# API Overview

> Query and mutate Done Bear resources over the GraphQL API.

The Done Bear API uses GraphQL for all queries and mutations. Send authenticated requests to the GraphQL endpoint to manage workspaces, tasks, projects, teams, labels, and API keys.

## Base URL

All API requests go to:

```bash
curl https://api.donebear.com/graphql \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  --data '{"query":"query { viewer { id email } }"}'
```

## Authentication

Send bearer credentials in the `Authorization` header. The API accepts:

- Done Bear API keys that start with `db_`
- Supabase JWTs

Example:

```bash
curl https://api.donebear.com/graphql \
  -H "Authorization: Bearer <token-or-api-key>" \
  -H "Content-Type: application/json" \
  --data '{"query":"query { myWorkspaces { id name } }"}'
```

## Machine-readable catalog

The OpenAPI 3.1 specification is published at:

- [https://donebear.com/openapi.json](https://donebear.com/openapi.json)
- [https://donebear.com/api/openapi.yaml](https://donebear.com/api/openapi.yaml)
- [https://api.donebear.com/openapi.json](https://api.donebear.com/openapi.json)

It lists unique `operationId`s, typed request and response schemas, and the `read`, `write`, and `admin` security scopes.

## Next steps

- Follow [Authenticate API requests](/api/authentication) to set up credentials.
- Read [API scopes](/api/scopes) before creating a key for an agent.
- Use [GraphQL reference](/api/graphql) for the full list of queries and mutations.
- Set up [webhooks](/api/webhooks) to receive a signed POST when a task, project, or comment changes.
- Read [API versioning](/api/versioning) for the `Api-Version` header, `@deprecated`, and sunset rules.
- See [Done Bear developer resources](https://donebear.com/developers) for the full catalog.

---

Every Done Bear page is listed at https://donebear.com/llms.txt. Any page has a markdown copy at its URL plus `.md`. Start from the map rather than guessing a path.