API

Story Points deliberately ships no tracker-specific integrations. Instead, every room exposes a tiny plain-HTTP surface. The room slug is the capability — same trust model as the app itself — so anything that can run curl can bridge to Jira, Linear, GitHub, or your own tooling.

Base URL: https://story-points.danielrose7.workers.dev

Authentication: there is none, by design. No OAuth, no API keys, no signup — and none are coming. The room slug (plus the optional room code below) is the entire credential, scoped to exactly one room and shared the same way the room itself is. That's a philosophy, not an omission: key machinery is accounts by the back door, tokens parked in scripts and CI logs leak, and the zero-ceremony surface is what lets you point your own agent at a room with nothing but the URL it was invited with.

Protected rooms: a host can require a 6-character room code (off by default). When enabled, queue and export need it — ?code=ABC123 or an X-Room-Code: ABC123 header — and return 401 without it. Invite links carry the code (/room/<room>?code=ABC123). Code checks are rate-limited: ten wrong guesses locks checking for ~15 minutes.

Import tickets into the queue

POST /api/room/<room>/queue

Plain text (one story per line) or JSON. Appends by default; ?mode=replace swaps the whole queue. Connected clients see imports live.

# Plain text
printf 'Login flow rework\nRate limiter for API\n' | \
  curl -X POST --data-binary @- \
  https://story-points.danielrose7.workers.dev/api/room/<room>/queue

# JSON
curl -X POST -H 'Content-Type: application/json' \
  -d '{"items":["Login flow rework","Rate limiter"]}' \
  'https://story-points.danielrose7.workers.dev/api/room/<room>/queue?mode=replace'

Response: {"queued": <total items now in queue>}. Limits: 100 items, 500 chars each. Returns 403 if the room's host has switched the ticket queue off, 400 for unparseable bodies.

Export the session

GET /api/room/<room>/export — JSON: room name, current queue, and round history (story, ISO end time, duration in seconds, deck-ordered vote counts).

GET /api/room/<room>/export?format=csv — the history as CSV (story,ended_at,duration_seconds,votes).

curl https://story-points.danielrose7.workers.dev/api/room/<room>/export

Returns 404 for rooms that don't exist yet.

Peek at a room

GET /api/room/<room>/peek — {"exists": bool, "name"?: string, "theme"?: string}. Cheap existence check; doesn't create the room.

Realtime

The app itself runs over a WebSocket at /api/room/<room>/ws?u=<user-id> with JSON messages (join, vote, reveal, clear, story, queue, settings, …). It's an internal protocol — no compatibility promises — but it's plain JSON if you want to script a bot; see shared/types.ts in the repo for message shapes.

Agent setup

One step for any agent — see the Agent setup guide:

Fetch https://story-points.danielrose7.workers.dev/agent-setup/prompt.md and follow it

Or point your coding agent or MCP tool at /llms.txt — it indexes these docs in Markdown. Every docs page also serves a raw Markdown twin at the same URL with .md appended (e.g. /docs/api.md), and /llms-full.txt bundles all pages in one fetch. A typical agent workflow:

# 1. Learn the surface
curl https://story-points.danielrose7.workers.dev/llms.txt
# 2. Import the backlog you were asked to estimate
your-tracker-cli list --sprint 42 | curl -X POST --data-binary @- \
  https://story-points.danielrose7.workers.dev/api/room/<room>/queue
# 3. After the session, collect results and write them back
curl https://story-points.danielrose7.workers.dev/api/room/<room>/export