The Arca REST API lets you read and write workspace data (tasks, lists, folders, statuses, labels, members, and comments) from any external application or script.
Base URL
All endpoints are available under:
Authentication
Every request must include a valid API key. You can pass it one of two ways:
Authorization header (recommended)
X-API-Key header
All API keys start with the arca_ prefix. Create and manage keys in the Arca app under Settings → API Keys.
API keys are secrets. Never embed them in client-side code or public
repositories.
401 Unauthorized.
Scopes
Each API key is granted a specific set of scopes. A request is rejected with 403 Forbidden if the key lacks the required scope for the endpoint.
Role restrictions
API operations are additionally constrained by your workspace role:
- Viewers can use read scopes (
tasks:read, folders:read, etc.) but cannot create, edit, or delete any resources.
- Members can create and edit resources but cannot delete folders or lists.
- Admins and owners have full access, including deleting folders and lists.
Additionally, workspace admins and owners can apply access restrictions to individual members, limiting them to specific folders and lists. Restricted members receive filtered results on list endpoints, and 403 Forbidden when accessing, creating, updating, or deleting resources in folders or lists outside their permitted scope.
Timestamps
All timestamps in responses are UTC ISO-8601 strings, for example:
When sending date values in request bodies (due_date, start_date), use ISO 8601 UTC format. A string without a timezone suffix (e.g., 2026-03-18T17:00:00) is treated as UTC. To remove a date, pass null or an empty string ("").
Errors
All error responses return JSON with a single error field:
