⁠Chapter 6. MantisBT REST API

The primary means of integrating with MantisBT with web services is with the bundled REST API, which is accessible at https://server.com/mantis/api/rest/.

⁠6.1. Authentication

REST API calls can be authenticated using one of the following methods:

API Token: This is the primary authentication method.
Create an API token for your user account and pass it in the Authorization HTTP request header using the RFC 6750 bearer scheme (Authorization: Bearer <token>).
Warning
The legacy, bare token form (Authorization: <token>) has been deprecated in 2.29.0. It is still accepted for backwards compatibility, but will be removed in a future release. The API will issue an HTTP Deprecation header in responses to requests using it.
API token authentication is required when using impersonation.
When a request requires authentication but none is provided (and anonymous access is not available), the API responds with 401 Unauthorized and a WWW-Authenticate: Bearer header advertising the expected scheme.
Anonymous: When anonymous access is enabled and an anonymous account is configured, the API can be accessed without authentication for read-only operations.
Cookie (Web UI): Used internally by the MantisBT Web UI when JavaScript calls the API on behalf of an already authenticated user session.