Introduction

Welcome to the reference for the Quire REST API!

The Quire REST API provides a broad set of operations and resources that:

• Consistently do repetitive or tedious tasks.
• Chain a process together for your team’s process and workflow.
  • Pull information from other locations such as email and Evernote into Quire.
  • Push information from Quire to other locations such as email and Zapier.

Want to share your thoughts on how Quire API works for you? Tell us how you feel about using our API and what we can do to make it better.

REST is a web-service protocol for rapid development by using HTTP and JSON technology.

API Changelog

You can find the Changelog of the API Reference on GitHub.

Authentication

For full setup instructions, see our Complete Setup Guide on the Quire blog.

OAuth v2.0

Quire uses OAuth v2.0 to authenticate your app and access the Quire REST API on a user’s behalf—without requiring the user’s password.

Authenticating via OAuth2 requires the following steps:

1. Register Your Application on Quire
2. Ask a Quire User to Grant Access to Your Application
3. Retrieve an Access Token
4. Make Authenticated Requests

Register Your Application on Quire

1. Give your app a cool name

Your app deserves a cool name that lives up to its broad range of great features.

All of the app users will see this name in public, so think carefully!

2. Choose the Quire Organization that your app belongs to

You can choose an organization in Quire that your app belongs to.

If one day you decide to leave the organization, you will lose the authority to manage the app.

3. Redirect URL

When users grant your app authorization request, users will be directed to the configured URL that you’ve set.

4. Choose permission scopes

You can set permission on what your app can do with Quire. There are several options for you to choose from.

Scope	Allows the app to
Manage profiles	Edit project and organization settings.
Create tasks	Add new tasks.
Manage tasks	Edit, assign, and schedule tasks and sublists.
Delete tasks	Delete tasks.
Manage tags	Add, edit, and remove tags.
Manage statuses	Add, edit, and remove statuses.
Manage notifications	Send notifications to users.

Note: Every app can read the organizations and projects a user authorized. If none of the options is selected, the app can only read user’s data, and Quire shows it as Read Only.

The scopes are fixed when a user grants access. If you change them later, a user gets the new ones only after authorizing your app again. The same goes for the Webhook URL: following a project or task with app (see WebHook) works only if your app had a Webhook URL when the user granted access (403 otherwise).

5. Development Client ID and Client Secret

The Client ID and Client secret will be automatically generated as you create an app.

The Client ID is a unique ID to identify your app.

You should keep your client secret safe, which means you should never share your client secret with anyone. If you choose to regenerate the client secret, the old one will immediately become invalid.

6. Update your App

If your app hasn't been published to Quire App Directory, it will remain as unpublished status. You can still use the configured shareable link in the Developer App Console Distribution to share the app with other users for testing or integration.

When you make changes to the app, you can use the shareable link to access the development copy as well. Working on your development copy will not affect your live App Directory app. When your updated app is ready to be published and replace the old version on Quire App Directory, your published app will have a different Client ID to the unpublished one.

There are two sets of Client ID and Client Secret.

• Development set - should be used during developing and testing internally of the app.
• Production set - should be used once your app is ready and published on Quire App Directory.

Fulfill Authorization Request

Ask a Quire User to Grant Access to Your Application

Once registering your application, you can ask your user to grant access to your application.

The authorization endpoint lets users grant your app access to the requested permissions.

The authorization endpoint should look like this:

https://quire.io/oauth?client_id=your-client-ID&redirect_uri=your-redirect-uri

After your user clicks Allow, the access will be granted, and he will be redirected to the URL you specified in the redirect_uri parameter with an authorization code provided as a query parameter called code.

After your app is granted, you can have an authorization code to exchange access token for access Quire API. The redirect_uri is optional. If omitted, the Redirect URL configured for your app is used. If specified, it must start with the configured Redirect URL.

Parameter	Value
client_id	{your-client-ID}
redirect_uri	Optional. The redirect URL after granted. If specified, it must start with the Redirect URL configured for your app (for a loopback URL, any port is accepted; see below). Otherwise, the configured URL will be used.
state	Optional. A random string generated by your app to protect from XSRF.

Loopback redirect URIs (native / CLI apps)

When the registered redirect URI's host is a loopback address — 127.0.0.1, [::1], or localhost — Quire accepts any port at request time, per RFC 8252 §7.3. Scheme, host, and path must still match the registered URI exactly.

For example, if your app registers http://127.0.0.1/callback, all of these are valid redirect_uri values at the authorize step (and must be echoed verbatim when exchanging the code):

http://127.0.0.1/callback
http://127.0.0.1:8866/callback
http://127.0.0.1:55123/callback

This lets installed apps (CLIs, desktop tools) bind to any free ephemeral port on the loopback interface and still receive the OAuth callback, without requiring users to keep a fixed port free. The rule applies only to loopback hosts — non-loopback redirect URIs continue to require a prefix match.

Retrieve Access Token

To retrieve the access token, you have to post a request to https://quire.io/oauth/token with the following data:

Parameter	Value
grant_type	authorization_code
code	{your-authorization-code}
client_id	{your-client-ID}
client_secret	{your-client-secret}
redirect_uri	Required if you specified redirect_uri in the previous authorization step. The value must be identical to the one used there.

curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=Your_code_from_previous_step&client_id=Your_app_client_id&client_secret=Your_app_client_secret&redirect_uri=Your_redirect_uri" \
  https://quire.io/oauth/token

The authorization code expires in 10 minutes and can be used only once.

Then, the access token will be returned in the response's body.

{
  "access_token":"ACCESS_TOKEN",
  "token_type": "bearer",
  "expires_in":3600,
  "refresh_token":"REFRESH_TOKEN"
}

The access token expires in 1 hour (expires_in is in seconds), and each request made with it extends it. Once it expires, use the refresh token to get a new one. The refresh token should be kept carefully and permanently since you need it to access every Quire API.

If a request to https://quire.io/oauth/token fails, the response is 400 with an OAuth error, for example:

{
  "error": "invalid_grant",
  "error_description": "The 'code' provided was invalid."
}

Refresh Access Token

To get a new access token, post a request to https://quire.io/oauth/token with the following data:

Parameter	Value
grant_type	refresh_token
refresh_token	{your-refresh-token}
client_id	{your-client-ID}
client_secret	{your-client-secret}

curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token&refresh_token=Your_refresh_token&client_id=Your_app_client_id&client_secret=Your_app_client_secret" \
  https://quire.io/oauth/token

The response has the same shape as above, with a new access_token. The refresh_token stays the same, so keep using it.

PKCE Support

Quire supports PKCE (RFC 7636) for public clients such as single-page apps and installed CLIs. To use it:

1. Add code_challenge and code_challenge_method=S256 to the authorization request.
2. Send code_verifier instead of client_secret when exchanging the authorization code for a token.

Note: Only S256 is supported. The redirect_uri rule above also applies — if you specified one at the authorization step, you must echo the same value when exchanging the code.

Access token lifetime

PKCE-issued access tokens are valid for 7 days (vs. 1 hour for confidential clients) and aren't extended by use. The response does not include a refresh_token — public clients have no client_secret with which to authenticate the refresh-token grant. When the access token expires, run the authorization flow again to obtain a new one.

This applies whenever code_challenge is sent, even by a confidential client. If your app needs a refresh token, don't use PKCE.

The expires_in field of the token response reflects the actual remaining lifetime, in seconds.

Use Access Token to Access Quire API

In each request, the access token must be put in the header. The header name is Authorization and the value is Bearer your_token.

After you exchange the access token, your app can make requests to Quire API on behalf of the authorized users.

curl -H 'Authorization: Bearer {access_token}' \
https://quire.io/api/user/id/me

{
  "email": "john@gmail.cc",
  "website": "https://coolwebsites.com",
  "id": "My_ID",
  "description": "This is *cool*!",
  "url": "https://quire.io/u/My_ID",
  "nameText": "My Name",
  "nameHtml": "My Name",
  "descriptionText": "This is cool!",
  "descriptionHtml": "This is <i>cool</i>!",
  "image": "https://quire.s3.amazonaws.com/oid/image.jpg",
  "iconColor": "37",
  "name": "My Name",
  "oid": "Dyh2YkFcu9uLgLFIeN1kB4Ld"
}

Token Expiration

A refresh token might stop working for one of these reasons:

• The user has revoked your app's access.
• The refresh token has not been used for 6 months.
• The user's account has been deleted.
• The user granted only some organizations and projects, and all of them have been deleted.
• Your app has been deleted.

Also, requests are rejected with 401 if the user hasn't signed in to Quire for more than 400 days, unless one of the user's organizations is on the Professional plan or above.

Publish App

By default, your app will be set as Private. You can change the app distribution to Public so that other Quire users can install your app to their workspace as well.

If your app is made available on Quire App Directory and you want to delete the app, you should communicate with your users first before deprecating the app.

WebHook

When one event on Quire is triggered, the system will send a payload to the webhook's configured URL.

A webhook is used by Quire to call an app, while Quire API is used by an app to call Quire. To receive these events, you have to specify a valid URL for Webhooks when configuring your app.

For a complete guide, see our blog post.

Every payload carries token, the Webhook Token you set when configuring your app, and secret, your app's Client Secret. Check both before trusting a payload, and ignore it if either doesn't match.

System Events

A system event is used to notify your app about system or app's activities.

Token Expiration

When the token has been expired or revoked, an event will be sent to your app. You can clean up your storage if necessary.

{
  "type": "system",
  "token": "hook-token-defined-by-you",
  "secret": "your-client-secret",
  "data": {
    "type": "token-revocation",
    "token": "the-refresh-token"
  }
}

Host Revocation

When the user revokes the grant to a host (either a project or an organization), an event will be sent to your app. You can clean up your storage if necessary.

{
  "type": "system",
  "token": "hook-token-defined-by-you",
  "secret": "your-client-secret",
  "data": {
    "type": "host-revocation",
    "token": "the-refresh-token",
    "host": "host-oid",
    "otype": "Project"
  }
}

• host is the OID of the project or organization, and otype is "Project" or "Organization".
• host is "*", with no otype, when the user revokes a grant that covered all their organizations and projects but still has other grants for your app.

