Summary
Since roughly 2026-08-28, POST/PATCH/DELETE requests to the Plane Cloud public API (https://api.plane.so/api/v1/...) are intermittently rejected with an HTTP 403 HTML page from Cloudflare ("Attention Required! | blocked"). GET requests succeed (HTTP 200). The block hits both plain curl and the official plane-mcp-server, so any programmatic/agent write access fails while reads work.
Repro (minimal)
- Generate a personal access token.
curl -I -X POST "https://api.plane.so/api/v1/workspaces/<slug>/projects/<id>/issues/" with a valid X-API-Key.- Response is
HTTP 403 with the Cloudflare challenge page (Attention Required! | blocked).
- The same request as
GET on /work-items/ returns HTTP 200.
Observed
- POST →
HTTP 403 (Cloudflare HTML challenge, not a Platform JSON error).
- GET →
HTTP 200.
- Waiting past the documented rate limit (60 req/min per key, per the docs) does NOT clear it — returns the CF 403 page, never the app-level
429.
- Occurs from multiple independent IPs and both
X-API-Key and Bearer auth.
Expected
A public API is always consumed by bots/scripts and authenticates via API key. Cloudflare bot-management/JS-challenge should not be applied to /api/v1/* (or should skip requests carrying a valid key). Abuse should be handled by the app-level rate limit (X-RateLimit-* headers / HTTP 429), which a programmatic client can handle — a Cloudflare JS challenge cannot be solved by an API client.
Impact
Breaks all programmatic write access to Plane Cloud (MCP server, scripts, agents) — the core use case of a public REST API.
Suggested fix
Exclude /api/v1/* from Cloudflare bot-management/JS challenge, or exempt requests with a valid X-API-Key. Alternatively, surface a machine-readable 429 instead of serving the CF HTML challenge on the API host.
Summary
Since roughly 2026-08-28, POST/PATCH/DELETE requests to the Plane Cloud public API (
https://api.plane.so/api/v1/...) are intermittently rejected with an HTTP 403 HTML page from Cloudflare ("Attention Required! | blocked"). GET requests succeed (HTTP 200). The block hits both plaincurland the officialplane-mcp-server, so any programmatic/agent write access fails while reads work.Repro (minimal)
curl -I -X POST "https://api.plane.so/api/v1/workspaces/<slug>/projects/<id>/issues/"with a validX-API-Key.HTTP 403with the Cloudflare challenge page (Attention Required! | blocked).GETon/work-items/returnsHTTP 200.Observed
HTTP 403(Cloudflare HTML challenge, not a Platform JSON error).HTTP 200.429.X-API-Keyand Bearer auth.Expected
A public API is always consumed by bots/scripts and authenticates via API key. Cloudflare bot-management/JS-challenge should not be applied to
/api/v1/*(or should skip requests carrying a valid key). Abuse should be handled by the app-level rate limit (X-RateLimit-*headers / HTTP 429), which a programmatic client can handle — a Cloudflare JS challenge cannot be solved by an API client.Impact
Breaks all programmatic write access to Plane Cloud (MCP server, scripts, agents) — the core use case of a public REST API.
Suggested fix
Exclude
/api/v1/*from Cloudflare bot-management/JS challenge, or exempt requests with a validX-API-Key. Alternatively, surface a machine-readable 429 instead of serving the CF HTML challenge on the API host.