Everything an AI agent can do with the Trello API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints25
API version1
Last updated22 June 2026
Orientation

How the Trello API works.

The Trello API is how an app or AI agent works with a Trello workspace: reading the boards, lists, and cards a user can see, creating and moving cards, commenting, and watching for changes. Access is granted through an API key that identifies the application and a user token that represents one person, and the token carries scopes, read, write, and account, that set what a call may do. A token reaches only the boards and organizations its member can already see, so scope and membership together draw the boundary, and Trello can post a change to a registered webhook.

25Endpoints
5Capability groups
11Read
14Write
3Permissions
Authentication
Trello authenticates a call with an API key plus a user token, not a single secret. The key identifies the application and may be public; the token represents one Trello user, grants access to their whole account, and must be kept secret. Both are sent as key and token query parameters or in an OAuth Authorization header. A token can also be obtained through the /1/authorize route or OAuth 1.0a, and Trello has announced a move to OAuth 2.0 through Forge.
Permissions
A token carries one or more of three scopes: read (reading boards, organizations, and so on), write (writing them), and account (reading a member's email, writing member info, and marking notifications read). A token also only reaches the boards and organizations its member can already see, so scope and membership together set the boundary. A token's expiry is chosen at authorization: 1hour, 1day, 30days, or never.
Versioning
The REST API carries a single path version, 1, under https://api.trello.com/1, and Trello does not mint new version numbers. Dated changes, deprecations, and the announced OAuth 2.0 migration ship through the developer changelog instead, so an integration tracks the changelog rather than pinning a version header.
Data model
Trello is organized as boards that hold lists, lists that hold cards, and members who belong to boards and organizations. The API is resource-oriented over these objects with predictable /1//{id} paths, returns JSON, and lets a request trim or nest fields with the fields parameter. A change to a watched model emits an action, like createCard or updateCard, that a webhook can deliver.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Trello determines what it can reach. A call carries an API key that identifies the application and a token that represents one user, and the token's scopes and that user's board memberships set the boundary of what the call can read or change.

Ways to connect

REST API

The REST API is served from https://api.trello.com/1, returns JSON, and selects fields with a fields query parameter. A call passes an API key and a user token, either as key and token query parameters or in an Authorization header as OAuth oauth_consumer_key and oauth_token. The route accepts both singular and plural nouns, so /1/members/me and /1/member/me are equivalent.

Best forConnecting an app or AI agent to Trello.
Governed byThe API key, the user token, and the token's scopes.
Docs ↗

Webhooks

Trello POSTs a JSON payload to a registered callback URL when a watched model changes, carrying the action, the updated model, and the webhook itself. A webhook is tied to one token and one model id, and a token's webhook is removed when the token expires. Each delivery includes an X-Trello-Webhook header, a base64 HMAC-SHA1 digest of the request body concatenated with the callback URL, so a receiver can confirm the request came from Trello. A webhook that fails for 30 days is disabled.

Best forReceiving Trello changes at an app or AI agent.
Governed byThe token the webhook was created under and its scopes.
Docs ↗
Authentication

API key + token

An API key identifies the application and is tied to a Power-Up; it is acceptable for the key to be public. A user token represents one Trello user and grants access to their account, so it must be kept secret. The token carries scopes (read, write, account) and an expiry chosen at authorization (1hour, 1day, 30days, or never), and a call sends both the key and the token.

TokenAPI key + user token (query params or OAuth header)
Best forServer-side calls on behalf of one user.
Docs ↗

1/authorize route

An application sends a user to the /1/authorize route with its API key, the requested scopes, and an expiration, and Trello returns a user token after the user approves. This is the simpler of the two token-granting flows and is used by many client-side integrations.

TokenUser token from the authorize redirect
Best forGranting a token without a full OAuth exchange.
Docs ↗

OAuth 1.0a

Trello supports the standard OAuth 1.0a flow to obtain a user token, with the same read, write, and account scopes. Trello has announced it is moving to OAuth 2.0 (3LO) through Forge, which will add new scopes, resource restrictions, and token expiry.

TokenOAuth 1.0a user token
Best forStandards-based delegated authorization.
Docs ↗
Endpoint reference

Every Trello API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Boards

Methods for working with boards, the top-level container for lists and cards.7

Needs the read scope; the token must belong to a member who can see the board.

Acts onboard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the write scope.

Acts onboard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcreateBoard
Rate limitStandard limits apply

Needs the write scope.

Acts onboard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventupdateBoard
Rate limitStandard limits apply

Needs the write scope; the deletion is irreversible and removes the board's lists and cards.

Acts onboard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the read scope.