Notification Events

A notification is the information about an update (aka., an activity). Here is an example:

{
  "type": "notification",
  "token": "hook-token-defined-by-you",
  "secret": "your-client-secret",
  "projectSummary": {
    "oid": "project-oid-where-event-occurred",
    "id": "project-id"
  },
  "organizationSummary": {
    "oid": "organization-where-event-occurred",
    "id": "organization-id"
  },
  "data": {
    "type": 0,
    "when": 1569831612000,
    "what": {
      "oid": "YxjapXXRCOYxoaiCT4tT3OQm",
      "id": 101,
      "name": "Brand new start",
      "parent": {
        "oid": "parent-oid",
        "id": 100,
        "parent": {
          "oid": "grand-parent-oid",
          "id": 99
        }
      }
    },
    "user": {
      "oid": "1AbDEFed2A5031BEDDweqmde",
      "id": "john.doer",
      "name": "John Doer"
    },
    "message": "<a href=\"https://quire.io/u/john.doer\">John Doer</a> added <a href=\"https://quire.io/w/MyProjects/101\">Brand new start</a>",
    "text": "John Doer added Brand new start",
    "url": "https://quire.io/w/MyProjects/101"
  } 
}

• type is the activity's type (see Activity Types), and when is when it happened, in milliseconds since the epoch.

• what is the task, project, or organization the activity is about, depending on type. It is the full record, as Get an existing task by its ID, Get a project by ID or Get an organization by ID returns it, except that a task carries no formula field values.

• user is the user who did it.

• The data map may also include an optional value field, which provides detailed information as a map. For example, for an assignment notification, value includes the assignee’s ID, name, and URL.

• For a reminder's change (types 84, 87, 88, 192, 193 and 194 in Activity Types), value is the reminder itself, as Get a reminder by OID returns it, or only its oid once removed.

• If the notification is about a start or due change, the data map will include an additional due field. This value is a date/time formatted in the user’s locale and time zone.

• If what is a task, its parent field holds the parent's oid and id, or null if the task has no parent. If the task’s parent also has a parent, the map includes a nested parent field as well.

• The projectSummary and organizationSummary fields provide information about the project and organization where the event occurred.

• There is an additional field, taskSummaries, for activities that can affect multiple tasks (for example, removing a task that has subtasks). This field is a list of map instances. Each map represents a task that was changed. If any of that task's subtasks were also changed, they are included in the map’s tasks field.

  • Please refer to Activity Types | taskSummaries.

Registration for Notifications

For instructions on updating a project or a task, see Update a project by ID and Update an existing task by its ID.

If the app wants to receive notifications of specific projects or tasks, it can follow the projects or tasks by sending a PUT request to the URL. To add a follower, the body of the request can be:

Syntax 1

{
  "addFollowers": ["app"]
}

where app is a keyword. It indicates that the app would like to receive the notifications about the given target (a project or a task). That is, it'll add the app into the target's followers.

Syntax 2

In addition, you can specify additional information that will be passed as part of a notification in the following syntax.

"app|team|channel"

where app is a keyword while team and channel are application specific. That is, you can pass any value to team and channel.

Note: team and channel can not contain '|'.

For example,

{
  "addFollowers": ["app|extra101"]
}

Then, the notification will carry an additional field called team with the value "extra101" (data is the same as without it; it's left empty in these examples):

{
  "type": "notification",
  "team": "extra101",
  "data": {}
}

Another example:

{
  "addFollowers": ["app|extra101|channel9"]
}

You'll get:

{
  "type": "notification",
  "team": "extra101",
  "channel": "channel9",
  "data": {}
}

Syntax 3

"app|team|channel|mine"

where both app and mine are keywords. It is similar to Syntax 2, except it receives only notifications that match the notification setting of the user.

If you don't need both team and channel, you can specify: "app|||mine".

The notification setting can be found at https://quire.io/w/YourProject?view=setting&tab=options#notifications

Syntax 4

"app|/path"

where app is a keyword, and /path is application specific. The path will be appended to the app's hook URL. For example, assume the app's hook URL is "https://super.app/hooks/standard", and the follower "app|/soc/id279/channel51". Then, the notification will be posted the following URL: "https://super.app/hooks/standard/soc/id279/channel51".

Syntax 5

If you'd like to pass additional information in this syntax, you can append it as follows.

"app|/path|channel"

For example, app|/soc/id8|box51. Then, box51 will be part of the JSON object sent to the hook URL.

{
  "type": "notification",
  "channel": "box51",
  "data": {}
}

Responding and Retries

When receiving the notification, your Web Hook shall return a status code between 200 and 299 within 1 minute to indicate success.

If a status code other than above is returned, or there is no response within 1 minute, we will retry 2 hours later, then 1 day later. If the last retry fails too, the payload is dropped.

Payloads to the same URL are posted one at a time. After 5 failures in a row, the URL is treated as down: new payloads to it wait for the retries above instead of being posted right away, and the admins of your app's organization get an email (at most once a day). Quire keeps probing the URL and resumes delivery once it returns a 2xx status again.

Activity Types

• Activity Types

Rate Limits

To protect the stability of the API and keep it available to all users, Quire enforces multiple kinds of rate limiting. Requests that hit any of our rate limits will receive a 429 Too Many Requests response. We may change these quotas or add new quotas in the future.

Here are the limits by plan.

