Connect · Developers

A checklist API for your systems and your AI assistants.

Start checklists from your own software, complete tasks, build templates in code and keep Data Sets in sync. Webhooks tell you the moment something happens, and the MCP server gives an AI assistant the same reach.

Start free trial Open the API reference

14-day free trialAPI and webhooks on every planOpenAPI 3 document

REST API v3POST /v3/checklists

Request

curl https://api.checkflow.io/v3/checklists \
  -H "X-API-KEY: $CHECKFLOW_API_KEY" \
  -H "Idempotency-Key: 7c9e2a41-5d3b-4f86-9a0e-1b2c3d4e5f60" \
  -H "Content-Type: application/json" \
  -d '{
    "templateKey": "3f2b8c1e-7a4d-4e5b-9c61-2d8f0a7b6e14",
    "name": "Employee Onboarding – Sam Lee",
    "parameters": [{ "key": "Start date", "value": "2026-10-12" }]
  }'

201 Created (shortened)

{
  "key": "9d4e2b7a-1c3f-4a8e-b5d6-7e0f2a9c3b18",
  "name": "Employee Onboarding – Sam Lee",
  "status": "InProgress",
  "allTasksComplete": false,
  "tasks": [
    { "key": "1f8b3d6e-…", "name": "Create Active Directory account",
      "status": "Incomplete", "isCurrentlyHalted": false }
  ]
}

In short

Last updated October 2026

CheckFlow has a JSON REST API, version 3, for everything a workspace does: checklists and their tasks, standalone tasks, templates, Data Sets, schedules and webhooks. Each API key acts as one member, so it sees only what they can. Nine webhook events push changes to you, and an MCP server lets AI assistants use the same operations. It is for developers connecting CheckFlow to their own systems.

Processes that start, finish and report in your own systems.

Start the right checklist automatically

A new hire in the HR system or a signed deal in the CRM creates the checklist through the API, with its parameters filled in.

Hear about it as it happens

Webhooks post a completed task, a new comment or a changed Data Set record to your endpoint, so nothing needs to poll.

Never more access than a person

A key acts as one member of your team and is refused wherever that member would be, in the API and over MCP alike.

REST API v3

One API key, one set of conventions

Send requests to https://api.checkflow.io, or to https://api-eu.checkflow.io for a workspace in the EU region. Every path starts with /v3/, and an X-API-KEY header is the only authentication: no version header, no OAuth. Administrators create keys on the API & Integrations tab of Team Management, and GET /v3/auth/test tells you which key you hold and who it acts as.

Each key acts as one member of the workspace, or as the workspace itself, chosen when it is created. Reads are filtered to what that member may see and writes are refused where they could not make them. Give each integration its own key so you can revoke one without touching the others.

JSON with camelCase names; every timestamp is UTC and ends in Z
Cursor pagination with pageSize, after and sort; Idempotency-Key makes a write safe to retry
One error body everywhere: code, message, requestId and, where relevant, field
A budget of 1,000 requests an hour per workspace, plus 10,000 for cheap calls such as schema reads

API v3 overview (docs)

Every error429 Too Many Requests

Headers

HTTP/1.1 429 Too Many Requests
Retry-After: 1260
X-RateLimit-Bucket: standard
X-RateLimit-Remaining: 0
X-Request-Id: req_2e9d4a7c1b3f48e0a6c5d8b1f7e2a094

Body

{
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Retry in 1260 seconds.",
    "requestId": "req_2e9d4a7c1b3f48e0a6c5d8b1f7e2a094",
    "retryAfterSeconds": 1260
  }
}

Quote the requestId to support and they can find the exact request.

Coverage

What the API covers

The OpenAPI document lists 96 paths. There is a route for nearly everything the app does, and the Swagger UI lets you try each one against your own workspace once you enter a key.

Checklists
Create from a template with parameters, list, search by field values, complete, archive, share and tag. Read the activity feed of any checklist you can see.
Checklist tasks and fields
Complete or uncomplete, mark not applicable, assign, set due dates, snooze, comment, answer fields, upload files and edit table rows. Halts and required fields are enforced, as in the app.
Standalone tasks and the Tasks Grid
Raise tasks outside any checklist with sub-tasks, comments and files, read the acting member’s Tasks Grid, and manage saved views and snoozes.
Templates and drafts
Create, copy, version and archive templates from a JSON document, validate one without publishing, build large ones as drafts, and move running checklists onto a new version.
Data Sets
Data Sets, fields, records and views, bulk record changes, and CSV import and export, so a reference list stays in step with the system that owns it.
Schedules
Create the schedules that start recurring checklists, list their runs and create a scheduled run’s checklist straight away.
Webhooks
Subscribe, update and delete subscriptions, read the delivery history, replay a delivery and rotate the signing secret.
Workspace
Members, groups and tags, plus the schema routes and the template authoring guide that tell you what a template document may contain.

