Link a work item to another

POSThttps://<your-url>/api/v2/work-items/{work_item}/links

MCP id work-items.links.storeAlso on this path: GET List a work item's links

Creates a link from the work item in the path to another work item in the same project, and returns it with a Location header pointing at the flat item path.

Token scope: api:write:project_management
Without it: 403 insufficient-token-scope.
Permission: project_management::manage_work_items
Without it: 403 insufficient-permission.
Rate cost: 1 unit, write bucket. A write costs the same whatever view you ask for.
Also: Accepts Idempotency-Key. Never cached: private, no-store. Unknown body keys are refused, never dropped.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: This work item blocks another

curl -X POST \
  'https://<your-url>/api/v2/work-items/1/links' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: <key>' \
  -d '{
    "link_type": "blocks",
    "target_work_item_id": 1
  }'

const response = await fetch('https://<your-url>/api/v2/work-items/1/links', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'Idempotency-Key': '<key>',
  },
  body: JSON.stringify({
    "link_type": "blocks",
    "target_work_item_id": 1
  }),
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->withHeader('Idempotency-Key', '<key>')
    ->post('https://<your-url>/api/v2/work-items/1/links', [
        'link_type' => 'blocks',
        'target_work_item_id' => 1,
    ]);

import requests
response = requests.request(
    'POST',
    'https://<your-url>/api/v2/work-items/1/links',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json', 'Content-Type': 'application/json', 'Idempotency-Key': '<key>'},
    json={'link_type': 'blocks', 'target_work_item_id': 1},
)

Response

The shape of the response, with sample values.

{
  "data": {
    "id": 1,
    "source_work_item_id": 1,
    "target_work_item_id": 1,
    "link_type": "blocks",
    "created_by": 1,
    "created_at": "2026-03-04T09:15:00Z",
    "updated_at": "2026-03-04T09:15:00Z",
    "direction": "…",
    "relationship": "…",
    "source_work_item": {
      "id": 1
    },
    "target_work_item": {
      "id": 1
    },
    "links": {
      "self": "https://<your-url>/api/v2/work-items/1"
    }
  }
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/duplicate-resource",
  "title": "Duplicate resource",
  "status": 409,
  "detail": "Another project already uses the code \"ACM\".",
  "instance": "/api/v2/projects",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "conflict": {
    "field": "code",
    "value": "ACM"
  }
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/validation-failed",
  "title": "Validation failed",
  "status": 422,
  "detail": "3 fields failed validation.",
  "instance": "/api/v2/worklogs",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "errors": [
    {
      "pointer": "/date",
      "code": "date_format",
      "detail": "The date does not match the format Y-m-d."
    },
    {
      "pointer": "/minutes",
      "code": "min",
      "detail": "The minutes must be at least 1."
    },
    {
      "pointer": "/description",
      "code": "required",
      "detail": "The description field is required."
    }
  ]
}

The body is exactly link_type and target_work_item_id: the source comes from the path, so source_work_item_id is not accepted, and created_by is the authenticated caller. To create the inverse of a relationship ("this item is blocked by ACM-9"), post to ACM-9's own collection instead: POST work-items/ACM-9/links with link_type=blocks and this item as the target stores the identical row, which both ends then read from their own side. Three refusals mirror plnnrly: a work item in another project is refused exactly as a nonexistent one is, linking an item to itself is 422 unprocessable-relationship, and repeating an existing (source, target, link_type) triple is 409 duplicate-resource.

Path parameters

work_iteminteger or stringRequired

The WorkItem's numeric id. Or its issue_key, matching [A-Z][A-Z0-9]*-[0-9]+.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

viewstring

Which field set to render.

summarydetaildefault

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

Idempotency-Keystring≤ 255

A caller-chosen key that makes this POST safe to retry. Replaying it returns the original response with Idempotency-Replayed: true.

Request body

Unknown keys are refused with 422, naming the key.

link_typestringRequired

The relationship, stored from the source item's point of view: blocks, clones, duplicates, merged_into, causes, relates_to or split_to. Only relates_to is symmetric.

blocks: The source cannot be finished until the target is, and the target is blocked by the source.
clones: The source was created as a copy of the target.
duplicates: The source and the target describe the same work; one of the two should be closed.
merged_into: The source was folded into the target, which now carries the work.
causes: The source is the cause of the target, typically a change that produced a defect.
relates_to: The two are related with no direction implied. This is the one symmetric type: it reads the same from either side.
split_to: The source was split and the target is one of the pieces it was split into.

New values may be added.

target_work_item_idinteger → WorkItem.idRequired

Work item the link points at. Always in the same project as the source.

Response 201

Returns a WorkItemLink in the detail view.

Headers

ETag: A strong validator of exactly this representation.
Idempotency-Replayed: true when this response was replayed from a stored Idempotency-Key rather than produced by a new write.
Location: The absolute URL of the created or queued resource.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning