How to Use Ninety's Public API
Ninety's Public API provides programmatic access to core resources including To-Dos, Issues, Rocks, Milestones, the Scorecard, Headlines, Meetings, your Vision, the Org Chart, Quarterly and Annual Reviews, users, and Teams. Authentication uses a Personal Access Token (PAT) generated in User Settings, with all calls executing under your user identity and respecting your in-app permissions.
Video overview
API documentation
Refer to the interactive API documentation for full endpoint signatures and example requests.
What you can build with the API
Common use cases include:
Push Scorecard values automatically from BI tools or data warehouses on a recurring schedule, up to 100 scores per call.
Capture leadership-attention items by auto-creating Issues from ticketing or monitoring tools.
Bulk-create Rocks during quarterly planning from strategy documents.
Build custom client tooling as a Coach with dashboards and intake flows.
Embed Ninety into your own product as a partner with programmatic read/write access.
What the API includes
The v1 API covers these resources:
Ninety Resource | What you can do |
To-Dos | Create (personal or team), query (with or without paging), get by ID, update, delete, comment, link to a Rock, Issue, or Milestone |
Issues | Create, query, get by ID, update, delete, comment, link to a To-Do, Rock, or Milestone |
Rocks | Create, query (with filters and optional paging), get by ID, update, soft delete, list a Rock's Milestones, link to a To-Do, Issue, or Milestone |
Milestones | Create (linked to a Rock), get by ID, update |
Scorecard | Read a team's Scorecard or one KPI's score for a period, query KPIs, create/update/delete scores and notes, write up to 100 scores in one call |
Headlines | List a team's Headlines (including discussed, archived, and Cascading Messages), create a Headline or Cascading Message |
Meetings | Get a team's next meeting with its agenda and attendees, list a team's past meetings, get one past meeting with its notes and the items it worked |
Vision | Read a team's Vision alongside the leadership team's: Core Values, Purpose, and Niche from the Vision page, and the 1-year and 3-year goals from the Strategy page |
Org Chart | Read the company's Org Chart: every Seat, what it's accountable for, and who holds it |
Quarterly and Annual Reviews | List the company's Quarterly or Annual Reviews: who reviews whom, due dates, and completion, never the answers (Owners and Admins only, and only if your plan includes Quarterly Reviews) |
Users | List your company's users (by email, or including inactive users), get a user by ID, list a team's users |
Teams | List your teams, or every team you can create or query work on |
Company-wide lists | Owners and Admins can list every To-Do, Issue, Rock, Milestone, KPI, KPI group, Headline, and past meeting in the company, plus every Seat and Seat holder on every Org Chart, including personal and shared charts |
In API payloads, KPIs are referenced as kpis, and their values are referenced as scores.
Who can use the API
Plan requirements:
Available on the Thrive subscription plan and the Legacy plan (Legacy Monthly and Legacy Annual). The Legacy plan is equivalent to Thrive in all features, including API access.
Accelerate, Essentials, and Free plans do not include API access.
Role requirements:
Owners, Admins, Coaches, Managers, and Team Members can generate tokens.
Observers cannot generate tokens.
The API enforces the same permissions you have within the Ninety app. Each user generates and manages their own tokens independently.
Rate limits
Rate limits apply per user and reset every second:
Subscription tier | Rate limit |
Essentials | API access not available |
Accelerate | API access not available |
Thrive and Legacy | 25 requests per second |
Requests exceeding your rate limit receive a 429 Too Many Requests response. Back off for at least one second and retry. For sustained high-volume workloads, consider upgrading your subscription tier.
How to generate a Personal Access Token
Click your name from the bottom of the left navigation.
Click User Settings.
Click Developer Settings.
Click Generate New Token in the top right.
Choose a Token Expiration Timeframe (default: 90 days).
Enter a Token Description (50-character limit) identifying the token's purpose.
Click Generate Token.
Copy and store the token securely immediately.
Warning: Treat your Personal Access Token like a password. Anyone with the token can call the API as you. Do not commit tokens to source control, share them in chat, or paste them publicly. Ninety displays the full token only once at generation. If lost, generate a new one.