Plan	Maximum requests per organization, per minute	Maximum requests per organization, per hour
Free	50	200
Professional	300	1,250
Premium	1,000	5,000
Enterprise	100 × members, at least 1,000	500 × members, at least 5,000

Note: the limit is per-organization. It sums up the total number of all accesses from all applications for each organization. Organizations that share one subscription also share one limit: their accesses are summed up together. Enterprise quotas scale with the number of paid members in the organization. A trial doesn't change these limits; they stay those of the plan before the trial. For more quota, please refer to Pricing.

Note: a personal project (the one behind My Tasks) is metered against its own bucket at half the limits of the best plan among the user's organizations, trials excluded — e.g. 25 per minute / 100 per hour on the Free plan. For Enterprise, it is half the Premium limits: 500 per minute / 2,500 per hour.

When a rate limit is exceeded, the response includes a standard Retry-After header whose value is the number of seconds to wait before retrying. The value reflects the time until the offending per-minute or per-hour counter resets, so clients can back off precisely instead of guessing.

HTTP/1.1 429 Too Many Requests
            Retry-After: 37
            Content-Type: application/json
            
            {"code": 429, "message": "..."}
            

Apart from the limits above, more than 500 requests in progress at once with the same access token from the same IP address also receive 429, with Retry-After: 30. Wait for pending requests to complete before sending more.

To inspect current usage without consuming budget, call GET /rate-limit/id/{id} (or /rate-limit/{oid}). Calls to that endpoint are free — they never count against the quota.

Request cost

Most calls cost 1 unit against the per-minute / per-hour budget above — a single-item GET / POST / PUT / DELETE on one record, a storage call, and so on. A few endpoint families scale their cost with how much work they actually do:

Endpoint family	Cost
Task list, subtree, and search (GET)	max(1, ceil(items / 100)) units, where items is the number of tasks returned. So ?limit=100 (or fewer) costs 1, ?limit=1000 costs 10, ?limit=no returning 5,000 items costs 50.
Bulk write — bulk-add, bulk-update, bulk-remove, bulk-move, bulk-transfer, bulk-approve	N units, where N is items.length in the request body (for bulk-add, every task created, nested tasks included) — the same total cost as N equivalent single-task calls. ?dry-run=true halves it to ceil(N / 2) (minimum 1). A batch holds at most 300 items, and no more than the per-minute limit — e.g. 50 on the Free plan, or 25 in a personal project on the Free plan; over the plan's limit is rejected with 402 (code 469), over 300 with 400.
POST /task with nested tasks	1 unit per task created, nested ones included. Capped like a bulk write: at most 300 tasks, and no more than the per-minute limit.
Project CSV / JSON export	5 + max(1, ceil(tasks / 100)) units — the same per-100 read cost as a list, plus a flat 5-unit export surcharge. tasks counts only those matching the ?status= filter, not the project total. So a 100-task export costs 6, a 1,000-task export costs 15, and a 5,000-task export costs 55. Only an export that runs costs this: one rejected with 402 for the plan costs 1 unit, like any call.
POST /notification	ceil(recipients / 10) units (minimum 1), counted from the resolved recipient list. Charged only after the recipients are resolved, so a call rejected with 404 costs nothing.
GET /insight/run/{oid}	1 unit, plus ceil(tasksLoaded / 250) - 1 when more than 250 tasks are loaded. tasksLoaded reflects the ?status=-filtered task set, so a tighter filter lowers the charge.
GET /rate-limit/..., GET /user/{oid}, GET /user/id/{id}, GET /user/list, GET /project/list (without an organization), GET /organization/list	Free — never counted.

Size limits

The body of a request can't be larger than 1 MB; a larger one gets 413 Content too large. Two exceptions:

• A storage value is at most 4 KiB as JSON; a larger one gets 413.
• A file uploaded with attach is limited by the plan's per-file size and storage quota instead; over either, 402 (code 469).

Compact Responses

Many endpoints accept an optional ?return= query parameter to control the shape of the response body:

• full (default) — the full record.
• compact — identifiers only:

Entity	Compact shape
Task, project, organization, sublist, document, chat, insight, dashboard	{"oid": "…", "id": …}
Comment, reminder, tag	{"oid": "…"}
Custom field (of a project or an insight)	{"name": "…"}
Approval category	{"id": "…"}
Status	{"value": …}

💡 Tip — pass ?return=compact whenever you don't need the full record back. It is strictly better for the caller (less bandwidth, fewer LLM tokens) and for the server, which then skips a post-write reload plus the full response render — including per-user lookups, custom-field expansion, and so on. The default stays full only for backward compatibility; new callers (MCP integrations, scripted clients, anything that just chains calls by OID/ID) should default to compact.

Where it applies

?return= is honored by:

• Single-item POST / PUT create and update endpoints, and every PUT …/undo-remove/… (task, comment, sublist, document, chat, insight, dashboard).
• GET /task/list/…, in both the flat and the ?depth>1 subtree form. Items render as {oid, id, cursor?}, and subtree nodes as {oid, id, tasks?, cropped?}.
• Bulk write endpoints, where it applies to every element of the returned array; null slots for skipped items are preserved in either mode. See Rate Limits for what those calls cost.

It is ignored by a GET on a single record, by DELETE, by the search endpoints (search, search-organization, search-folder), and by the timelog, attach, emoji, storage, and notification endpoints — their response shape is fixed. DELETE /task/bulk-remove/… likewise ignores it, since its response is already in identifier shape.

