Jasper + your own tools: the REST API and incoming webhooks

Use the REST API to read and change your Jasper data from scripts and other systems, and incoming webhooks to post messages from any tool into a Jasper chat channel.

Available All plans

Create a token Read the setup guide

What you can do

Read and update Jasper data from your own scripts, reports and back-office systems, with tokens limited to the scopes you choose.
Post build results, deploy notices or form submissions into a Jasper chat channel from any tool that can send a Slack-style webhook.
Move a tool from Slack to Jasper without rewriting it: Jasper accepts the same text, blocks and attachments.
Trigger an AI code review from your own CI through the API.

What syncs

Data	Direction	When
Your Jasper data, by scope: reviews, repositories, time, chat, wiki and more	Jasper ↔ your system	When your code calls the API.
Messages from your tools	Your tool → Jasper chat	When the tool posts to the channel's webhook address.
Events from Jasper, such as a finished review	Not sent yet	You can register an endpoint and send a signed test, but Jasper doesn't send real events yet.

Set up in 4 steps

Who can do this: API: anyone can create a personal token; owners and admins create organisation tokens. Incoming webhooks: channel admins, owners and admins.

Open Personal settings, then OAuth Tokens. Create a token, choose its scopes and expiry, and copy it: it is shown once.
Send requests to https://heyjasper.ai/api/v1 with the header Authorization: Bearer followed by your token.
For an incoming webhook, open a channel's details in the Jasper desktop app, go to Incoming webhooks and click Add incoming webhook. Copy the address: it is shown once.
Point your tool's Slack webhook setting at that address, or post JSON with a text field to it.

Permissions we ask for, and why

Nothing outside Jasper is connected here: you decide what each token and webhook can do.

Permission	Why Jasper needs it
`Token scopes`	Each token carries only the scopes you pick from 38, such as reviews:read or time-tracking:write.
`Organisation API access`	Token requests need API access on for your organisation. New workspaces start with it off; it turns on when an owner or admin creates an organisation token under Personal settings, then API Tokens.
`Incoming webhook address`	Anyone with the address can post into that one channel, as the webhook. It cannot read the channel.
`IP allowlist`	If your organisation limits access to certain IP addresses, API calls must come from them too.

Your data

Jasper shows a token once and can't show it again. Incoming webhook addresses are stored only as hashes.
Messages posted by a webhook are stored like any other chat message in that channel.
Creating, regenerating and removing an incoming webhook is recorded in the audit log.

Our privacy policy covers what we store, where, and for how long.

Limits and what is not synced

Jasper doesn't yet send its review, billing or team events to webhook endpoints. You can register an endpoint through the API and send it a signed test, but no real events are delivered. Check the API instead.
By default the API allows 60 requests a minute, 1,000 an hour and 5,000 a day per person.
Incoming webhooks accept up to 60 messages a minute each, 16,000 characters per message and 256 KB per request. The channel and thread fields are ignored.
Incoming webhooks work in channels, not direct messages, and are added from the desktop app.
A webhook stops working when the person who added it leaves the channel or is deactivated. Regenerate it to take it over.

Common questions

Can Jasper call my server when a review finishes?

Not yet. Outgoing webhooks can be registered and tested, but Jasper does not deliver events to them today. Check the API instead.

Will our Slack webhook integrations work with Jasper?

Usually, yes. Jasper accepts Slack's text, blocks (header, section, context, actions, image and divider), attachments, username and icon fields. It ignores channel and thread_ts.

How do I authenticate?

Send a bearer token in the Authorization header. Personal tokens, organisation tokens and OAuth apps all work.

Is the API on the free plan?

Yes. The API and incoming webhooks are on every plan. Endpoints for a paid module, such as time tracking, work only if your organisation has that module.