Before you start
Every Cowork endpoint needs a Bearer token for a person, sent asAuthorization: Bearer <token>. The token must belong to a company admin. A company API token is refused with 403, because Cowork records every write against the person who made it.
The person’s role needs the permission for what you do:
Create a task
Send the task to Submit standalone company work:client_idis your own identity for this submission, unique within the company. It takes letters, digits,_and-. Sending the same submission again returns the task already stored, so a retry never makes a second ticket. A different submission with aclient_idalready used answers409.titleis required, up to 255 characters.descriptionis optional, up to 10,000 characters.due_onis optional: a calendar day,YYYY-MM-DD. A day that doesn’t exist, such as2026-02-30, is refused with422.
201 with the new task under task. Keep its id and its lock_version: you need both to change it. A new task starts open.
Read the tasks
List the company’s work returns undeleted tasks, the most recently updated first:- Results use cursor pagination. Ask for up to 100 tasks with
page[limit](25 by default), and pass the cursor frommeta.pagination.next_cursoraspage[cursor]for the next page. filter[status]keeps the statuses you list, comma-separated.filter[assignee]keeps tasks assigned to one person by their user id, to nobody (unassigned), or to Mist (agent).sortisupdated(the default),boardfor the order the board draws a column, ordue.
Change a task
Each change below carriesexpected_version: the lock_version you last read. If someone changed the task since, the change is refused with 409, and the answer includes the current task, so retry against that one.
Change what the company’s work says changes the title, description, kind, priority or due date. Send only what changes:
priority is urgent, high, medium, low, or null. kind is bug, change, feature, design, support, or null.
Status and owner have routes of their own:
- Record a person’s verdict on the company’s work moves the task with
status_change. Itsstatusisopen,needs_info,in_progress,revieworskipped. In a company with Cowork on, only the people working a ticket move it, such as its assignee. Anyone else is refused with403. - Say who owns the company’s work assigns the task with
assignment. Itsassigneeis{ "kind": "user", "user_id": 42 }for an admin of the company, ornullfor nobody.
Create tasks from a Site
On a company Site, the page can call Cowork itself, as the admin who has it open. Declarecowork: write (and cowork: read to list tickets) in config/access.json, have your company allow cowork under Visitor data, and call /cowork/tasks with fluid.api. Each call does what the visitor could do with their own sign-in, so a visitor who can’t use Cowork gets 403. See File a Cowork ticket.
That only reaches Cowork as the visitor, on a company Site. To file tickets for visitors who can’t use Cowork themselves, or from a member’s own Site, use a server function instead. A function has no Fluid credential of its own that reaches Cowork, so keep an admin’s token as a secret and call the API with fetch:
functions/file-ticket.ts
signed_in access in config/functions.json, so only signed-in visitors can file. Every task it makes is created as the admin whose token it holds, so the function names the visitor in the description.