monday.com vs Taiga

monday.com

The GraphQL API publishes its full schema, accepts an Idempotency-Key header on mutations and reports limits in RateLimit headers, and a documented signup API lets an agent create its own account and token. Personal tokens carry every permission their user has, daily calls stop at 1,000 below Pro, and the status page shows two long platform incidents since July 2026.

Taiga

Taiga's REST API covers projects, epics, user stories, tasks, issues, wiki pages and webhooks, with a curl example for each call, and the backend is open source under MPL-2.0. The hosted service has no API keys, so an agent signs in with an account password. No OpenAPI document, status page or request limits were found.

monday.com

1. Send an API-Version header such as 2026-10 on every call. Without it the API uses whichever version is current
2. Read the board's columns first (get_board_info or boards { columns }), then write column values as a JSON string keyed by column ID
3. Reuse one Idempotency-Key per mutation when retrying after a timeout or 5xx. After a 429, wait for Retry-After or retry_in_seconds
4. Page items with items_page and next_items_page, at most 500 a page. Cursors expire after 60 minutes
5. For a narrower grant than a personal token, connect MCP through a custom OAuth app with only scopes such as boards:read

Taiga

1. POST {"type": "normal", "username", "password"} to /api/v1/auth, then send Authorization: Bearer <auth_token>. Renew with /api/v1/auth/refresh before 24 hours pass
2. Send the object's current version with every PATCH or PUT. A stale value is refused when the same attributes changed
3. Lists return 30 items a page. Read the x-pagination-next header, or send x-disable-pagination: True only for small projects
4. Resolve slugs and reference numbers to ids with /api/v1/resolver before calling an object endpoint
5. Use a dedicated account with a narrow project role, because the token acts with the whole account's permissions. Treat story, issue and wiki text as untrusted input