On an endpoint that honors ?return=, an empty value means full, and any value other than full or compact returns 400 Bad Request. Elsewhere any value is ignored.

Status Codes

Code	Meaning	Description
200	Success	Request successful
204	No Content	Request successful; the endpoint has no response body to return. A DELETE also returns 204 if the resource doesn't exist, except remove-timelog, which returns 404 when no time log matches, and any /storage/id/… path (404: storage has no ID form).
400	Bad Request	You're using a wrong parameter, or passing incorrect data.
401	Unauthorized	Invalid or expired token.
402	Payment required	The organization’s subscription does not permit use of this app, the subscription has expired, or a plan quota/limit has been reached (body code 469 or 470 — see below).
403	Forbidden	Not authorized to access the resource, the Authorization header is missing or malformed (body code 100), or temporarily blocked (body code 471 — see below).
404	Not Found	The specified resource could not be found.
405	Method not allowed	Method not allowed or supported.
408	Request Timeout	The request took longer than 10 minutes to process. Retry later, or split it into smaller requests.
409	Conflict	The request conflicts with the current state, such as creating something that already exists. message says what conflicts.
413	Content too large	The request's content is larger than 1 MB, or a storage value is larger than 4 KiB. A file upload is limited by the plan instead (402).
418	Not valid JSON content	The request's content doesn't appear to be JSON.
429	Too Many Requests	Exceeded the rate limit for API calls, or sent too many requests at once. Carries a Retry-After header.
500	Internal Server Error	There is an unexpected error.
503	Service Unavailable	Server is down for maintenance.

Error Responses

All 4xx and 5xx responses share a common JSON envelope, represented by the ErrorResponse schema:

{ "code": 400, "message": "Invalid value for `priority`: foo (expected -1, 0, 1, or 2)." }

• code is the HTTP status code, echoed in the body — except for 402, where it is 469 (a plan quota/limit has been reached) or 470 (the subscription has expired), and for 403, where it is 471 if the account is temporarily blocked, or 100 if the Authorization header is missing or malformed. These let clients tell the cases apart without parsing message.
• message is a human-readable description, typically naming the offending field and — for 400 — the expected format. Long submitted values are truncated.

Each endpoint's Responses block lists the specific status codes that endpoint can emit; the body shape is this same envelope everywhere.

Error Code	Meaning
100	General authentication error, such as a missing or malformed Authorization header (returned with HTTP 403).
400	Bad request including wrong request body, wrong parameter and so on.
401	Invalid or expired token.
403	Forbidden.
404	Resource not found.
405	Method not allowed.
408	Request timeout.
409	Conflict.
413	Request too large.
429	Too many invocations (the rate limit).
469	Quota exceeded, such as number of projects, number of members, and other plan limits. Returned with HTTP 402.
470	Subscription expired. Returned with HTTP 402.
471	Temporarily blocked; try again later. Returned with HTTP 403.
500	General invocation error. Most likely, an internal error.

Quire MCP Server

Quire offers an MCP (Model Context Protocol) server that lets AI assistants — Claude, ChatGPT, Cursor, VS Code, and other MCP-compatible clients — work with your Quire workspace through natural language.

Once connected, the assistant can list and search your projects, create or update tasks and subtasks, post comments, manage tags, sublists, statuses, documents, chats, insights, dashboards, and more — all on your behalf and within the permissions you grant.

Quire MCP is built on top of the same Quire REST API documented here, so anything an integration can do via REST is reachable from an AI assistant once it is connected.

Server URL

The Quire MCP server is hosted at:

https://mcp.quire.app/mcp

Authentication is handled by OAuth 2.1 — your AI assistant walks you through the standard authorization screen, you approve access for the workspaces you choose, and the assistant receives a token scoped to your account. No client ID or client secret needs to be configured by the end user.

The server speaks the Streamable HTTP transport and supports Dynamic Client Registration (RFC 7591) and PKCE (RFC 7636), so any compliant MCP client can connect with just the URL above.

What you can do

The Quire MCP server exposes the full Quire object model as MCP tools. At a high level:

Category	What the AI can do
User & Organizations	Identify the current user, look up users, list and update organizations
Projects	List, search, and inspect projects; manage members, custom fields, and approval categories
Tasks	Create, update, move, transfer, complete, approve, and delete tasks; manage dates, peekaboo, and time logs; search across a project, folder, or organization
Bulk operations	Create, update, move, transfer, approve, or delete many tasks in one call
Subtasks & Sublists	Build task hierarchies, group tasks into sublists, and reorder within sublists
Comments & Attachments	Read and post comments on tasks and chats; attach files to tasks or comments
Tags & Statuses	Manage the project's tag library and workflow statuses
Documents	Create, read, update, and delete project documents
Chats & Insights	Start chat threads, post chat comments, and manage insight reports and their fields
Dashboards	Create, read, update, archive, and delete dashboards for a project, organization, or folder (widget contents are not yet exposed)
External teams	List and inspect a project's external teams (partners)
URL resolver	Turn any pasted Quire URL (task, project, document, …) into the underlying object

For the authoritative, always-up-to-date list of tools and their parameters, run tools/list from your MCP client after connecting.

Connect your AI assistant

You only need the server URL — the authorization flow is started by the client and completed in your browser.