The API and webhooks are included in the Business plan at $10 per user per month, or $9 billed annually, and in the free trial.

Webhooks

Webhooks: signed, retried and replayable

Subscribe a URL to an event and CheckFlow posts JSON to it when the event happens. There are nine: new_checklist, checklist_completed, task_completed, task_assigned, comment_created, file_uploaded and data_set.record.created, .updated and .deleted. Narrow most of them to one template, one task or one upload field with a scope.

The signing secret comes back once, when you subscribe. Every delivery carries CF-Signature, an HMAC-SHA256 of the timestamp and the raw body, so you can prove it came from CheckFlow. A failed delivery is tried again, five attempts in all over a few hours, and each delivery is kept, so you can see what was sent and what came back, then replay it once your endpoint is up again.

Rotate a secret at any time: the old one keeps signing for 24 hours
CF-Delivery-Id is the same on every retry and replay, so you can deduplicate
A subscription that misses ten deliveries in a row is switched off, and says why

Webhook events (docs)

WebhooksPOST /v3/webhooks

{
  "eventType": "task_completed",
  "targetUrl": "https://hooks.yourcompany.com/checkflow",
  "source": "custom",
  "scope": {
    "type": "Template",
    "key": "3f2b8c1e-7a4d-4e5b-9c61-2d8f0a7b6e14"
  }
}

Each delivery

POST /checkflow
CF-Event: task_completed
CF-Delivery-Id: 5b1e0c7a-…
CF-Signature: t=1790503200,v1=9f2c…

Hash the exact bytes "{t}.{body}" with your secret and compare in constant time.

MCP server

The MCP server: the API, for AI assistants

The CheckFlow MCP server carries the same operations as 147 tools, so Claude, ChatGPT, Gemini, Grok, Copilot or any other AI assistant can start checklists, work tasks, fill in fields, build templates and update Data Sets when you ask in plain language. It answers at https://api.checkflow.io/mcp (and api-eu for the EU) over Streamable HTTP, and it is stateless: no session to keep alive.

It authenticates with the same X-API-KEY header, so the assistant acts as the key’s member and sees only what they can. Every tool is labelled read-only, writing or destructive, so a client can ask before it deletes anything, and writes take an idempotency key. The docs give step-by-step setup for Claude Code, Claude Desktop, Cursor and VS Code; any client that can send a custom header works, and one that only speaks OAuth can connect through the mcp-remote bridge.

Tool families: checklists, checklist tasks, standalone tasks, workspace and Tasks Grid, template authoring, Data Sets, schedules and webhooks
Administrators can switch off AI assistant connections for the whole team in one place
MCP calls share the workspace’s hourly request budget with the REST API

Read the MCP guide

Connect a clienthttps://api.checkflow.io/mcp

Claude Code

claude mcp add --transport http checkflow https://api.checkflow.io/mcp \
  --header "X-API-KEY: your-api-key-here"

VS Code · .vscode/mcp.json

{
  "servers": {
    "checkflow": {
      "type": "http",
      "url": "https://api.checkflow.io/mcp",
      "headers": { "X-API-KEY": "${input:checkflow-api-key}" }
    }
  }
}

VS Code prompts for the key once and stores it securely, rather than in the file.

Versions

API v3 and the legacy v1 and v2 API

The older API at app.checkflow.io/api still works, and existing integrations, including the Zapier app, keep running on it. New integrations should use v3, and the migration guide maps every legacy endpoint to its v3 equivalent.

How API v3 compares with the legacy v1 and v2 API
What	API v3	Legacy v1 and v2
Address	api.checkflow.io/v3 (and api-eu)	app.checkflow.io/api
Version	In the path	X-API-VERSION header
Conventions	One error body, cursor pagination, Idempotency-Key	The original v1 and v2 shapes
Webhook events	Nine, with delivery history, replay and rotation	Six
MCP server	Yes, the same operations	No

Migrating is optional and can happen one integration at a time. Both versions use the same API keys.

Getting started

Your first integration in five steps

01
Create a key
An Administrator creates one on the API & Integrations tab, named for the integration, and chooses who it acts as. Store it as a secret, never in a shared file.
02
Check it
Call GET /v3/auth/test. The answer names the key, the member it acts as and your workspace’s region, so you know which address to use.
03
Find the template
List templates with GET /v3/templates and keep the key of the one to run. Template keys stay the same across versions.
04
Start a checklist
Post the template key, a name and any parameter values to /v3/checklists with an Idempotency-Key, so a retry after a timeout returns the same checklist.
05
Listen for the result
Subscribe to checklist_completed for that template, store the signing secret, and update your own system when the delivery arrives.

