Podio
Read and write Podio items, apps, workspaces, tasks, comments and webhooks over the Podio API.
About
Podio ships in the w6w first-party pack. It declares 29 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.podio- Version
- 0.1.2
- Author
- w6w
- Licence
- MIT
- Categories
- Project Management · Databases · Productivity
Overview
Podio is a customizable work platform where teams build their own record types — leads, invoices, bug reports, anything — inside workspaces, and this app lets a workflow read and write those records directly. Look up an item by id or by an external id for upsert-style syncing, create and update items, count and filter a whole app’s worth of records, and search across an app or a whole workspace when a filter alone cannot find what you need.
Beyond items, list an organization’s workspaces and a workspace’s apps, discover an app’s own field definitions and option lists (Podio’s fields are user-defined, so this is how a workflow learns the exact vocabulary a given app uses), add comments, and create and complete tasks. Manage the webhook subscriptions that notify your systems when something in Podio changes.
Because every Podio app has its own fields, chosen by whoever set it up, discovering a workspace’s actual schema before writing to it is part of using this app well, not an extra step.
Build with Podio
Three routes to the same 29 actions. The Workflow tab is generated from Podio's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Get App Fields
app-fields-list The writable field schema of one Podio app: every field's id, external id, type, label, settings and the sub_ids its values use. Run this before Create Item or Update Item — the fields are user-defined, so nothing else can tell you their names.
Get App
app-get The full definition of one Podio app: configuration, field schema, rights and owner. The app token Podio includes in this response is removed before it is returned.
List Apps in Workspace
app-list Every visible Podio app (record type) in a workspace, with its id and basic configuration. Use Get App Fields for one app's field schema.
Add Comment
comment-add Post a comment on an item, task or other Podio object. Notifies the object's subscribers without changing any field value.
List Comments
comment-list Comments on an item, task or other Podio object, oldest first — so the newest comment is the last element, not the first.
Attach File
file-attach Attach a file that already exists in Podio to an item, comment, task, status or workspace. This app does not upload files — see the README.
Get File
file-get One file's metadata and its download, permalink and thumbnail URLs. Returns links, not bytes — and those links are authenticated, so a service outside Podio cannot follow them.
Create Webhook
hook-create Register a webhook on an app or workspace. The hook is created INACTIVE — run Request Webhook Verification next, then have your endpoint validate the code Podio sends it.
Delete Webhook
hook-delete Remove a webhook. Podio's reference does not mark this operation as available under App Authentication, unlike creating and listing hooks.
List Webhooks
hook-list The webhooks on one app or workspace, with each hook's status. A hook reading “inactive” has not completed verification and is delivering nothing.
Request Webhook Verification
hook-verify-request Ask Podio to send the verification code to a webhook's URL. Your endpoint must then POST that code back to Podio's validate endpoint to activate the hook.
Count Items
item-count How many items in an app match a saved view or a set of filters, without fetching them. Filters here are query-string style, not the nested form Filter Items takes.
Create Item
item-create Add an item to a Podio app. Field values are supplied as a JSON object keyed by field external id — run Get App Fields to see the keys and their sub_ids.
Delete Item
item-delete Permanently delete an item. Podio keeps no copy and publishes no restore endpoint — the item cannot be retrieved afterwards.
Filter Items
item-filter List the items of an app, optionally narrowed by field filters and sorted. Podio cannot filter text fields here — use Search in App for text.
Get Item
item-get One item, with its field values in Podio's own array-of-fields shape (nothing is flattened, so no sub-value is lost), plus its app, revisions and comments.
Get Item by External ID
item-get-by-external-id Find an item by the external id you set on it. Podio does not enforce uniqueness — if two items share an external id it returns an arbitrary one. 404s when nothing matches.
Update Item
item-update Change field values on an item. Only the fields you include are touched; an empty array clears a field. Pass a revision to fail rather than overwrite a concurrent edit.
Get Item Values
item-values-get Just the field values of one item, without the item envelope, revisions or comments. Cheaper than Get Item when only the data matters.
List Organizations
org-list Every organization the connected user belongs to, each with the workspaces they are a member of. Needs a user connection — an app connection has no user.
Get Granted Scope
scope-get What this connection may reach and with which permissions — the references the user picked on Podio's consent screen, or the single app an app connection is locked to.
Search in App
search-app Full-text search across one app's items and tasks. This is how you match on text — Filter Items cannot filter text fields. Returns hits (id, title, link), not values.
Search in Workspace
search-space Full-text search across a whole workspace — items, statuses and non-private tasks — newest activity first. Private tasks are excluded and are not reported as omitted.
Get Workspace
space-get One workspace, including its privacy setting and the rights the connected identity holds on it.
List Workspaces
space-list Every workspace (the API calls it a space) in one organization. Broader than the spaces inlined on List Organizations, which are only the ones you are a member of.
Complete Task
task-complete Mark a task complete. If the task recurs, Podio creates the next occurrence and returns its id — check that field before completing tasks in a loop.
Create Task
task-create Create a Podio task, optionally attached to an item or other object. Responsible parties can be given by user id or by email address.
Get Task
task-get One task in full: description, responsible, due date, labels, files, its reference to an item, and the completion audit trail.
List Tasks
task-list Tasks matching a set of filters. Leaving “Completed” unset returns both open and completed tasks; set View to full for descriptions, files and labels.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Podio's real ids.
{
"manifestVersion": "2",
"name": "podio-example",
"steps": [
{
"id": "app-fields-list",
"uses": {
"app": "io.w6w.podio",
"action": "app-fields-list",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"appId": "<appId>"
}
}
]
}Here are some of the things you can do
-
Get App Fields
readapp-fields-list -
Get App
readapp-get -
List Apps in Workspace
readapp-list -
Add Comment
performcomment-add -
List Comments
readcomment-list
+24 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Podio, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Podio. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "item-create",
payload: {
appId: "<value>",
fields: "<value>",
// externalId: "<value>",
// tags: "<value>",
// fileIds: "<value>",
// hook: "<value>",
// silent: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action item-create --payload '{"appId":"<value>","fields":"<value>"}'Give an AI agent Podio — without giving it Podio's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.podio#app-fields-list",
"input": {
"appId": "<appId>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Podio connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Podio's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Podio itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Podio declares its own checks, so its health is a property of the app rather than something the host guesses at.
Podio platform status
Component status from status.podio.com. Covers the API, the web app, email, and the two Advanced Workflow Automation components.
Podio API reachable
Unauthenticated probe of api.podio.com. A schema-correct 401 is a PASS — it proves the API host resolves and Podio's own error handler answered. Whether a credential works is the auth checks' job.
Request quota headroom
Reads Podio's X-Rate-Limit-Limit / X-Rate-Limit-Remaining headers off a scope read. The header names come from Podio's own PHP client — its API reference documents no rate limits at all. Reports unknown, never ok, when the headers are absent.