Acts onlist
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the read scope; a request for too many cards at once can return API_TOO_MANY_CARDS_REQUESTED.

Acts oncard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the read scope.

Acts onmember
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Lists

Methods for working with lists, the columns that hold cards on a board.5

Needs the read scope.

Acts onlist
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the write scope.

Acts onlist
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcreateList
Rate limitStandard limits apply

Needs the write scope.

Acts onlist
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventupdateList
Rate limitStandard limits apply

Needs the write scope; archiving keeps the list and its cards rather than deleting them.

Acts onlist
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventupdateList
Rate limitStandard limits apply

Needs the read scope.

Acts oncard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Cards

Methods for working with cards, the individual items on a list.5

Needs the read scope.

Acts oncard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the write scope; the list it is created on must be on a board the token can write to.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcreateCard
Rate limitStandard limits apply

Needs the write scope; moving a card between lists is an update to its idList.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventupdateCard
Rate limitStandard limits apply

Needs the write scope; the deletion is irreversible, unlike archiving.

Acts oncard
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventdeleteCard
Rate limitStandard limits apply

Needs the write scope; the comment is attributed to the member behind the token.

Acts onaction
Permission (capability)write
VersionAvailable since the API’s base version
Webhook eventcommentCard
Rate limitStandard limits apply

Members

Methods for reading and updating members, the people in Trello.4

Needs the read scope; member endpoints are limited to 100 requests per 900 seconds.

Acts onmember
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit100 requests / 900s on /1/members/

Needs the read scope; reading the member's email also requires the account scope.

Acts onmember
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit100 requests / 900s on /1/members/

Needs the read scope; member endpoints are limited to 100 requests per 900 seconds.

Acts onboard
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit100 requests / 900s on /1/members/

Writing member info needs the account scope, which also covers reading a member's email and marking notifications read.

Acts onmember
Permission (capability)account
VersionAvailable since the API’s base version
Webhook eventNone
Rate limit100 requests / 900s on /1/members/

Webhooks

Methods for registering and managing webhooks that watch a model for changes.4

The webhook belongs to the token and can only watch models that token can access; the read scope is enough to receive change notifications.

Acts onwebhook
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the read scope; the webhook must belong to the token used.

Acts onwebhook
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The webhook must belong to the token used, or the call returns a 'webhook does not belong to token' error.

Acts onwebhook
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The webhook must belong to the token used; webhooks are also removed automatically when their token expires.

Acts onwebhook
Permission (capability)read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Trello can notify an app or AI agent when a watched object changes, like a card being moved or a comment being added, instead of the app polling for changes. A webhook is attached to a token and a single model id, and Trello POSTs the action and the updated model to a registered callback URL.

EventWhat it signalsTriggered by
createCardA card was created on a board or list the webhook watches./1/cards
updateCardA card changed, like its name, description, due date, or the list it sits on. Moving a card fires this event./1/cards/{id}
deleteCardA card was permanently deleted./1/cards/{id}
commentCardA comment was added to a card./1/cards/{id}/actions/comments
createListA list was created on a board the webhook watches./1/lists
updateListA list changed, like its name, position, or open/closed state./1/lists/{id}
/1/lists/{id}/closed
createBoardA board was created./1/boards/
updateBoardA board changed, like its name, description, or open/closed state./1/boards/{id}
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Trello limits how fast an app or AI agent can call, by a per-key rate and a separate per-token rate measured over a ten-second window, with a tighter limit on member endpoints.

Request rate

Trello meters requests two ways at once: 300 requests per 10 seconds for each API key, and 100 requests per 10 seconds for each token. The /1/members/ endpoints carry a tighter limit of 100 requests per 900 seconds. Going over returns HTTP 429 with an error of API_KEY_LIMIT_EXCEEDED or API_TOKEN_LIMIT_EXCEEDED, and if a single key accumulates more than 200 of these 429s, Trello returns 429 for the rest of that key's requests. Every response carries x-rate-limit headers giving the interval, the max, and the remaining count for both the key and the token, so an integration can pace itself.

Pagination

Most list endpoints return the full set for the parent object rather than a numbered page, and a limit parameter caps how many items come back (for example up to 1000 actions on a board). Time-ordered endpoints like actions accept before and since parameters that take an id or date to walk through history. Requesting too much at once, such as all cards with their actions, can return API_TOO_MANY_CARDS_REQUESTED.

