUT /object/field/tag/order, PATCH /object/field/tag/:tagSlug, DELETE /object/field/tag/:tagSlug and GET /object/field/tag/:tagSlug/usage. Deleting a tag that records still use retires it instead and returns archived: true.
  • Added POST /object/field/tag/unit/:objectSlug creates a tag with the update.{objectSlug} scope instead of object.update.

2026-09-12

  • Changed GET /files/download, GET /files/signed-url and POST /files/signed-urls serve a record's file under the file name and content type saved with the record, instead of the storage name and application/octet-stream.

2026-09-11

  • Changed A webhook delivery that gets a 4xx response is no longer retried, except for 408 and 429.

2026-09-02

  • Added POST /object/data/:objectSlug/bulk-actions/:jobId/cancel stops a background bulk job. Records it already changed stay changed. Only the user who started the job can cancel it.

2026-09-01

  • Added POST /object/data/:objectSlug/bulk-actions and POST /object/data/:objectSlug/bulk-duplicate accept select_all: true with an optional scope (search, filters, filter tree, assignees) instead of record_slugs, and excluded_record_slugs to leave records out.

2026-08-30

  • Changed POST /oauth/token and POST /oauth/revoke are limited to 30 requests per minute and answer 429 above that.

2026-08-26

  • Added Records include position, their manual board order, as a decimal string.
  • Changed The create response and the record.created webhook include fields left blank, with the value null.

2026-08-23

  • Added Records include capabilities (can_edit, can_delete, can_assign) on reads and in create, update and assignee responses.
  • Added Records include linked_record, the record this one was created from, or null. Create, update and bulk update accept linked_object_slug next to linked_data_slug.
  • Changed Relation cells in record responses hold at most 10 linked records unless the request sends page and limit. Follow pagination.nextPage for the rest.
  • Changed GET /object returns only the objects the caller can read and no longer needs the object.read scope.
  • Changed GET /object/:objectSlug, GET /object/:objectSlug/other-objects, GET /object/field/:objectSlug, GET /object/field/select/:objectSlug, GET /object/field/trigger-fields/:objectSlug and GET /object/field/show/:objectSlug/:fieldSlug need read.{objectSlug} instead of object.read.

2026-08-20

  • Changed PUT /object/data/:objectSlug/:dataSlug returns the whole record, including calculated fields. _meta.pending_fields names fields that a background recalculation will still update.

2026-08-18

  • Breaking Each relation cell in a record's relations is { items, pagination } instead of { items, total, has_more }.
  • Added GET /object/data/:objectSlug/:dataSlug accepts page and limit to page its relation cells.

2026-08-17

  • Added POST /object/data/:objectSlug/signals returns open_tasks, overdue, mentions and unread_incoming for up to 500 record slugs.

2026-08-16

  • Breaking POST /object/data/:objectSlug, POST /object/data/:objectSlug/:recordSlug/duplicate, POST /object/data/:objectSlug/inline and PUT /object/data/:objectSlug/:dataSlug return the record itself in data instead of { fields, data }. parent_record is the record itself as well.
  • Breaking POST /object/field/duplicate/:objectSlug returns data: { created, skipped_relation_fields, failed_targets, conditional_stripped }, where created maps each target object slug to its new fields.

2026-08-14

  • Added GET /object/data/:objectSlug/:dataSlug/activity returns a record's activity trail a page at a time, when record_activity_tab is true in GET /object/features.
  • Added POST /object/data/:objectSlug/column-values/:fieldSlug lists the values a field holds across records, most common first.
  • Added POST /object/data/:objectSlug/bulk-duplicate copies a selection of records and accepts an Idempotency-Key header. It needs create.{objectSlug} and works when record_duplicate is true in GET /object/features.

2026-08-11

  • Breaking Relation values are only in record.relations[relationSlug]. The copy at record[relationSlug] is gone.
  • Changed Date fields (date, start_date, due_date) are returned as YYYY-MM-DD.
  • Added GET /object/active accepts search.

2026-08-10

  • Changed PUT /object/data/:objectSlug/:dataSlug returns { fields, data }, like create. Reverted on 2026-08-16.
  • Breaking field_group on field responses is the field's section, { slug, name } or null, instead of "system" or "custom". Use is_system for that.
  • Added GET /object/field/types includes can_column_relation for each field type.

2026-08-09

  • Added GET /files/download streams a stored file by its key.
  • Added Linked records in relations can carry columns, the relation's display fields keyed by field slug. The key is absent when none are set.

2026-08-06

  • Added Linked records in relations include label, object_name and object_icon. A linked record with no name uses its random_id as name.
  • Added Relation options include random_id, label and icon, and each option group includes object_name and object_icon.
  • Changed Changing, deactivating or deleting a field that a board groups by can answer 409. Send ?force=true to go ahead.

2026-08-05

  • Added PATCH /object/data/:objectSlug/:recordSlug/position sets a record's manual board order from its neighbours, before_slug and after_slug.
  • Added GET /object/field/file-formats lists the formats a file field can accept.

