How to Use Ninety's Public API
Ninety's Public API gives our users programmatic access to the core resources customers manage in Ninety: To-Dos, Issues, Rocks, Milestones, the Scorecard, Headlines, Meetings, the V/TO®, the Accountability Chart®, Quarterly and Annual Reviews, users, and Teams. The same engine that powers Ninety's integrations is now available directly, so you can build your own integrations against the same surface. Each call authenticates with a Personal Access Token (PAT) you generate in your User Settings, runs as you, and respects all of your in-app permissions.
Video overview
What you can build with the API
The Public API is designed for customers, Implementers, and partners who already work with mixed tool stacks and want Ninety to connect directly to those tools. Common patterns include:
Push Scorecard values automatically. Pipe Measurables values from your BI tool or data warehouse into Ninety on a recurring schedule to eliminate manual entry. The batch endpoint writes up to 100 scores in a single call.
Capture leadership-attention items from your other systems. Auto-create Issues in Ninety from your ticketing, support, or monitoring tools so nothing important gets lost.
Bulk-create Rocks during quarterly planning. Create Rocks and Milestones from your strategy document, planning tool, or annual planning process without re-typing decisions.
Build custom client tooling as an Implementer. Generate client dashboards, intake flows, and meeting prep materials from live Ninety data.
Embed Ninety into your own product as a partner. Read and write Ninety data programmatically from inside your own application.
What the API includes
The v1 API covers the following resources. Refer to the API reference documentation for full endpoint signatures, parameters, and response shapes.
Ninety Resource | What you can do |
To-Dos | Create (personal or team), query (with or without paging), get by ID, update, delete, comment, link to a Rock, Issue, or Milestone. |
Issues | Create, query, get by ID, update, delete, comment, link to a To-Do, Rock, or Milestone. |
Rocks | Create, query (filter by status, level, future scope, quarter, team; with or without paging), get by ID, update, soft-delete, list a Rock's Milestones, link to a To-Do, Issue, or Milestone. |
Milestones | Create (linked to a Rock), get by ID, update. |
Scorecard | Read a team's Scorecard, or one Measurable's score for a period. Query Measurables (filter by period interval, owner, search; paginated). Create, update, and delete scores and notes per Measurable and period, or write up to 100 scores in one call. |
Headlines | List a team's Headlines, including discussed and archived ones and Cascading Messages. Create a Headline or a Cascading Message. |
Meetings | Get a team's next Meeting with its agenda and attendees. List a team's past Meetings with their ratings and length. Get one past Meeting with its notes and the Headlines, Issues, To-Dos, and Rocks it worked. |
V/TO | Read a team's V/TO alongside the leadership team's: Core Values, Core Focus™, and the 1-Year Plan and 3-Year Picture™ goals. Leadership sections that haven't been shared with you come back empty. |
Accountability Chart | Read the company's Accountability Chart: every Seat, what it's accountable for, and who holds it. |
Quarterly and Annual Reviews | List the company's Quarterly or Annual Reviews: who reviews whom, due dates, and completion. Answers are never included. Owners and Admins only, and only if your company's plan includes Quarterly Reviews. |
Users | List your company's users (look one up by email, or include inactive users), get a user by ID, list a team's users. |
Teams | List your teams, or every team you can create or query work on. |
Company-wide lists | Owners and Admins can list every To-Do, Issue, Rock, Milestone, Measurable, Measurable group, Headline, and past Meeting in the company, plus every Seat and Seat holder on every Accountability Chart, including personal and shared charts. |
In API payloads, Measurables are referenced as kpis, and their values are referenced as scores. The API documentation reflects the exact field names used in requests and responses.
Who can use the API
API access is gated by both your Ninety subscription plan and your user role.
Plan requirements:
The API is available on the Thrive and Legacy plans (Legacy Monthly and Legacy Annual). Legacy plan customers have the same access as Thrive plan customers.
The Accelerate, Essentials, and Free plans do not include API access at this time.
Role requirements:
Owners, Admins, Implementers, Managers, and Managees (Team Members) can generate a Personal Access Token.
Observers cannot generate tokens.
Note: The API enforces the same permissions you have inside the Ninety app. If you cannot perform an action through the Ninety interface, you cannot perform it through the API either. Each user generates and manages their own tokens, so an Admin or Implementer cannot generate tokens or manage API access on behalf of someone else.
Rate limits
API requests are rate-limited by your company's subscription tier. Rate limits apply per user, and counts reset every second.
Subscription tier | Rate limit |
Thrive and Legacy | 25 requests per second. |
What happens if you exceed your rate limit:
If a request exceeds your tier's rate limit, the API returns a 429 Too Many Requests response. To handle 429 responses gracefully, back off for at least one second and retry. For sustained high-volume workloads, you have two options: design your client to stay under your tier's limit or move to a higher tier in Ninety.
Need a higher rate limit?
If your tier's rate limit doesn't fit your workload, talk to your team about upgrading to a higher subscription tier.
How to generate a Personal Access Token
You can generate Personal Access Tokens in your User Settings. Each token is tied to your individual user and inherits the permissions granted by your role in the Ninety app.
Click your name from the bottom of the left navigation.
Click User Settings.
Click Developer Settings.
Click Generate New Token in the top right.
In the Generate Personal Access Token dialog, choose a Token Expiration Timeframe from the dropdown. The default is 90 days.
Enter a Token Description to identify what this token is for (50-character limit).
Click Generate Token.
