Endpoint reference

Who the key acts as: principalId, organizationId, kind (integration for a key, person for someone signed in) and systemAdmin. Make this call when you set up a connection.

curl https://api.checklistsquad.com/api/me -H "Authorization: Bearer $CSQ_KEY"

The organization the key belongs to, with what the caller may manage there: canManageMembers, canManageSquads, canCreateTemplates, canManageSettings, canManageIntegrations, and the setting membersCanAddTemplates.

Rename the organization or turn "Members can add templates" on or off: { "name": "Acme Property", "membersCanAddTemplates": false }. Admins only; no key may.

Sign everyone in the organization out of every device. Admins only; no key may. API keys are not sessions: revoke a key on its own.

Where single sign-on stands: the connection and its provider, the domains and the TXT record each needs, the values to give the identity provider, the policy, and what may happen next.

Choose the identity provider: { "provider": "okta" } (microsoft-entra, okta, google-workspace or generic-saml).

Add a domain to verify: { "domain": "acmeproperty.com" }. The answer names the TXT record to publish.

Look for the domain's TXT record now.

Remove a domain.

Check the identity provider's SAML metadata without saving it: { "metadataXml": "…" } or { "metadataUrl": "https://…" }.

Save the identity provider's metadata, as above.

{ "requireSsoForExistingMembers": true, "allowJitProvisioning": true }: whether members must sign in through the provider, and whether new people at a verified domain join on first sign-in.

Start a test sign-in through the provider; the answer carries the address to open.

Record how the test sign-in ended.

Turn single sign-on on, once a domain is verified and a test has passed.

Turn single sign-on off; people sign in with email codes again.

The organization's library and the public templates. Each has id, title, summary, category, isPublic, key (a public template's name, such as guest-room-turnover-checklist), version and its definition: sections, their steps, and each step's fields. Filters: organizationId, library=true (the library only), public=true. To browse the public templates, search them or read them by category, use the directory.

curl "https://api.checklistsquad.com/api/templates?public=true" -H "Authorization: Bearer $CSQ_KEY"

Add a template to the library, one of three ways: a copy (sourceTemplateId), a checklist's shape (sourceChecklistId), or a definition of your own. Always send id (a UUID) and title. Answers 201 with the template; 409 when the id exists. Full keys may.

curl https://api.checklistsquad.com/api/templates -H "Authorization: Bearer $CSQ_KEY" -H "Content-Type: application/json" \
  -d '{ "id": "a1f2…", "title": "Room turnover, ours", "sourceTemplateId": "3b0e…" }'

Replace a library template's title, summary, category and definition. The version goes up by one. Public templates cannot be edited. Running checklists keep the shape they started with.

A page of public templates, A to Z by title: id, key, title, summary, category, categoryName, kind, sections, steps, image and updatedAt. Filters: category (A to Z within it) and q, which matches templates holding every word of it in their title, summary or steps. 24 to a page unless pageSize says otherwise; there is no total.

curl "https://api.checklistsquad.com/api/catalog/templates?category=hospitality&q=minibar"

One public template whole by its key: its definition, version, category and its page's words (listing). 404 for any other key.

The categories, A to Z by name, or with featured=true the ones the directory features, in their order: key, name, shortName, description, icon, image, featured.

One category by its key; 404 when there is none.

The checklists in the organization: id, title, status (inProgress, completed), templateId, templateVersion, creatorPrincipalId, createdAt, dueAt, completedAt, and whether the caller may assign (canAssign) or edit (canEdit) each. Filter: id.

curl "https://api.checklistsquad.com/api/checklists?id=5f0d3c1a-…" -H "Authorization: Bearer $CSQ_KEY"

Start a checklist. From a template, send templateId and title, and optionally id and dueAt; the server makes the sections and steps. From nothing, send id, title and the rows: sections (id, key, title, position) and items (id, key, title, sectionId, position, fields). Answers 201; 409 when the id exists. The key and the admin who made it own the checklist. Start and Full keys may.

curl https://api.checklistsquad.com/api/checklists -H "Authorization: Bearer $CSQ_KEY" -H "Content-Type: application/json" \
  -d '{ "templateId": "3b0e…", "title": "Room 12, Friday" }'

Finish it, { "status": "completed" }, or rename it, { "title": "…" } (which needs CHECKLIST_EDIT). Finishing works at any point; open and blocked steps stay as they are.

Sections: id, checklistId, key, title, position. Filter: checklistId.

Add a section to a running checklist: id, checklistId, key, title, position.

Rename or move a section: { "title": "…", "position": 2 }. A field left out stays as it is.

Remove a section. Its steps move to the checklist itself. 404 when it is already gone.

Steps: id, checklistId, sectionId, key, title, instructions, position, fields (key, type, label, required, unit), status (open, done, blocked, skipped), statusReason, answers by field key, doneAt, doneByPrincipalId. Filter: checklistId.

curl "https://api.checklistsquad.com/api/items?checklistId=5f0d3c1a-…" -H "Authorization: Bearer $CSQ_KEY"

Add a step: id, checklistId, sectionId (or null for the checklist itself, which needs CHECKLIST_EDIT), key, title, instructions, fields, position.