2026-08-04

  • Added Records include relations, every relation cell keyed by relation slug.
  • Added GET /object/features reports which optional record features are on.
  • Added Create, update, inline create and bulk update responses include dropped_fields when read-only fields were removed from the request.
  • Added GET /object/field/:objectSlug accepts is_active.
  • Changed Deleted options no longer appear in a field's options or in GET /object/data/:objectSlug/field-options/:fieldSlug. A record that still holds one returns it with is_deleted.
  • Changed Update responses return select-type values as option objects, the same as reads.

2026-08-03

  • Added POST /object/data/:objectSlug/bulk-actions runs update, assign or delete on a list of records. It answers 202 with a job_id when the work runs in the background, and GET /object/data/:objectSlug/bulk-actions/:jobId reports on it.
  • Added POST /object/data/:objectSlug/inline creates a record from a board column or table row.
  • Added GET /object/data/duplicates/:objectSlug/:fieldSlug lists records that share a value in one field. It needs read access to every record of the object.

2026-08-02

  • Added POST /object/data/:objectSlug/:recordSlug/duplicate copies a record. It works when record_duplicate is true in GET /object/features.

2026-07-30

  • Added Date and datetime fields set to show the Hijri calendar also return <fieldSlug>_hijri.

2026-07-29

  • Added POST /object/data/:objectSlug/bulk-assign accepts assignees, a full list of user slugs. admin_slug still works; sending both answers 400.
  • Added Field details include group_slug and group_ineligible.

2026-07-27

  • Breaking Records no longer include assignee. assignees is the only owner field, with the primary owner first.

2026-07-26

  • Added Fields can be marked api_only. The value of an API-only field is saved only when the write comes from an API key or OAuth token; other writes drop it. Field create and update accept api_only, and field responses include it.
  • Added Field responses include field_group, "system" or "custom". Replaced on 2026-08-10.

2026-07-24

  • Added PATCH /object/data/:objectSlug/:recordSlug/assignees sets a record's assignees, up to 20. Records include assignees.
  • Changed POST /object/data/:objectSlug/bulk-assign needs assign.{objectSlug} instead of update.{objectSlug}.

2026-07-22

  • Added GET /files/signed-url and POST /files/signed-urls (up to 100 keys) accept API keys and OAuth tokens.
  • Added POST /object/field/option/:objectSlug/:fieldSlug adds one option to a select-type field.
  • Added GET /object/overview returns workspace totals for records, saved views and objects.

2026-07-21

  • Breaking Select, status, priority, multi-select, tag and source values are returned as an array of option objects (id, value, label, color, icon). A single-select field returns an array of zero or one item. Writes accept one option id or an array of option ids.

2026-07-19

  • Changed Datetime values are returned in the acting user's saved timezone, with its offset, for example 2026-03-01T14:00:00+03:00.

2026-07-14

  • Added OAuth tokens can create and manage webhook subscriptions. Changes an OAuth app makes are not sent to that app's own subscriptions.
  • Added GET /object/field/trigger-fields/:objectSlug accepts exclude.

2026-07-13

  • Added Webhooks: GET /webhooks/events, POST /webhooks/subscriptions, GET /webhooks/subscriptions, GET /webhooks/subscriptions/:slug and DELETE /webhooks/subscriptions/:slug, with the record.created, record.updated and record.deleted events and signed deliveries. Creating a subscription needs read.{object_slug}. Changes an API key makes are not sent to that key's own subscriptions. See Webhook events.
  • Added Object and field endpoints under /object and /object/field accept API keys and OAuth tokens.
  • Added Scopes accept a {verb}.* wildcard, such as read.*, covering every object the credential's user can reach with that verb.
  • Added GET /object/field/manager lists every field in the workspace. Field details include is_shared, shared_with and is_visible.
  • Changed Presenting a refresh token that was already used revokes every token that app holds for that user.
  • Changed POST /object/field/duplicate/:objectSlug accepts at most 50 target objects and 200 field slugs.

2026-07-12

  • Added API keys (crtk_live_…), sent as X-Api-Key or Authorization: Bearer. Record endpoints under /object/data accept them.
  • Added OAuth 2.0 authorization code flow for partner apps, with POST /oauth/token (authorization_code and refresh_token grants) and POST /oauth/revoke. Access tokens start with crtk_oauth_.
  • Added GET /me returns the credential's workspace and scopes.
API versions and changes< Previous

Powered by heyo-docs

On this page

2026-09-132026-09-122026-09-112026-09-022026-09-012026-08-302026-08-262026-08-232026-08-202026-08-182026-08-172026-08-162026-08-142026-08-112026-08-102026-08-092026-08-062026-08-052026-08-042026-08-032026-08-022026-07-302026-07-292026-07-272026-07-262026-07-242026-07-222026-07-212026-07-192026-07-142026-07-132026-07-12