Improbable for developers
An Improbable board is a workspace's plan for one cycle: its objectives, their key results, the teams that own them and how far along each one is. This is how a system outside the product reads that plan.
There are three doors, and they are the same board behind all three.
| Door | Who opens it | What it needs |
|---|---|---|
| The HTTP API | A scheduler, a warehouse job, a dashboard | An API key |
| The MCP server | An AI assistant | The same API key, or a sign-in |
| An embed link | Anyone with the link | Nothing |
It is read-only
There is no write. No endpoint on this API creates, edits or deletes anything,
and there is no scope, plan or key that turns one on. The route file that
mounts the API exports GET and nothing else — that is where read-only is
said, because there is no column in the database that could say it instead.
If you need to get data into a board, that is not this API, and documenting a write surface that does not exist would be worse than saying so.
It discloses exactly what a public embed link discloses
This is the rule the whole payload is built around, and it runs one way: a document may publish less than an embed link shows, never more.
So a key opens a board and it does not open the roster behind it. The people in the payload carry a name, a job title, a photo and a colour, because those are drawn on the board. They do not carry email addresses, employment records, salary bands, managers, countries, phone numbers or anything a person wrote about themselves in their own profile. Objectives do not carry their position on the canvas. Key results do not carry the metric definition behind them.
If you would not be comfortable putting a board on a public URL, a key to that board is not safer — it is the same payload with a credential in front of it.
The two reads
GET https://app.improbable.work/api/v1/cycles
What the workspace has planned, so a caller can name a cycle. See List cycles.
GET https://app.improbable.work/api/v1/cycles/2026-C03/board
One cycle's board, as JSON. See Read a board.
The document has 7 top-level fields —
cycle, generatedAt, teams, objectives, people, features, departments — and every door hands back the same one.
Everything else in one paragraph
Send your key as an Authorization: Bearer header; see
Authentication. A key is a system's, minted by an admin: it
opens the HTTP API, and the MCP server at /api/mcp only until
14 January 2027 — a person connecting an assistant signs in instead. The ceiling is 60 requests a
minute per key, and every way of failing to authorize the HTTP API answers
with the same 401; see Rate limits and errors. Responses carry
Cache-Control: private, no-store and no Access-Control-Allow-Origin at all,
which means a browser cannot call this API — a caller here is a server.
Where the addresses are
The URLs on this page are written against https://app.improbable.work. Your own are printed,
with your own cycle id already in them, in Workspace settings → API — and
in the Export dialog, which is where most people mint their first key. The
product prints them rather than linking here because only the product knows the
host it is served from and which cycle you are looking at.