Copy the token immediately and store it somewhere secure.
Warning: Treat your Personal Access Token like a password. Anyone with the token can call the API as you, with the same permissions you have in the Ninety app. Do not commit tokens to source control, paste them into chat tools, or share them. Ninety will display the full token only once, when you generate it. If you lose a token, generate a new one.
The Developer Settings page also lists best practices for managing your tokens over time: rotate tokens regularly (every 90 days is a good default), revoke tokens you're no longer using, and monitor each token's Last used timestamp for unexpected activity.
How to authenticate API requests
The API is a REST service that lives at https://api.public.ninety.io/v1. Authenticate each request by passing your Personal Access Token as a Bearer token in the Authorization header.
A quick way to verify your token works is to call GET /teams, which lists the teams you have access to in your company. If your token is valid, you'll receive a 200 OK response with your team list.
For full request and response details, including all required headers, parameters, and response shapes, refer to the API documentation.
Permissions and scope
Every API call honors the user and company boundaries Ninety enforces inside the app.
Per-user scope. Each call executes as the user who generated the token. All actions are recorded against that user in Ninety's audit log.
Per-company scope. Tokens are scoped to the company associated with the user. You cannot read or write data from another company through your token, even if you belong to multiple Ninety companies. Generate a separate token from each company's User Settings if you need cross-company access.
In-app permissions enforced. If your role does not allow you to delete a Rock from another team in the Ninety app, the API will reject the same call. There is no admin or superuser override.
No assignment to other users. All items created or updated through the API are assigned to the authenticated user. The API does not support assigning items to other users in v1.
Company-wide lists are for Owners and Admins. The endpoints that list every item in the company, the Seat and Seat holder lists, and the Quarterly and Annual Reviews list return a
403 Forbiddenresponse for every other role.
What's not in v1
The first version of the API focuses on the highest-demand resources and operations. The following are not supported in v1 and may be added in future releases.
No assignment endpoints. You cannot assign items to anyone other than the token holder.
No delete endpoint for Milestones. Milestones can be created and updated through the API; deletion is not yet supported.
No webhooks or push notifications. Clients poll the query endpoints. Webhook support is on the roadmap for a future release.
No bulk writes beyond Scorecard scores. You can write up to 100 Scorecard scores in one call. Every other create, update, and delete acts on one item at a time.
Full API reference
The complete reference for endpoint signatures, request and response shapes, parameters, error codes, and example payloads lives in the API reference documentation.
The API reference documentation is the authoritative reference. This help article provides orientation and the rules around access, rate limits, and permissions.
Frequently asked questions
Which plans include API access?
The Public API is available on the Thrive subscription plan and the Legacy plan (Monthly and Annual). The Legacy plan is equivalent to Thrive in all features, including API access. The Accelerate, Essentials, and Free plans do not include API access.
Can I generate a token as an Observer?
No. Observers cannot generate Personal Access Tokens or call the API. If you need API access, ask your company's Owner or Admin to change your role.
Can an Admin or Implementer generate tokens for other users?
No. Every user generates and manages their own tokens from their own User Settings. There is no admin-level token management in v1.
What happens if I hit my rate limit?
You'll receive a 429 Too Many Requests response. Back off for at least one second and retry. If you regularly hit the limit, talk to your team about upgrading to a higher subscription tier.
Can I read Scorecard values through the API?
Yes. You can read a team's whole Scorecard for a window of periods, or one Measurable's score for the period that contains a date you choose. Any date inside the period works, and Ninety matches it to the right period. Owners and Admins can also list every Measurable in the company with up to a year of scores per request.
Can I write many Scorecard scores in one call?
Yes. The batch endpoint creates or updates up to 100 Measurable scores in one call, with an optional note for each. Each score succeeds or fails on its own, and the call returns 200 OK even when some scores fail, so check the result for each score and retry only the ones that failed. A score fails if its Measurable is calculated by a formula, its period hasn't started yet, or the same Measurable and period appear twice in the call. If any score in the request is malformed, such as an invalid ID or a missing value, the whole call is rejected with a 400 Bad Request response and nothing is written.
How does the Public API compare to the Zapier integration?
The Public API gives you direct, code-level access to the same engine that powers Ninety's Zapier integration and the native integrations. Use the API when you need custom logic, your own UI, or volume beyond what Zapier supports. Use Zapier when you want a no-code path or pre-built recipes.
Is there an SDK or client library?
Not in v1. The API is a standard REST service over HTTPS, usable from any HTTP client, language, or platform. Use the API reference documentation to generate a client in your preferred language.
Can I have more than one Personal Access Token?
Yes. You can generate multiple tokens from User Settings > Developer Settings. Use the Token Description field to label each token for the integration or use case it's for. Revoke any tokens on the same page when you no longer need them.
What if I lose my token?
Generate a new one from User Settings > Developer Settings. Tokens are only displayed in full once, at the moment they're created, so a lost token cannot be recovered.
How long do Personal Access Tokens last?
You set each token's lifespan when you generate it. In the Token Expiration Timeframe dropdown, choose 30, 90, 180, or 365 days (the default is 90 days). When a token expires, generate a new one from User Settings > Developer Settings.
Can I create linked items, such as linked To-Dos, via the API?
Yes. You can link a To-Do, Issue, or Rock to an item of another type or to a Milestone. Link items when you create or update them, or link two existing items with the item's links endpoint, which also removes a link. Both items must belong to your company, and linking the same two items twice returns a 409 Conflict response.