The Developer Settings page recommends rotating tokens every 90 days, revoking unused tokens, and monitoring the "Last used" timestamp for unexpected activity.
How to authenticate API requests
The API lives at https://api.public.ninety.io/v1. Authenticate requests by passing your Personal Access Token as a Bearer token in the Authorization header.
Verify your token works by calling GET /teams, which lists teams you can access. A valid token returns a 200 OK response with your team list.
Refer to the API documentation for full request and response details.
Permissions and scope
Every API call honors Ninety's user and company boundaries:
Per-user scope: Each call executes as the user who generated the token. All actions record against that user in the audit log.
Per-company scope: Tokens scope to the user's associated company. Generate separate tokens from each company's User Settings for cross-company access.
In-app permissions enforced: If your role prohibits an action in Ninety, the API rejects it. No admin or superuser override exists.
No assignment to other users: All created or updated items assign to the authenticated user. The API does not support assigning items to others in v1.
Company-wide lists are for Owners and Admins: The endpoints that list every item in the company, the Seat and Seat holder lists, and the Quarterly and Annual Reviews list return a
403 Forbiddenresponse for every other role.
What's not in v1
No assignment endpoints.
No delete endpoint for Milestones.
No webhooks or push notifications (polling required).
No bulk writes beyond Scorecard scores (up to 100 per call); every other write acts on one item.
Full API reference
Complete endpoint signatures, request and response shapes, parameters, error codes, and example payloads are available in the API reference documentation.
Frequently asked questions
Which plans include API access?
The Public API is available on the Thrive subscription plan and the Legacy plan (Monthly and Annual). Legacy plan customers have identical feature access to Thrive, including API. The Accelerate, Essentials, and Free plans do not include API access.
Can I generate a token as an Observer?
No. Observers cannot generate Personal Access Tokens. Request a role change from your company's Owner or Admin.
Can an Admin or Coach generate tokens for other users?
No. Every user generates and manages their own tokens from their User Settings.
What happens if I hit my rate limit?
You receive a 429 Too Many Requests response. Back off for at least one second and retry. For regular limit hits, upgrade your subscription tier.
Can I read Scorecard values through the API?
Yes. Read a team's whole Scorecard for a window of periods, or one KPI's score for the period that contains a date you choose. Any date inside the period works. Owners and Admins can also list every KPI in the company with up to a year of scores per request.
Can I write many Scorecard scores in one call?
Yes. The batch endpoint creates or updates up to 100 KPI scores in one call, with an optional note for each. Each score succeeds or fails on its own, and the call returns 200 OK even when some fail, so check each score's result and retry only the failures. A score fails if its KPI is calculated by a formula, its period hasn't started, or the same KPI and period appear twice in the call. A malformed score, such as an invalid ID or a missing value, rejects the whole call with a 400 Bad Request response and writes nothing.
How does the Public API compare to the Zapier integration?
The Public API provides direct, code-level access to the same engine powering Ninety's Zapier integration. Use the API for custom logic, custom UI, or high volumes. Use Zapier for no-code paths or pre-built recipes.
Is there an SDK or client library?
Not in v1. The API is a standard REST service usable from any HTTP client, language, or platform. Use the API reference documentation to generate a client in your preferred language.
Can I have more than one Personal Access Token?
Yes. Generate multiple tokens from User Settings > Developer Settings. Use the Token Description field to label each token. Revoke unused tokens on the same page.
How long do Personal Access Tokens last?
You set each token's lifespan when you generate it. In the Token Expiration Timeframe dropdown, choose 30, 90, 180, or 365 days (the default is 90 days). When a token expires, generate a new one from User Settings > Developer Settings.
What if I lose my token?
Generate a new one from User Settings > Developer Settings. Tokens display in full only once at creation, so lost tokens cannot be recovered.
Can I create linked items, such as linked To-Dos, via the API?
Yes. Link a To-Do, Issue, or Rock to an item of another type or to a Milestone, either when you create or update it or with the item's links endpoint, which also removes a link. Both items must belong to your company. Linking the same two items twice returns a 409 Conflict response.