Prefer not to write code? The Zapier app does much of this with clicks. See integrations.

An API designed for agents as well as people.

The same conventions that make retries safe for your code make them safe for an AI agent: one error format, stable keys and idempotent writes.

Connect an assistant in minutes
Claude, ChatGPT, Gemini, Grok, Copilot or any other AI assistant can work in CheckFlow through the MCP server, with the permissions of the API key it holds.
AI in CheckFlow
Draft the template first
Describe the process and the free AI checklist generator drafts the template your integration will start.
Try the AI generator
A guide written for models
GET /v3/schema/guide is the template authoring guide, in prose, served to code and to MCP clients alike.
Template documents (docs)

AI assistantcheckflow MCP · connectedIllustrative example

Our endpoint was down for an hour this morning. Replay the task_completed deliveries that failed.

checkflow · replay_webhook_deliverydone

webhook:  "task_completed · Employee Onboarding"
delivery: "5b1e0c7a-…"

→ outcome Delivered · statusCode 200 · 412 ms

I found three failed deliveries in the history and replayed each one. All three were accepted this time. Each kept its original CF-Delivery-Id, so your endpoint can spot any it already processed.

Templates teams often start by API.

Each can be created by your own system the moment its trigger happens.

Information TechnologyLive demo

IT Service Request Fulfilment Checklist

6 phases · 31 tasks

Information TechnologyLive demo

IT Incident Management Process Checklist

6 phases · 30 tasks

Operations & Facilities ManagementLive demo

Vendor Onboarding Process Checklist

7 phases · 35 tasks

Browse all templates

Developer guides

Checklist API questions

How do I get a CheckFlow API key?

An Administrator creates keys on the API & Integrations tab of Team Management; Members and Guests cannot. When creating a key they choose who it acts as: an Administrator, a Member or the workspace itself. Send it in the X-API-KEY header on every request, and call GET /v3/auth/test to check it. The same key connects the MCP server.

Is there a REST API for checklists?

Yes. REST API v3 creates checklists from templates, completes and assigns their tasks, answers fields, uploads files, and covers standalone tasks, templates and drafts, Data Sets, schedules and webhooks. It is documented in an OpenAPI 3 document and a Swagger UI that needs no key to read.

Which webhook events can I subscribe to?

Nine: new_checklist, checklist_completed, task_completed, task_assigned, comment_created, file_uploaded, and data_set.record.created, updated and deleted. A subscription can be narrowed to a template, a task or an upload field, depending on the event. Deliveries are signed with CF-Signature, retried if they fail, kept in a delivery history and can be replayed.

What happens to API v2?

Nothing. The v1 and v2 API stays at app.checkflow.io/api and existing integrations, including the Zapier app, keep working. v3 is a separate surface with its own address; move to it when it suits you, using the migration guide in the docs.

Are there rate limits?

Yes. Each workspace has 1,000 standard requests an hour and 10,000 cheap ones, such as schema reads and validation, shared by all its keys and its MCP connections. Every response reports the budget in X-RateLimit-* headers, and a request over it gets 429 with a Retry-After header.

Can I keep a Data Set in sync with another system?

Yes. The API creates, updates and deletes Data Set records, in bulk if needed, and imports or exports CSV. The three data_set.record webhook events tell your system when someone changes a record in CheckFlow, so linked drop-downs in your checklists always show the current list.

What is the CheckFlow MCP server?

An MCP (Model Context Protocol) server with 147 tools that let Claude, ChatGPT, Gemini, Grok, Copilot or any other AI assistant work in your workspace: start checklists, complete tasks, fill in fields, build templates and manage Data Sets. It uses your API key and acts as whoever the key represents. Setup guides cover Claude Code, Claude Desktop, Cursor and VS Code. Read the MCP guide.

Which plans include the API?

The REST API, webhooks and the MCP server are included on every plan, starting with Business at $10 per user per month, or $9 billed annually, and in the free trial. Enterprise customers can also have a dedicated database with direct read-only access. See pricing.

Build your first integration today.

Start a free trial, create an API key and start a checklist from your own code in minutes.

Start free trial Book a demo

14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting

A checklist API for your systems and your AI assistants.

Processes that start, finish and report in your own systems.

Start the right checklist automatically

Hear about it as it happens

Never more access than a person

One API key, one set of conventions

What the API covers

Checklists

Checklist tasks and fields

Standalone tasks and the Tasks Grid

Templates and drafts

Data Sets

Schedules

Webhooks

Workspace

Webhooks: signed, retried and replayable

The MCP server: the API, for AI assistants

API v3 and the legacy v1 and v2 API

Your first integration in five steps

Create a key

Check it

Find the template

Start a checklist

Listen for the result