API

Keys, limits and errors

• Create a key in your project's Settings → Developers and send it as Authorization: Bearer tuti_…. Keep it on your server. A key works for one project.
• Read only keys can use the GET endpoints; changing anything needs a Read and write key.
• Up to 600 requests a minute per key; over that you get 429 with a Retry-After header.
• Errors are { "error": { "code", "message" } } with status 400, 401, 403, 404, 409 or 429.
• Posts and comments are written by the key's creator, or on behalf of someone from your app with "author": { "id", "name", "email" }: their id in your app, the same person as with single sign-on.

MCP (for AI assistants)

Every endpoint below is also a tool on Tuti's MCP server, so assistants like Claude can search, triage and answer your feedback. Add it as a remote MCP server (Streamable HTTP) at https://tuti.so/mcp with the header Authorization: Bearer tuti_…. Read only keys get only the reading tools.

claude mcp add --transport http tuti https://tuti.so/mcp \
  --header "Authorization: Bearer $TUTI_API_KEY"

Webhooks

Add endpoints in Settings → Developers. Tuti sends a POST with a JSON body for each event you pick: post.created (new post), post.status_changed (status changed), comment.created (new comment), changelog.published (changelog published), code_change.ready (autopilot found updates), conversation.created (new conversation), conversation.message_created (new message from a user), plus ping from "Send test".

• Headers: Tuti-Event-Id, Tuti-Event-Type and Tuti-Signature.
• Answer with any 2xx within 10 seconds. Anything else is retried with growing gaps for about a day, always with the same event id: deliveries are at least once, so skip events whose id you've already handled.
• Redirects aren't followed, and endpoints must be public HTTPS URLs.

{
  "id": "evt_…",
  "type": "post.created",
  "createdAt": "2026-10-19T09:30:00.000Z",
  "project": { "slug": "acme", "name": "Acme" },
  "data": { "number": 12, "title": "Dark mode", "status": "open", … }
}

Check the signature with the webhook's secret before trusting a request (Node):

import { createHmac, timingSafeEqual } from "node:crypto";

// body: the raw request body as a string, before parsing it.
function verify(body, header, secret) {
  const { t, v1 } = Object.fromEntries((header ?? "").split(",").map((part) => part.split("=")));
  if (!/^\d+$/.test(t ?? "") || !/^[0-9a-f]{64}$/.test(v1 ?? "")) return false; // missing or malformed
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // older than 5 minutes
  const expected = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
  return v1.length === expected.length && timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}