BugHerd
PROJECT MANAGEMENT · TASKS
Projects, taskboard columns, and tasks with their feedback in that organization.
Connecting BugHerd in practice
BugHerd authenticates with HTTP Basic using the API key as the username and the literal string x as the password, which is easy to get wrong in a client that expects a bearer token. The more consequential limit is that DELETE only works on projects, attachments and webhooks: tasks, columns, comments and users cannot be removed through the API at all, so an agent that creates them cannot clean up after itself.
Scopes that draw scrutiny
Basic base64(api_key:x)One account-wide key from Settings > General, sent as the Basic auth username with the literal password x. No scopes, no read-only variant.
Rate limits
- Sustained 60 requests per minute, with a burst allowance of up to 10 additional requests.
- Over the limit returns 429 Too Many Requests.
- BugHerd says applications using webhooks instead of polling may request lifted rate limits.
- List endpoints return at most 100 records per page; page starts at 1 and an empty array means the end.
Worth knowing
- DELETE is supported only on projects, attachments and webhooks. Tasks, columns, comments and users have to be deleted in the UI, so anything an agent creates in those types is permanent as far as the API is concerned.
- Custom columns push status_id past 5 and make the status field carry the custom column name, so an integration keyed to fixed status values breaks on any customer who added a column.
- A 410 Gone from your webhook endpoint automatically removes the webhook, which turns a temporary deploy gap into a silent disconnection.
- Paths are relative to https://www.bugherd.com rather than an api subdomain, and pagination reports no total.
Checked against BugHerd API v2 (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put BugHerd behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.