OpenProject vs Taiga

OpenProject

OpenProject's APIv3 has a public OpenAPI 3.1 document with 320 operations, stable error identifiers and optimistic locking, and the same API ships in the free GPL-3.0 Community edition. No request limits are published, API tokens carry their user's full permissions, and 83 security advisories were published in the last twelve months, 13 rated critical.

Taiga

Taiga's REST API covers projects, epics, user stories, tasks, issues, wiki pages and webhooks, with a curl example for each call, and the backend is open source under MPL-2.0. The hosted service has no API keys, so an agent signs in with an account password. No OpenAPI document, status page or request limits were found.

OpenProject

1. Send the API token as Authorization: Bearer <token>, or as the Basic auth password with the user name apikey
2. Read the resource first and send its current lockVersion with every PATCH. A stale value returns 409 UpdateConflict
3. POST to the /form endpoint of a work package to learn writable fields and allowed values before creating or updating
4. URL-encode filters as a JSON array, and add pageSize, offset and select to keep work package lists small
5. Run the agent as a dedicated user with a narrow project role, and treat work package text and comments as untrusted input

Taiga

1. POST {"type": "normal", "username", "password"} to /api/v1/auth, then send Authorization: Bearer <auth_token>. Renew with /api/v1/auth/refresh before 24 hours pass
2. Send the object's current version with every PATCH or PUT. A stale value is refused when the same attributes changed
3. Lists return 30 items a page. Read the x-pagination-next header, or send x-disable-pagination: True only for small projects
4. Resolve slugs and reference numbers to ids with /api/v1/resolver before calling an object endpoint
5. Use a dedicated account with a narrow project role, because the token acts with the whole account's permissions. Treat story, issue and wiki text as untrusted input