Yes. Every webhook delivery is signed with HMAC-SHA256. The header X-PathHub-Signature carries the timestamp and signature so you can verify the request really comes from PathHub.

PathHub API — Project plans & AI over REST + Webhooks

Q: Which tiers include API access?

API access is included in Pro (2,000 calls/month) and Max (20,000 calls/month). The Free plan does not include API access.

Q: What happens if I exceed the rate limit?

Requests beyond 120/min receive HTTP 429 with a clear error code. Monthly quotas reset at the start of each month.

What you can do with the API

PathHub's logic isn't locked inside the app. Most in-app features are 1:1 available as a REST endpoint — AI features included.

Generate AI project plans from descriptions

POST a 1-2 sentence description, get back a full ActionPath: phases, tasks, risks, budget, compliance, stakeholders.

Read & mutate tasks programmatically

List, sub-resources, PATCH on individual tasks. Status changes trigger webhooks — perfect for dashboards and automations.

Real-time events via webhooks

Seven events (task.status_changed, project.created, risk.added …), HMAC-signed, 3x retry with backoff.

AI chat & tools via API

RAG chat over your project documents, generate RACI/SWOT/risk matrices/Gantt, run autonomous agents — all via simple POST calls.

Export plans as Markdown

Full ActionPath as Markdown — perfect for feeding plans into ChatGPT/Claude or pasting into Notion/Confluence.

Compliance library programmatically

GDPR, NIS2, ISO 27001, industry rules — all DE/AT/CH regulations, filterable by country, industry, and company size.

Get started in 3 steps

From never tried to first successful call in under five minutes.

1

Create a key

In the app under Tools › Developers / API. Pick a scope (read, write or ai). The key is shown only once — store it securely.

2

Send a request

Header Authorization: Bearer phk_live_…. Base URL: https://app.pathhub.ai/api/v1. Responses are always JSON or Markdown.

3

Subscribe to webhooks (optional)

POST to /v1/webhooks with your HTTPS URL. PathHub signs every delivery with HMAC-SHA256 — verify snippet is in the docs.

Examples

Curl snippets for the most common use-cases — copy-paste ready without further explanation.

Generate a project plan

From a 1-sentence description to a full ActionPath.

generate-plan.shcurl

curl -X POST https://app.pathhub.ai/api/v1/ai/generate-plan \
  -H "Authorization: Bearer phk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Roll out an internal wiki, ~15 staff, 6 weeks.",
    "title": "Internal Wiki",
    "desired_timeline_weeks": 6,
    "locale": "en"
  }'

Tick a task

Also fires a task.status_changed webhook.

patch-task.shcurl

curl -X PATCH \
  https://app.pathhub.ai/api/v1/tasks/<task_id> \
  -H "Authorization: Bearer phk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"checked": true}'

Create a webhook

Response includes secret just once — save it now.

create-webhook.shcurl

curl -X POST https://app.pathhub.ai/api/v1/webhooks \
  -H "Authorization: Bearer phk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/webhook",
    "events": ["task.status_changed"]
  }'

Endpoints at a glance

19 endpoints, grouped by function. Full descriptions including request/response schemas live in the interactive reference.

GET/v1/projects

GET/v1/projects/{id}

GET/v1/projects/{id}/{resource}

GET/v1/projects/{id}/export

PATCH/v1/tasks/{id}

GET/v1/documents

POST/v1/documents/search

GET/v1/webhooks

POST/v1/webhooks

DELETE/v1/webhooks/{id}

POST/v1/ai/generate-plan

POST/v1/ai/projects/{id}/chat

POST/v1/ai/projects/{id}/tools/{tool}

POST/v1/ai/projects/{id}/agents/{task}

POST/v1/ai/projects/{id}/recommendations

GET/v1/ai/agents

GET/v1/compliance-rules

GET/v1/project-templates

GET/v1/usage

Try it live: hit any endpoint with the "Try it out" button.

Open interactive reference

Works with any iPaaS platform

REST + Webhooks are generic enough that every major no-code tool can use them without a dedicated app.

Zapier

Make

n8n

Power Automate

Custom code (Node, Python, Go, …)

FAQ

The most common questions about tiers, limits and security.

Which tiers include API access?

API access is included in Pro (2,000 calls/month) and Max (20,000 calls/month). The Free plan does not include API access. Enterprise quotas on request.

How does the AI quota work with the API?

AI calls (plan generation, chat, tools, agents) count both against the API request quota and against the workspace's shared AI quota (50/month on Pro, 500/month on Max). Pure read calls (projects, tasks, compliance) only count against the API limit.

Do I need to write custom code to connect PathHub?

No. The REST API works with Zapier, Make, n8n and Power Automate. Custom code (Node, Python, Go etc.) is only needed for deeper behaviour — e.g. custom mappings into internal systems.

Are webhooks signed?

Yes. Every webhook delivery is signed with HMAC-SHA256. The header X-PathHub-Signature: t=<unix_ts>,v1=<mac> carries timestamp and signature. A ready-to-use Node.js verify snippet lives in the full docs. Replay protection: reject deliveries older than 5 minutes.

What happens if I exceed the rate limit?

Requests beyond 120/minute receive HTTP 429 with code rate_limit_exceeded. Monthly quotas reset at the start of each month. Check current usage anytime via GET /v1/usage.

Are API keys bound to a workspace?

Yes. Each key belongs to exactly one workspace and only sees its data. If you have multiple workspaces (e.g. several clients), create one key per workspace. Keys can be revoked at any time.

Is there an official OpenAPI spec?

Yes — /api/v1/openapi serves the full OpenAPI 3.0 YAML. Directly importable into Postman, Insomnia, Stoplight, or as a source for code generators.

Talk to PathHub over REST