OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Task reads return structured records with selectable fields.
Get multiple tasks ↗
Filtered task records · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Collections support pages of up to 100 records.
Get multiple tasks ↗
limit and offset · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Project, assignee and modified_since filters are documented.
Get multiple tasks ↗
Query parameters · Checked 2026-10-16
Access cost barrier 10.0/10
Access is free, or included in the lowest paid plan with no fixed access fee; published usage-only charges are eligible
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Free and paid domains have API budgets, establishing a route without a higher-plan access requirement.
Asana rate limits ↗
Standard rate limits · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility 10.0/10
Customer authorization without discretionary provider approval
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
The customer controls credentials or authorizes the application within existing resource permissions.
Asana authentication ↗
Customer token authorization · Checked 2026-10-16
Downstream permission -
-
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Applicable third-party processing, AI use and redistribution terms remain unresolved.
Asana authentication ↗
Reviewed route documentation; downstream contractual scope unresolved · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface 7.5/10
Create and update in one business domain
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Task creation uses tasks:write and user-authorized fields.
Create a task ↗
Required scope and request body · Checked 2026-10-16
Update a task ↗
Update task operation · Checked 2026-10-16
Custom application path 10.0/10
Customer applications using fixed APIs without provider selection
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Customers can connect an application using the documented token route.
Asana authentication ↗
Customer application authentication · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism 7.5/10
Documented updated-since filters or webhooks
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Resource event polling advances a sync token.
Get events on a resource ↗
sync parameter · Checked 2026-10-16
Limit visibility 10.0/10
Published numeric quotas and recovery instructions
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Per-token limits are 150 requests/minute for free domains and 1,500 for paid; 429 supplies Retry-After.
Asana rate limits ↗
Standard and concurrent rate limits · Checked 2026-10-16
CDC and deletion capture 7.5/10
Updates and deletion identities documented for the stated resources
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Changed and deleted events include resource identity; exceptional omissions remain possible.
Asana Events and sync tokens ↗
Event.action and resource.gid · Checked 2026-10-16
Replay and gap recovery 7.5/10
Replay/change queries within a documented retention window
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Events remain retrievable for 24 hours; tokens may expire earlier and 412 signals a required re-crawl.
Asana Events and sync tokens ↗
Sync tokens · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Structured files or API records can be held outside the provider.
Asana project importing and exporting ↗
Customer download route · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
The export guide does not establish a contractual post-cancellation retrieval window.
Asana project importing and exporting ↗
Reviewed export route; cancellation rights unresolved · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Project JSON/CSV supplies portable records; attachment bytes and full history are unverified.
Asana project importing and exporting ↗
Exporting projects · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 2.5/10
External integration code; native business logic portability not established
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
External customer code can call the documented API; native logic portability is not established.
Asana authentication ↗
Customer API integration · Checked 2026-10-16
Rights to custom logic -
-
Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route.
Ownership and reusable export of native workflow definitions require a separate contractual review.
Asana authentication ↗
Reviewed route documentation; artifact rights unresolved · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
Personal tokens act with the creating user’s permissions. OAuth lets each user authorize an application; administrative controls and resource access still apply.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
Task collections support project and assignee filters, modified_since and offset pagination. Compact responses require explicit optional fields; subtasks need their own traversal.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| Customer personal API token | API key | Customer | No | Customer-supplied credentials | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
The API documents limits for both free and paid domains. Enterprise export and service-account entitlements are separate from the assessed user-token route.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
Task creation is documented through REST with tasks:write. Writes remain constrained by the authorizing user and object permissions.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Events identify changed, deleted and undeleted resources. Tokens expire within 24 hours and can expire sooner; a 412 response requires a new token and potentially a fresh crawl.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | Updates and deletion identities documented for the stated resourcesAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Changed and deleted events include resource identity; exceptional omissions remain possible. | Asana Events and sync tokens ↗Event.action and resource.gidChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Replay/change queries within a documented retention windowAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Events remain retrievable for 24 hours; tokens may expire earlier and 412 signals a required re-crawl. | Asana Events and sync tokens ↗Sync tokensChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Projects can be downloaded as JSON or CSV, and task responses can be retained outside Asana. These routes do not establish complete attachments, history or organization recovery.
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
External applications can implement their own logic using tasks and events. Native automation ownership and reusable export remain unresolved (the API contract alone does not settle artifact rights).
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Task reads return structured records with selectable fields. | Get multiple tasks ↗Filtered task recordsChecked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Collections support pages of up to 100 records. | Get multiple tasks ↗limit and offsetChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Project, assignee and modified_since filters are documented. | Get multiple tasks ↗Query parametersChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | Customer authorization without discretionary provider approvalAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. The customer controls credentials or authorizes the application within existing resource permissions. | Asana authentication ↗Customer token authorizationChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | Access is free, or included in the lowest paid plan with no fixed access fee; published usage-only charges are eligibleAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Free and paid domains have API budgets, establishing a route without a higher-plan access requirement. | Asana rate limits ↗Standard rate limitsChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | -Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Applicable third-party processing, AI use and redistribution terms remain unresolved. | Asana authentication ↗Reviewed route documentation; downstream contractual scope unresolvedChecked 2026-10-16 |
| Which external write operations are documented? | Create and update in one business domainAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Task creation uses tasks:write and user-authorized fields. | Create a task ↗Required scope and request bodyChecked 2026-10-16 Update a task ↗Update task operationChecked 2026-10-16 |
| How can customers connect an application they build or choose? | Customer applications using fixed APIs without provider selectionAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Customers can connect an application using the documented token route. | Asana authentication ↗Customer application authenticationChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | Documented updated-since filters or webhooksAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Resource event polling advances a sync token. | Get events on a resource ↗sync parameterChecked 2026-10-16 |
| How are integration limits disclosed? | Published numeric quotas and recovery instructionsAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Per-token limits are 150 requests/minute for free domains and 1,500 for paid; 429 supplies Retry-After. | Asana rate limits ↗Standard and concurrent rate limitsChecked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Structured files or API records can be held outside the provider. | Asana project importing and exporting ↗Customer download routeChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. The export guide does not establish a contractual post-cancellation retrieval window. | Asana project importing and exporting ↗Reviewed export route; cancellation rights unresolvedChecked 2026-10-16 |
| How can customers define their own business logic? | External integration code; native business logic portability not establishedAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. External customer code can call the documented API; native logic portability is not established. | Asana authentication ↗Customer API integrationChecked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -Asana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Ownership and reusable export of native workflow definitions require a separate contractual review. | Asana authentication ↗Reviewed route documentation; artifact rights unresolvedChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedAsana / customer-authorized task and project REST APIs, resource Events API and project JSON/CSV downloads; enterprise organization exports are outside the assessed route. Project JSON/CSV supplies portable records; attachment bytes and full history are unverified. | Asana project importing and exporting ↗Exporting projectsChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- Applicable downstream processing, AI-use and redistribution terms
- Contractual retrieval rights after cancellation
- Ownership and reusable export of native workflow artifacts
- Complete attachment, history and configuration migration
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.