Tick, answer, block or skip a step: { "status": "done", "answers": { "meter-reading": "4821" } }. blocked and skipped need statusReason; done needs every required field. Changing its title, instructions, fields, sectionId or position needs ITEM_EDIT.

curl -X PUT https://api.checklistsquad.com/api/items/9a2c… -H "Authorization: Bearer $CSQ_KEY" -H "Content-Type: application/json" \
  -d '{ "status": "blocked", "statusReason": "No clean towels in the store room" }'

Remove a step that is still open. A done, blocked or skipped step is evidence and stays.

The proof on the checklists the key may see: id, checklistId, itemId, fieldKey, kind (photo, signature), contentType, status (pending until uploaded), who added it, when it was captured, and for an uploaded one a url good for a day.

Record a photo or a signature on a step: id (a UUID), checklistId, itemId, fieldKey, kind, contentType, byteLength, width, height, capturedAt. Answers 201 with the row; 409 when the id exists.

Where to PUT the bytes: a url that works for a short while, and the headers the PUT must carry.

Say the bytes are in. The row becomes uploaded.

Remove a photo or signature from a step that is still open.

Who holds each part: one row per assigned checklist, section or step, with nodeType, nodeId, principalId (a person, a squad, or everyone in the organization), displayName, and pending while an invited person has not joined. Filter: checklistId.

Give a checklist, section or step to someone: id (the node, checklist::{id}, section::{id} or item::{id}), checklistId, nodeType, nodeId, and principalId from /api/people or /api/squads. Sections need SECTION_ASSIGN, steps ITEM_ASSIGN. Sending it again with someone else replaces the assignee.

Clear a part's assignee, so it falls back to whoever holds the part above it. The id is the node, as above.

The organization's recurring checklists: title, rule (frequency, interval, days, dayOfMonth), readyTime, dueTime, timeZoneId, startsOn, endsOn, status (active, paused), pausedReason, pausedNode, generatedThrough, lastError, and whether the caller may manage each (canManage).

Set one up: id, title, templateId, the rows (sections, items), rule, readyTime, dueTime, timeZoneId, startsOn, endsOn, and assignments (one line per part: nodeType, nodeId, principalId or invitationId). Answers 201 with the schedule, its plan granted and its first day made; 409 when the id exists.

Its whole editable state: title, rule, readyTime, dueTime, timeZoneId, startsOn, endsOn and status. A moved rhythm makes the next day again; paused takes a day not yet open back, active resumes from today.

The schedules' sections: scheduleId, key, title, position.

The schedules' steps: scheduleId, sectionId, key, title, instructions, fields, position.

Who does each part every time, one row per schedule node with its own assignee or pending invitee: scheduleId, nodeType, nodeId, principalId, invitationId, displayName, pending.

Assign a part from the next day on: scheduleId, nodeType, nodeId, and principalId or invitationId. A section needs SCHEDULE_SECTION_ASSIGN, a step SCHEDULE_ITEM_ASSIGN. The day already made and not yet open changes with it.

Clear a part's own assignee, so it follows the part above. 404 when it has none.

The days taken out of each schedule: scheduleId, date.

Take a day out: id, scheduleId, date. A day already open, or one the rhythm doesn't fall on, is refused with 400.

Put a day back. 404 when it is not skipped.

System administrators only: the scheduler's last run, how many schedules are active and paused, and the latest day it could not make.

What happened, oldest first: kind (checklist.started, item.done, item.blocked, assigned, checklist.finished, …), the part it happened to, actorPrincipalId and actorName (a person or an integration), at, and via when a person acted through an AI assistant. Filter: checklistId.

curl "https://api.checklistsquad.com/api/activity?checklistId=5f0d3c1a-…" -H "Authorization: Bearer $CSQ_KEY"

The organization's members (kind: "person", with displayName, email, isAdmin) and its integrations by name (kind: "integration"). Only people can be assigned.

The organization's squads: id, subjectId (what you assign to), name, description.

Form a squad. Admins only; no key may.

Who is in each squad: squadId, principalId.

Put a member in a squad. Admins only.

Take a member out of a squad. Admins only.

Pending invitations. Empty for a key.

Invite someone by email. Admins only; no key may.

Revoke a pending invitation. Admins only.

The caller's own email settings, as a one-row page: emailAssigned, emailBlocked, emailFinished, emailDueSoon.

Replace the caller's email settings with the four switches above.

The organization's keys: name, role, keyHint, createdAt, lastUsedAt, expiresAt, revokedAt, rollingUntil. Never a key itself.

Make a key: id (twelve letters and digits), name, role (read, start or full), expiresAt. Answers 201 with the integration and the key, once.

Rename a key or change its role: { "name": "…", "role": "read" }.

A new key, shown once; the old one keeps working for overlapHours (24 by default, 168 at most).

Revoke a key. It stops at once.