Claude Desktop

1. Open Settings → Connectors.
2. Click Add custom connector.
3. Enter a name (for example, Quire) and the URL https://mcp.quire.app/mcp.
4. Save and click Connect. Claude Desktop will open a browser window where you can sign in to Quire and grant access.

Claude Code

Add the server with one command:

claude mcp add --transport http quire https://mcp.quire.app/mcp

Then trigger the OAuth flow from inside Claude Code:

/mcp

Pick quire, follow the link to authorize, and you're done.

Gemini CLI

Edit ~/.gemini/settings.json (user scope) or .gemini/settings.json (project scope):

{
  "mcpServers": {
    "quire": {
      "httpUrl": "https://mcp.quire.app/mcp",
      "authProviderType": "dynamic_discovery"
    }
  }
}

Restart Gemini CLI, then trigger OAuth:

/mcp auth quire

dynamic_discovery makes the CLI auto-detect the OAuth requirement, register a client, and open a browser to authorize. (OAuth requires that your local machine can receive a redirect on http://localhost:7777/oauth/callback.)

Codex CLI

Add the server with one command:

codex mcp add quire --url https://mcp.quire.app/mcp

Or edit ~/.codex/config.toml directly:

[mcp_servers.quire]
url = "https://mcp.quire.app/mcp"

Then trigger the OAuth flow:

codex mcp login quire

Codex CLI opens a browser where you sign in to Quire and approve access. (If your environment needs a fixed callback port, set mcp_oauth_callback_port at the top of config.toml.)

ChatGPT

ChatGPT supports remote MCP servers as Plugins (available on Plus, Pro, Business, Enterprise, and Edu plans).

1. Open chatgpt.com and go to Settings → Plugins.
2. Click Browser plugins.
3. Click the + icon at the upper right corner to add a new plugin.
4. Enter a name (for example, Quire) and the URL https://mcp.quire.app/mcp.
5. Sign in to Quire when prompted and approve access.

Perplexity

Perplexity supports remote MCP servers as Custom Connectors on paid plans (Pro, Max, Enterprise).

1. Open perplexity.ai and go to Settings → Connectors.
2. Click Add Connector → Advanced (or Add custom connector).
3. Enter a name (for example, Quire), set the URL to https://mcp.quire.app/mcp, and choose Streamable HTTP as the transport with OAuth as the authentication method.
4. Save, then click Connect and sign in to Quire to approve access.

Microsoft Copilot Studio

Copilot Studio connects to remote MCP servers through the MCP onboarding wizard in your agent.

1. Open your agent in Copilot Studio and go to the Tools page.
2. Select Add a tool → New tool → Model Context Protocol.
3. Fill in the wizard:
   • Server name: Quire
   • Server description: a short summary the agent orchestrator can use to decide when to call the server (for example, "Manage Quire projects, tasks, and comments").
   • Server URL: https://mcp.quire.app/mcp
   • Authentication: OAuth 2.0 → Dynamic discovery.
4. Select Create, then Next. On Add tool, choose Create a new connection, sign in to Quire, and approve access.
5. Click Add to agent.

Dynamic discovery uses Quire's OAuth metadata to register a client and complete authorization automatically — no client ID or secret needs to be configured by hand.

Cursor

Add the following entry to your MCP settings (~/.cursor/mcp.json or Settings → MCP):

{
  "mcpServers": {
    "quire": {
      "url": "https://mcp.quire.app/mcp"
    }
  }
}

Reload Cursor and complete the OAuth flow when prompted.

VS Code (GitHub Copilot Chat)

Create or edit .vscode/mcp.json in your workspace (or the user-level equivalent):

{
  "servers": {
    "quire": {
      "type": "http",
      "url": "https://mcp.quire.app/mcp"
    }
  }
}

Open the Command Palette and run MCP: List Servers, select quire, and start it. VS Code will open a browser to authorize.

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "quire": {
      "serverUrl": "https://mcp.quire.app/mcp"
    }
  }
}

Restart Windsurf and authorize when prompted.

Other MCP clients

Any client that supports Streamable HTTP MCP servers with OAuth can connect — just point it at https://mcp.quire.app/mcp. For clients that only speak the older stdio transport, use a bridge such as mcp-remote:

{
  "mcpServers": {
    "quire": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.quire.app/mcp"]
    }
  }
}

Authorization scopes

The first time you connect, Quire shows the standard authorization screen. You can choose:

• Which organizations and projects the assistant may access.
• What it may do — the same permission scopes that apply to regular Quire OAuth apps (see Authentication).

You can revoke access at any time from your Quire account settings, or by removing the connector from your AI client.

Privacy and rate limits

• Quire MCP requests count against the same per-organization API quotas as direct REST calls — see Rate Limits.
• Conversations with your AI assistant are not stored on Quire's servers; the MCP server only sees the individual tool calls the assistant makes on your behalf.
• All traffic is encrypted in transit (HTTPS); access tokens are never exposed to model output.

