Trace.Space offers five ways to connect other tools to your organization's data. This article is the map; each surface has its own article for the details.
Surface | Use it for | Who sets it up |
REST API | Scripts, pipelines and integrations | Any member, via an API client |
MCP server | AI assistants such as Claude, Cursor and VS Code | Each user, from their own tool |
API query skill | Giving an AI coding agent a ready-made guide to the API | Any member, via an API client |
Webhooks | Being notified when items, traces, comments or reviews change | Org admin, via the API |
Jira and GitHub apps | Linking items to issues and pull requests | Org admin |
The REST API
The API is split into a core service for organization data and an auth service for sign-in, users and organizations. Use the base URL for your region: https://api.tracespace.app in Europe, https://api.tracespace.ai in North America. Paths start with /core/ or /auth/.
Authentication. Create an API client on Organization settings > Integrations to get a client ID and secret (see API clients), then exchange them for a bearer token. Tokens last 15 minutes.
curl -X POST "https://api.tracespace.app/auth/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=&client_secret="
The response is standard OAuth JSON with access_token, token_type and expires_in. Send the token on every call:
curl "https://api.tracespace.app/core/types" \ -H "Authorization: Bearer " \ -H "Target-Organization: "
Conventions worth knowing:
Field names are camelCase in every core API request and response. The token endpoint is the exception: it follows the OAuth standard and uses
access_token.Target-Organizationnames the organization a call is for, by its domain name (the short identifier in the app URL). A token that covers several organizations falls back to the first one when the header is missing, so always include it. An API client token is bound to one organization.Discovery. The auth service publishes standard OAuth metadata at
/auth/.well-known/oauth-authorization-server,/auth/.well-known/openid-configurationand its signing keys at/auth/.well-known/jwks.json.Reference. The REST API documentation link on the Integrations page opens the interactive reference for the core API. The OpenAPI document itself is at
/core/openapi/v1.json; the auth service has the same pair under/auth/.An API client acts with the permissions of the member who created it.
The MCP server
The MCP server lets an AI assistant work in your organization through a set of 30 tools: it can read, create, update and move items, follow traces, filter and search, read types and picklists, read baselines and reviews, and record review feedback. The assistant signs in as you with a browser login, so no keys are needed. The Integrations page generates a ready-made config file for Cursor, VS Code and Claude Code. See MCP server setup for connecting and the MCP tools reference for what each tool does.
The API query skill
When you create an API client, the credentials dialog offers Download skill. The file, SKILL.md, is an instruction sheet for an AI coding agent that explains how to get a token, how to filter and search items, and which endpoints exist, with your credentials filled in. Keep it private. Details are in API clients.
Webhooks
Webhooks push a signed JSON message to a URL you own whenever items, traces, comments or reviews change; there is no page for them in the app, so org admins manage subscriptions through the core API. See Webhooks for the endpoints, event types, signature check and retry policy.
Jira and GitHub apps
The Jira and GitHub integrations link items to issues and pull requests and show their status in the item sidebar. They are connected by an org admin from the Integrations page. See Jira and GitHub integrations.