canonical: https://jentic.com/apis/timesheet.io/timesheet

# Timesheet API

Timesheet is a cross-platform time tracking application for professionals, freelancers, and teams to monitor work hours, manage projects, track expenses, and generate detailed reports across Android, iOS, and Web. The Timesheet REST API provides comprehensive functionality for creating, retrieving, updating, and deleting time tracking data. Integrate time tracking, project management, and reportin. The API exposes 159 endpoints secured with apiKey, bearer authentication.

## For AI agents

Programmatically create a new API key, list API keys. Covers 159 operations with apiKey, bearer authentication.

## Scope

Does not handle payments, communications, or crm - use for analytics only.

## Capabilities

- Create a new API key
- List API keys
- Get API key details
- Delete an API key
- Revoke all API keys

## Use cases

### Analytics Operations

Use the Timesheet API to perform analytics operations programmatically. The API provides 159 endpoints covering core functionality including create a new API key, list API keys, get API key details.

Example prompt: Call POST `/v1/apikeys` to create a new API key

### Automated Oauth2 Authentication Management

Automate oauth2 authentication operations by combining multiple Timesheet API endpoints. Agents can list API keys and then get API key details in a single workflow.

Example prompt: Call GET `/v1/apikeys` to list API keys, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Timesheet API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle apiKey, bearer tokens manually.

Example prompt: Search Jentic for 'create a new API key', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/v1/apikeys` | Create a new API key |
| GET | `/v1/apikeys` | List API keys |
| GET | `/v1/apikeys/{keyId}` | Get API key details |
| DELETE | `/v1/apikeys/{keyId}` | Delete an API key |
| POST | `/v1/apikeys/revoke-all` | Revoke all API keys |
| POST | `/v1/apikeys/{keyId}/revoke` | Revoke an API key |
| POST | `/v1/automations` | Create automation |
| GET | `/v1/automations` | List automations |

## Key resources

- **Oauth2 Authentication** — # OAuth 2.1 Authentication
timesheet.io implements OAuth 2.1 with PKCE (Proof Key for Code Exchange)
- **API Key Authentication** — # API Key Authentication

timesheet.io supports API Key authentication as an alternative to OAuth 2.
- **Pagination** — # Pagination

When you're making calls to the API, there'll be a lot of results to return. For that
- **Webhook** — # Webhooks

Webhooks allow you to receive real-time notifications about events in your Timesheet acc
- **Profile** — # Profile Management

The Profile API allows you to manage user profiles, including personal informa

## Why Jentic

- **Setup:** Wiring the Timesheet API by hand means choosing between its Authorization API key and bearer token, working through 159 endpoints, and handling retries yourself. Through Jentic you install once, import Timesheet from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** Timesheet puts the key id in the URL path (`/v1/apikeys/{keyId}`), so a rule can pin your agent to a specific API key resource. You choose the operations it may call, so destructive ones like revoking a key or revoke-all are not included unless you add them.
- **Credential handling:** Your Timesheet credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list API keys' or 'create an automation', and Jentic returns the matching Timesheet operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Mixpanel** — Alternative analytics API
- **Amplitude** — Alternative analytics API
- **Segment** — Complementary analytics API
- **Pendo** — Complementary analytics API

## FAQ

### What authentication does the Timesheet API use?

The Timesheet API uses apiKey, bearer authentication. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I create a new API key with the Timesheet API?

Yes. Use the POST `/v1/apikeys` endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Timesheet API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I create a new API key through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'create a new API key'. Jentic returns the matching Timesheet API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Timesheet API have?

The Timesheet API exposes 159 endpoints covering oauth2 authentication, API key authentication, pagination operations.

### Can I limit what my agent is allowed to do with the Timesheet API?

Yes. Because you run Jentic One yourself, your own rules decide which Timesheet API operations and credentials the agent may call, so you can grant read operations like GET `/v1/apikeys` or GET `/v1/automations` while withholding everything else. The key id sits in the URL path (`/v1/apikeys/{keyId}`), so a rule can pin the agent to a specific API key resource rather than the whole account. Destructive operations such as revoking a key or POST `/v1/apikeys/revoke-all` are only available to the agent if you explicitly add them.