Troubleshooting

• "Connection refused" or "Failed to authenticate" — make sure the URL is exactly https://mcp.quire.app/mcp (with the /mcp path) and that your client supports the Streamable HTTP transport.
• Authorization screen never appears — some clients require you to manually trigger the OAuth flow (for example, /mcp in Claude Code). Check the client's MCP server panel for an "authorize" button or status message.
• The assistant can't see a project — confirm the project belongs to an organization you authorized, and that your Quire role on that project allows the action you're asking for.
• Tool calls return 429 Too Many Requests — you have hit the per-organization rate limit. The assistant will receive a Retry-After value; wait that many seconds before retrying.

If a problem persists, contact Quire support with the timestamp of the failing request and (if shown) the request ID surfaced by the MCP client.

Quire CLI

Quire offers a command-line interface (@quire-io/quire-cli) that lets developers and power users drive their Quire workspace from a terminal or a shell script.

Once you are signed in, you can list and search projects, create or update tasks and subtasks, post comments, manage tags, sublists, statuses, documents, chats, insights, and more — and pipe the results into jq, xargs, or any other Unix tool.

Quire CLI is built on top of the same Quire REST API documented here, so anything an integration can do via REST is reachable from your terminal once you have signed in.

Install

The CLI ships through three channels.

npm (recommended)

Requires Node 20 or later.

npm install -g @quire-io/quire-cli
quire --version

Try it without installing:

npx @quire-io/quire-cli --help

The package is published as @quire-io/quire-cli; the installed binary is named quire.

Homebrew

For macOS or Linux users with Homebrew:

brew install quire-io/quire/quire
quire --version

This installs the same single-file binary that GitHub Releases ships, via the quire-io/homebrew-quire tap. After the first install, brew upgrade quire keeps you on the latest version.

Single-file binary

For machines that do not have Node, download a pre-built binary from the GitHub Releases page. One artifact per platform is attached to every release:

Platform	Filename
macOS, Apple Silicon	quire-darwin-arm64
macOS, Intel	quire-darwin-x64
Linux, x86_64	quire-linux-x64
Linux, ARM64	quire-linux-arm64
Windows, x86_64	quire-win-x64.exe

Each release also ships a SHA256SUMS file so you can verify the download. On Unix:

curl -LO https://github.com/quire-io/quire-cli/releases/latest/download/quire-darwin-arm64
curl -LO https://github.com/quire-io/quire-cli/releases/latest/download/SHA256SUMS
shasum -a 256 -c SHA256SUMS --ignore-missing
chmod +x quire-darwin-arm64
mv quire-darwin-arm64 /usr/local/bin/quire
quire --version

The binaries embed Node 22 LTS, so no separate runtime is required.

Updating

How you update the CLI depends on how you installed it:

Installed via	Upgrade command
npm i -g	npm i -g @quire-io/quire-cli@latest
Homebrew	brew upgrade quire
npx	nothing — npx @quire-io/quire-cli always pulls the latest unless you pinned a version
GitHub Releases binary	re-download from the Releases page and replace the binary on $PATH

Check your installed version with quire --version and compare against the Releases page.

Get started

quire login          # opens your browser, runs OAuth, saves credentials locally
quire whoami         # confirms the signed-in user and lists their organizations
quire project list   # first read against the API

quire login runs the OAuth public-client flow ( PKCE, RFC 7636) over a loopback redirect ( RFC 8252). The browser opens to the Quire authorization screen; after you approve, control returns to the CLI and the resulting tokens are saved to:

• ~/.config/quire/credentials.json on Linux and macOS (mode 0600)
• %APPDATA%\quire\credentials.json on Windows

The file is encrypted at rest with AES-256-GCM. The key is derived from your username and hostname, so a copy of the file taken to another machine or another user account cannot be decrypted.

As a public client, the CLI gets no refresh token: the access token lasts 7 days, after which you run quire login again.

What you can do

The CLI exposes the full Quire object model as subcommands. Run quire --help for the top-level list, or quire <command> --help for any subcommand.

Category	Commands
User & Organizations	quire whoami, quire user get, quire org list / get / update / limit
Projects	quire project list / get / update / members / export, quire project field, quire project approval-category
Tasks	quire task list / get / tree / search / subtasks / comments, quire task create / subtask / update / complete / uncomplete / move / transfer / delete, quire task dates / peekaboo / approve / revoke-approval, quire task timelog, quire mine
Bulk operations	quire task bulk-create / bulk-update / bulk-delete / bulk-move / bulk-transfer / bulk-approve / bulk-subtasks (up to 300 tasks per call; fewer on the Free plan or in a personal project, see Rate Limits)
Sublists	quire sublist list / get / create / update / delete / add-task / remove-task / undo-remove
Tags & Statuses	quire tag and quire status (list / get / create / update / delete)
Comments & Attachments	quire comment list / get / add / update / delete, quire task attach, quire comment attach
Chats	quire chat list / get / create / update / delete / comments, quire chat comment add
Documents	quire doc list / get / create / update / delete / undo-remove
Insights	quire insight list / get / create / update / delete, quire insight field
Partners	quire partner list / get
Notifications	quire notify — send a self-targeted in-app notification
URL resolver	quire resolve — turn any Quire URL into the underlying object
Undo	quire undo — restore a recently deleted task, sublist, document, comment, chat, or insight
Reference	quire colors — list Quire's 48-slot color palette

Output modes

Every command supports three output modes, controlled by global flags:

• Default — colorized, human-readable tables (or aligned key-value blocks for get commands). Long cells are truncated; pass --no-truncate to keep the full text.
• --json — the raw API response, unmodified, on stdout. Designed to round-trip through jq, yq, or any other JSON tool.
• --quiet (-q) — only the resource ID, one per line. Designed for xargs.

