Build on Sumhour
Four ways in. Each acts as one person inside one workspace, never beyond that person's role, and only within the permissions they granted.
| You want to | Use |
|---|---|
| Let Claude, ChatGPT or Cursor log time, read reports and draft invoices | MCP |
| Script Sumhour from any language | REST API |
| Stay in the terminal | Command line |
| React when something happens in Sumhour | Webhooks |
Quick start
- In Sumhour, open your account menu, then API tokens, and make a token. Copy it; it is shown once.
- Call the API:
export SUMHOUR_TOKEN=sh_pat_...
curl https://app.sumhour.com/api/v1/me -H "Authorization: Bearer $SUMHOUR_TOKEN"
- Log an hour and a half:
curl -X POST https://app.sumhour.com/api/v1/entries \
-H "Authorization: Bearer $SUMHOUR_TOKEN" -H "Content-Type: application/json" \
-d '{"projectId":"<projectId from /projects>","duration":"1:30","notes":"Design review"}'
Permissions
A token or an AI connection gets some of these. Presets on the tokens page: Time tracking, Read only, Everything your role allows.
| Permission | Lets it |
|---|---|
time:read |
See entries, the timer and timesheets |
time:write |
Log, change and delete time, run the timer, submit weeks |
projects:read |
See projects, tasks and clients |
projects:write |
Add clients and projects (admins and owners) |
expenses:read |
See expenses |
expenses:write |
Add expenses |
invoices:read |
See invoices |
invoices:write |
Draft invoices and record payments |
reports:read |
Run reports |
approvals:read |
See weeks waiting for review |
approvals:write |
Approve and send back weeks |
team:read |
See the people in the workspace |
events:write |
Send workspace events to apps such as Zapier (admins and owners) |
Rules that always apply
- The workspace's own rules hold everywhere: locked and approved weeks do not change, required notes and tasks are required, contractors see only their projects.
- Every change is recorded in the Activity log with where it came from, for example via API · Zapier or via MCP · Claude.
- Removing someone from the workspace, or revoking a token or a connection, takes effect on the next request.
This server
Everything on these pages points at https://app.sumhour.com. A self-hosted Sumhour serves the same pages with its own address.
- OpenAPI 3.1: https://app.sumhour.com/api/v1/openapi.json
- MCP endpoint:
https://app.sumhour.com/mcp - For AI agents: llms.txt and llms-full.txt