Rhythm API Overview
The Rhythm API lets you build integrations that read and update your company's plan: goals, statuses, tasks, comments, meetings, and more. It is organized around REST. If you have worked with a RESTful API before, the concepts will be familiar. Requests use standard HTTP verbs, responses are JSON (including errors), and HTTP status codes indicate success or failure.
API v2 is the current Rhythm API. All new integrations should be built on v2. The original API (now called the Legacy API, or v1) remains available for integrations that already use it. See "Legacy API (v1)" below.
All v2 requests are made to:
https://app.rhythm.cloud/api/v2
Prerequisites
- Your company must be enabled for API Access by Rhythm Systems. Contact help@rhythmsystems.com to request this.
- Your user account must be granted API Access by your Company Admin. This makes you an API Admin for your company.
Once both are in place, the API Admin section appears in the menu that opens when you click your user thumbnail in the upper-right corner of Rhythm. If you do not see it after both grants are confirmed, refresh your browser or log out and log back in.
Authentication
The v2 API uses OAuth 2.1 with the authorization code flow and mandatory PKCE. An API Admin creates an OAuth Client in API Admin → OAuth V2 Clients, your application sends the user to the Rhythm authorization page, and exchanges the returned code for an access token (1 hour) and refresh token (30 days).
Full flow, request formats, and token handling: Authenticating with the Rhythm API (OAuth 2.1).
Request and response conventions
Company context
A Rhythm user may belong to more than one company. If the authorizing user belongs to exactly one company, no extra header is needed. If the user belongs to several, send the company the request is for on every company-scoped request:
Rhythm-Company-Id: {COMPANY_ID}
Company IDs are available from the companies endpoint, which lists the companies the token can access.
Success responses
Successful responses wrap the result in a data property. A single item is an object; a list is an array.
{ "data": { "id": "…", "name": "…" } }
{ "data": [ { "id": "…" }, { "id": "…" } ] }
Error responses
Errors return an HTTP status code and a JSON body with a machine-readable error code and a human-readable error_description:
{ "error": "invalid_request", "error_description": "…" }
| HTTP status | error |
Meaning |
| 400 | invalid_request |
Missing or malformed input |
| 401 | unauthorized |
Missing, expired, or invalid access token |
| 403 | forbidden |
The user is not allowed to view or change this item |
| 404 | not_found |
The item does not exist or is not visible to the user |
| 409 | conflict |
The change conflicts with the item's current state |
| 422 | unprocessable_entity |
Input is well-formed but fails a business rule |
| 500 | server_error |
Unexpected error on Rhythm's side |
Pagination
List endpoints accept maxResults. The default page size is 25 and the maximum is 100.
Dates
Dates are ISO 8601 (YYYY-MM-DD). Date-times are YYYY-MM-DDThh:mm:ss.
Permissions
The API acts as the user who authorized the integration. It can see and change only what that user can see and change in Rhythm. Items the user cannot access are omitted from lists and return 403 or 404 when requested directly.
What the API covers
The v2 API exposes the same plan data you work with in Rhythm, including:
- Goals: KPIs, Quarter Priorities, Annual Priorities, and Winning Moves, with their status updates
- Tasks
- Comments
- Meetings, agendas, and attendees
- Dashboards and scorecards
- KPI targets
- Strategic plans and the strategic foundation (core values, core competencies, SWOT)
- Job scorecards, feedback, and parking lot items
- Companies, teams, users, and quarters
Every change made through the API is recorded in the item's history in Rhythm.
The full endpoint reference is provided to integration partners on request. Contact help@rhythmsystems.com with a short description of what you are building.
Event subscriptions
Rhythm can notify an integration when plan data changes, instead of the integration polling for changes. Today, event subscriptions deliver to Zapier only; use the Rhythm integration in Zapier to start workflows from Rhythm changes. See Integrate Using Zapier + Rhythm.
Event names, delivery envelope, and retry behavior: Rhythm API Event Subscriptions.
Legacy API (v1)
The original Rhythm API is still supported for integrations that already use it. It is not recommended for new work.
- Base URL:
https://api.rhythm.cloud - Authentication: OAuth 2.0 (authorization code, no PKCE), with API Clients created in API Admin → API Clients
The v1 documentation remains available: Authentication Overview, API Clients, Initiate an Integration with OAuth 2.0, Get OAuth 2.0 Access Token and Refresh Tokens, Refresh OAuth 2.0 Access Token, Using OAuth 2.0 Access Tokens, and the goal and task endpoint pages.
Migrating from v1 to v2
| Legacy API (v1) | API v2 | |
| Base URL | api.rhythm.cloud |
app.rhythm.cloud/api/v2 |
| Authentication | OAuth 2.0 authorization code | OAuth 2.1 authorization code with PKCE (S256 required) |
| Client setup | API Admin → API Clients | API Admin → OAuth V2 Clients; secret shown once |
| Company selection | Fixed by the authorizing user's login | Rhythm-Company-Id header when the user belongs to several companies |
| Success body | Varies by endpoint | Always wrapped in data |
| Error body | Varies by endpoint | Always { "error", "error_description" } |
| Token lifetime | See v1 docs | Access 1 hour, refresh 30 days |
| Pagination | Varies by endpoint | maxResults, default 25, max 100 |
A v1 client cannot be reused for v2. Create a new OAuth Client and have users authorize again.