Copy page

Asana

Twin of the Asana REST API.

Twin of the Asana REST API.

Covers	app.asana.com
Auth	Personal access tokens, OAuth
Webhooks	Yes
Operations	139

Coverage

Workspaces, users, teams, projects and sections, tasks with subtasks and assignees, stories, tags, custom fields, attachments with real byte round-trip, webhooks and POST /batch. The OAuth authorize and token endpoints sit on the same base, at Asana’s own /-/oauth_authorize and /-/oauth_token.

Credentials

Both kinds ride Authorization: Bearer. Any well-formed personal access token authenticates by default, so your existing 2/… token needs no change. Set auth.mode to enforced to accept only the tokens the world knows. See Credentials.

OAuth tokens carry <resource>:<action> scopes and one missing the scope a route needs gets Asana’s 403 naming it. Personal access tokens are unrestricted.

Vendor specific details

• Writes go inside a data envelope. A body posted without one is not an error, it is read as an empty request, so every required field comes back missing.
• Without opt_fields you get a compact record: gid, name, resource_type and nothing else. With it you get gid plus exactly the fields you named, so resource_type disappears unless you ask. Unknown names are ignored silently.
• List endpoints refuse to be called bare. GET /tasks with no filter is a 400 naming the options, not an empty page.
• An id that is not numeric is a 400 before any lookup, while a numeric id that does not exist is a 404.
• There is no idempotency mechanism anywhere in Asana, and none here. A retried create makes a second object with a new gid.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.