Examples:

# human-readable
            quire task search "release notes" --project my-project --mine
            
            # scriptable
            quire task search "release notes" --project my-project --json | jq '.[].name'
            
            # pipeline-friendly
            quire task search "stale" --project my-project -q | xargs -L1 quire task complete
            

Other useful global flags:

• --color-mode auto|always|never (or NO_COLOR=1) controls ANSI colors.
• --yes auto-confirms destructive prompts (quire task delete, quire task bulk-delete, …). Required for non-interactive use.
• --profile <name> selects a credentials profile (see below).
• --verbose prints debug information to stderr.

The CLI keeps stdout clean for piping: prompts, progress messages, and warnings all go to stderr, and a broken pipe (e.g. quire ... | head) exits 0 silently.

Profiles

The CLI supports multiple credentials stores via --profile. Each profile gets its own file (credentials.<name>.json) under the same config directory.

quire login   --profile work
quire login   --profile personal
quire whoami  --profile work
quire mine    --profile personal

The default profile is default; override per shell with QUIRE_PROFILE=....

quire logout [--profile <name>] deletes the local credentials file. It does not revoke the CLI's access on the Quire server. To do that, also open Account Settings > Apps ( https://quire.io/r/setting?tab=app) and remove the Quire CLI app.

Configuration

Environment variable	Default	Purpose
QUIRE_PROFILE	default	Profile selected when --profile is not passed
QUIRE_CONFIG_HOME	~/.config/quire/ (Unix), %APPDATA%\quire\ (Windows)	Where credentials and other CLI state live
QUIRE_API_SERVER	https://quire.io/api	Override the API base URL (advanced; the CLI prints a warning to stderr when set)
QUIRE_CLI_LOOPBACK_PORT	8866	Local port the OAuth callback listens on. Any free port works, since Quire accepts any port on a loopback redirect URI
NO_COLOR	unset	Set to any value to disable ANSI colors

Authorization scopes

The first time you run quire login, Quire shows the standard authorization screen. You can choose:

• Which organizations and projects the CLI may access.
• What it may do — the same permission scopes that apply to regular Quire OAuth apps (see Authentication).

You can revoke access at any time by removing the Quire CLI app in Account Settings > Apps ( https://quire.io/r/setting?tab=app).

Privacy and rate limits

• CLI requests count against the same per-organization API quotas as direct REST calls — see Rate Limits. On a 429, the CLI waits for the Retry-After value (with a small jitter, capped at 60 seconds) and retries once before failing.
• Credentials live only on the machine where you ran quire login. Nothing is sent to Quire other than authenticated API calls.
• All traffic is encrypted in transit (HTTPS); access tokens never appear in command output, only in the encrypted credentials file.

Troubleshooting

• Not logged in. Run \quire login`.` — credentials are missing, expired, or revoked. Run quire login again.
• The browser does not open during quire login. — the authorization URL is also printed to stderr. Copy and paste it into any browser; the loopback callback will still complete the flow.
• Failed to bind 127.0.0.1:8866 — another process is using the OAuth callback port. Pick a free port, set QUIRE_CLI_LOOPBACK_PORT=<port>, and re-run quire login.
• 429 Too Many Requests — the CLI auto-retries once after the server-supplied delay. Past that, wait and re-run; the per-organization rate limit is documented at Rate Limits.
• quire ... | head prints a broken-pipe stack trace. — you should not see this; the CLI catches EPIPE and exits 0. If you do see it, please report it as a bug.
• Output looks corrupted on Windows. — make sure your terminal supports ANSI escape sequences (Windows Terminal, VS Code's terminal, and modern PowerShell do). Otherwise pass --color-mode never or set NO_COLOR=1.

If a problem persists, contact Quire support with the timestamp of the failing request, the command line you ran (with any tokens or IDs redacted), and — if helpful — the output of the same command with --verbose.

Emojis

When adding or removing a comment's emoji reactions, an emoji can be given as the emoji itself or by one of its names below, with or without colons and in any case. The names are the shortcodes GitHub and Slack use. For example, +1, :thumbsup: and 👍 are the same.

Emoji	Names
😃	smiley
😞	disappointed
😐	neutral_face
😂	joy
😍	heart_eyes
😜	stuck_out_tongue_winking_eye
😏	smirk
😱	scream
😭	sob
😡	rage, pout
👍	+1, thumbsup
👎	-1, thumbsdown
🙌	raised_hands
👊	punch, facepunch, fist_oncoming
💪	muscle
❤️	heart
🎉	tada
🚀	rocket
💯	100
⚠️	warning

❤ and ⚠ without the variation selector (U+FE0F) are accepted as ❤️ and ⚠️. Responses always return the emoji itself.

💡 Tip — prefer names when calling from a script or an AI assistant. A name needs no percent-encoding in the URL, and it can't fall victim to a missing variation selector or a look-alike character. POST /comment/add-emoji/{commentOid}/+1,tada is the same request as POST /comment/add-emoji/{commentOid}/%F0%9F%91%8D,%F0%9F%8E%89.

https://quire.io/api