Request size

A token's webhook is removed when the token expires, and a webhook that fails to deliver for 30 days is disabled. A token's expiry is set at authorization to 1hour, 1day, 30days, or never. The fields parameter trims a response to named fields, with the object id always returned.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe request was malformed, like a missing required parameter or an invalid value.Read the error message, fix the parameters, and resend. The request is not retryable as-is.
401UnauthorizedThe API key or token is missing, invalid, or expired, or the token lacks the scope the request needs.Confirm both the key and a current token are sent, and that the token carries the read, write, or account scope the call requires.
404Not FoundThe object does not exist, or is not visible to the member behind the token.Verify the id and confirm the token's member has access to it.
429API_KEY_LIMIT_EXCEEDED / API_TOKEN_LIMIT_EXCEEDEDThe per-key (300 per 10s) or per-token (100 per 10s) rate was exceeded; a sustained excess of 429s on a key returns 429 for the rest of that key's requests.Back off and retry, reading the x-rate-limit headers to pace requests, and smooth bursts across the ten-second window.
Versioning & freshness

Version history.

Trello's REST API carries a single path version, 1, and ships dated changes through its developer changelog rather than minting new version numbers.

Version history

What changed, and when

Latest version1
1Current version
REST API v1 (current, unversioned beyond the path)

Trello's REST API is served under https://api.trello.com/1 and carries no version numbers beyond the path 1. Changes ship through the developer changelog rather than new version strings, so the entries below are the notable recent dated changes.

What changed
  • Single path version 1; responses are JSON and fields can be trimmed with the fields parameter.
  • Authentication is an API key plus a user token with read, write, and account scopes.
2026-02-20Feature update
New security requirements for Cloud apps

Atlassian published new security requirements for Government Cloud apps effective 31 March 2026, plus annual updates to its Cloud App Security Requirements covering AI security, data protection, and runtime security.

2025-09-15Requires migration
SCIM v2 endpoints deprecated

The SCIM endpoints /scim/v2/users and /scim/v2/groups were announced for deprecation on or after 10 December 2025, in favour of the REST API for Trello members and related queries.

2025-04-16Feature update
OAuth 2.0 (3LO) announced

Trello announced that OAuth 2.0 will replace its current authorization mechanism, introducing new scopes, resource restrictions, and token expiry, with external OAuth2 clients using Forge's OAuth2 Providers as confidential clients.

2025-02-17Requires migration
PUT board/:id/labelNames deprecated

The PUT /1/boards/{id}/labelNames endpoint was announced for deprecation in six months (around 18 August 2025), with developers directed to the label creation and update endpoints instead.

There is one live version of the REST API; track the changelog for deprecations.

Trello developer changelog ↗
Questions

Trello API, answered.

What is the difference between an API key and a token?+
The API key identifies the application and is tied to a Power-Up; it is acceptable for it to be public. The token represents one Trello user and grants access to that user's whole account, so it must be stored securely and revoked if exposed. A call sends both, as key and token parameters or in an OAuth Authorization header.
What scopes can a token have?+
Three: read covers reading boards, organizations, and the like on behalf of the user; write covers writing them; and account covers reading a member's email, writing member info, and marking notifications read. A token is granted only the scopes the application requested and the user approved, and it still only reaches what that user can already see.
What are the rate limits?+
Trello applies two limits at once: 300 requests per 10 seconds for each API key, and 100 requests per 10 seconds for each token. The /1/members/ endpoints are limited to 100 requests per 900 seconds. Exceeding a limit returns HTTP 429, and every response includes x-rate-limit headers showing the interval, the max, and the remaining count so a client can pace itself.
How do Trello webhooks work?+
A webhook is created against a token and a single model id with a callback URL, and Trello POSTs a JSON payload (the action, the updated model, and the webhook) whenever that model changes. Each delivery carries an X-Trello-Webhook header, a base64 HMAC-SHA1 digest of the body plus the callback URL, so a receiver can verify it came from Trello. A webhook is removed when its token expires and is disabled after 30 days of failed deliveries.
How do I verify a webhook came from Trello?+
Each request carries an X-Trello-Webhook header containing a base64 digest of an HMAC-SHA1 hash. The receiver hashes the concatenation of the full request body and the callback URL exactly as provided at creation, using its API secret, and compares the result to the header. A mismatch is rejected to prevent spoofing.
Is the Trello API versioned?+
The REST API uses a single path version, 1, and Trello does not publish new numbered versions. Changes, deprecations, and the planned OAuth 2.0 migration are announced through the developer changelog, so an integration should follow the changelog rather than pin a version.
Related

More productivity API guides for agents

What is Bollard AI?

Control what every AI agent can do in Trello.

Bollard AI sits between a team's AI agents and Trello. Grant each agent exactly the access it needs, read or write, board by board, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Trello token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Trello
Board Agent
Read cards ResourceOffReadFull use
Move and update cards ActionOffReadFull use
Delete boards ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Trello