Kanboard#

Kanboard supports native task CSV import and bounded selected-project JSON-RPC sync through the shared reviewable provider-import flow. API sync also imports the selected projects' members into the same user-mapping review.

Capabilities#

Credential verification#

Credential storage and verification use the generic organization-scoped endpoints:

PUT  /api/v1/providers/kanboard/credentials
POST /api/v1/providers/kanboard/credentials/verify
GET  /api/v1/providers/kanboard/credentials
DELETE /api/v1/providers/kanboard/credentials

Store credentialType: "API_KEY" with secret containing exactly this versioned JSON object:

{
  "version": 1,
  "baseUrl": "https://kanboard.example.com/kanboard",
  "username": "teamboost-integration",
  "accessToken": "opaque-token",
  "projectIds": [12, 34]
}

The object accepts no aliases or additional keys. projectIds must contain 1–25 unique positive integers. A dedicated, read-only personal-token user is the default. Username jsonrpc explicitly selects Kanboard's global application-token mode; verification never falls back between the modes.

Because Kanboard is self-hosted, the service deployment must separately include the exact canonical HTTPS installation URL in KANBOARD_ALLOWED_BASE_URLS, for example:

KANBOARD_ALLOWED_BASE_URLS=["https://kanboard.example.com/kanboard"]

An empty, malformed, or non-matching allowlist disables Kanboard API requests while CSV import remains available. URLs with credentials, query strings, fragments, IP literals, custom ports, or ambiguous paths are rejected. DNS is validated as public-only on every request attempt, redirects and environment proxies are disabled, and the transport connects only to the validated addresses while retaining normal TLS hostname verification.

Verification requires Kanboard v1.2.53 or newer. It checks the authenticated project list and probes getColumns plus getProjectUsers for every selected project. The credential secret is encrypted at rest and is never returned by a status or verification response. Invalid credentials return invalid_api_key; insufficient project access returns insufficient_permissions; disabled destination policy and provider availability failures return service_unavailable.

API sync#

After storing and verifying the credential, start a reviewable API import with:

POST /api/v1/providers/kanboard/imports/sync

The generic organization-scoped sync endpoint decrypts this organization's stored credential, then performs a fixed read-only conversation. It reads the Kanboard version and timezone, verifies that every selected project is visible, and fetches each selected project's columns, categories, members, open tasks, closed tasks, tags, and task links. Callers cannot supply JSON-RPC method names or project ids in the sync request.

The first supported API contract is Kanboard v1.2.53 or newer. One sync is bounded to 25 selected projects, 500 total tasks, 1,000 unique project members, 50 calls per JSON-RPC batch, 5 MiB per response, 25 MiB across response bodies, three attempts per JSON-RPC request, and 30 seconds of cumulative retry wait. A limit violation fails the sync; results are never silently truncated.

The returned import session uses capability SYNC. It includes all selected project members in userMappings, including members not referenced by the current task set. Task and user identities are namespaced to the canonical installation URL:

<canonical-base-url>::task::<numeric-id>
<canonical-base-url>::user::<numeric-id>

Numeric user id 0 remains unassigned. Present creators and assignees must be mapped to TeamBoost members before confirmation. Project public-share tokens and generated project URLs are not copied into the stored source context.

Export and upload#

The first supported contract is the native task export produced by Kanboard v1.2.53 when the application uses:

• language en_US;
• timezone UTC;
• date format m/d/Y.

In Kanboard, open the project dropdown, choose Exports, then Tasks, and download the CSV. Upload that file through the generic endpoint:

POST /api/v1/providers/kanboard/imports/csv

The endpoint requires the normal TeamBoost user token and organization scope. It creates a review session; it does not immediately create TeamBoost tasks.

The file must have Kanboard's exact native 24-column task header, in the native order. UTF-8 with or without a BOM and standard quoted CSV commas, quotes, and newlines are supported. A localized, reordered, incomplete, or extended header is rejected with invalid_csv_format. Invalid row values are isolated as row errors when the rest of the file can still be reviewed.

Mapping behavior#

Every one of the 24 CSV values, including empty cells, is also preserved in the session's lossless source record. CSV task identity uses csv::task::<Task Id>, and a blank Kanboard reference is displayed as #<Task Id>.

API sync likewise preserves each accepted top-level task response as its lossless source record and enriches it with the canonical base URL, Kanboard version and timezone, project, column, category, actors, tags, numeric values, and task links.

Review requirements#

Before confirming the session:

1. Resolve every present creator and assignee to a TeamBoost member.
2. Review every open task's Kanboard column and choose a TeamBoost status if needed.
3. Review the OTHER, UNKNOWN priority, and UNKNOWN complexity defaults.
4. Inspect category, swimlane, color, position, time, and numeric source context.
5. For CSV only, confirm that the export came from the supported UTC, English, m/d/Y configuration.

projectionErrors block confirmation. mappingNotes are advisory and remain visible for operator review.

Refresh model#

Kanboard remains pull-based. Call POST /api/v1/providers/kanboard/imports/sync whenever an operator needs a fresh, bounded review snapshot. This starts another review session; it is not an automatic continuous or two-way sync.

Unsupported or not built#

• OAuth app installation. Kanboard's JSON-RPC credential model does not provide an OAuth authorization flow.
• Native token-only webhook delivery is intentionally unsupported because it cannot authenticate the exact request body or reject replay. WEBHOOK remains absent. Revisit event delivery only with a signed plugin or proxy plus shared replay and idempotency support.