feat(clickup): ClickUp integration — 23 tools, OAuth + API-token auth, attachment upload by waleedlatif1 · Pull Request #5702 · simstudioai/sim

waleedlatif1 · 2026-07-16T03:06:19Z

Summary

New ClickUp integration: 23 tools covering tasks (create/get/update/delete/list/search with status/assignee/tag/due-date filters), comments (create/get/update/delete), attachment upload, tags, task/list members, custom fields, and the workspace → space → folder → list hierarchy (incl. create folder/list)
OAuth provider wiring (authorization-code flow via https://app.clickup.com/api, redirect /api/auth/oauth2/callback/clickup; ClickUp issues non-expiring tokens with no refresh tokens, so the refresh path is intentionally unreachable) + clickup-service-account token-paste credential for personal pk_ API tokens, mirroring the Linear setup
Shared clickupAuthorizationHeader helper sends pk_ tokens bare and OAuth tokens as Bearer, per ClickUp's documented auth — used by tools, the upload route, and the token validator alike
Attachment upload follows the internal-route file pattern (contract-validated /api/tools/clickup/upload-attachment, processFilesToUserFiles → assertToolFileAccess → multipart attachment field, 100MB cap, returns UserFiles for downstream blocks)
Block with per-operation subBlocks (canonical credential + file params, timestamp wand configs, advanced-mode filters), BlockMeta templates/skills, gradient brand icon on white, generated docs page + hand-written service-account guide (shielded from doc-generation cleanup)
Every endpoint, param, and response field was cross-checked against the official ClickUp API v2 reference; unverifiable fields (e.g. custom-field required) were dropped rather than guessed. custom_task_ids/team_id custom-ID addressing is intentionally out of scope for this round.

Type of Change

New feature

Testing

Typecheck, check:api-validation, check:bare-icons, and docs generation all pass; tool/block/OAuth wiring audited against the ClickUp API docs. Needs a live OAuth app (client ID/secret) for end-to-end verification.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…3 tools, block, and attachment upload - 23 tools covering tasks (create/get/update/delete/list/search), comments (create/get/update/delete), attachment upload, tags, members, custom fields, and the workspace/space/folder/list hierarchy - OAuth provider wiring (authorization-code flow, non-expiring tokens) plus clickup-service-account token-paste credential (personal pk_ API tokens), with a shared clickupAuthorizationHeader helper (pk_ tokens sent bare, OAuth tokens as Bearer) - File upload follows the internal-route pattern: contract-validated /api/tools/clickup/upload-attachment builds the multipart form and returns UserFiles - ClickUp block with per-operation subBlocks, canonical file param, BlockMeta templates/skills, and gradient brand icon - Generated integration docs page + hand-written service-account guide

…pload route - Map documented task fields that were dropped: markdown_description, subtasks, watchers, custom_fields, time_spent, folder, space — making the include_subtasks / include_markdown_description options observable - Expand verified filters: assignees/tags/due-date ranges on get_tasks and search_tasks, include_closed on search_tasks; add due_date_time / start_date_time flags and update-task assignee add/remove - Guard update_comment against an empty body and require comment text in the block; prefer markdown_content over content on create_list and make markdown reachable for lists in the UI - Drop the unverified 'required' field from custom-field outputs; read both err and error keys from ClickUp error bodies; correct notify_all wording - Upload route: 100MB size cap, shared attachment mapper with full documented response fields (version, thumbnails), base-URL constant

…oc generation The generator prunes integration pages it does not derive from blocks; add the hand-written ClickUp API-token guide to HANDWRITTEN_INTEGRATION_DOCS so regeneration cannot delete it.

vercel · 2026-07-16T03:06:26Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 16, 2026 7:09am

waleedlatif1 · 2026-07-16T03:06:30Z

@greptile

cursor · 2026-07-16T03:06:30Z

PR Summary

Medium Risk
Large new surface area (OAuth, stored API tokens, file upload proxy) with workflows able to mutate external ClickUp data; patterns match existing integrations but live OAuth E2E is still pending per PR notes.

Overview
Adds a ClickUp productivity integration end-to-end: workflow block with 38 operations (tasks, comments, attachments, tags, custom fields, checklists, time tracking, and workspace hierarchy), matching tool implementations against ClickUp API v2, and user-facing docs.

Auth: OAuth provider (CLICKUP_CLIENT_* env, callback, user info) plus clickup-service-account for personal pk_ tokens, validated via /user using shared clickupAuthorizationHeader (bare pk_, Bearer for OAuth).

Attachments: Dedicated /api/tools/clickup/upload-attachment route with file access checks, 100MB limit, and multipart proxy to ClickUp.

Also registers the block, icons, integrations catalog entry, and BlockMeta templates/skills.

^{Reviewed by Cursor Bugbot for commit 33caff5. Configure here.}

waleedlatif1 · 2026-07-16T03:06:31Z

@cursor review

greptile-apps · 2026-07-16T03:09:46Z

Greptile Summary

This PR adds a full ClickUp integration to Sim. The main changes are:

ClickUp tools for tasks, comments, hierarchy, custom fields, checklists, timers, tags, members, and attachments.
OAuth and personal API-token authentication.
A protected attachment-upload route with file access checks and a 100 MB limit.
ClickUp block configuration, icons, registry wiring, and documentation.

Confidence Score: 5/5

This looks safe to merge.

The attachment download limit is enforced before an oversized stored file is fully buffered.
Explicit false date flags now reach ClickUp correctly.
List operations require the identifier for the selected parent type.
Assignee-only and resolved-state-only comment updates remain supported.
No blocking issues were found in the updated code.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/clickup/upload-attachment/route.ts	Adds authenticated attachment upload with file authorization, bounded storage downloads, multipart forwarding, and ClickUp error handling.
apps/sim/blocks/blocks/clickup.ts	Defines ClickUp operations, conditional configuration fields, authentication inputs, and tool parameter mappings.
apps/sim/tools/clickup/update_comment.ts	Supports independent comment text, assignee, and resolved-state updates while rejecting empty requests.

_{Reviews (13): Last reviewed commit: "fix(clickup): reject empty update_task b..." | Re-trigger Greptile}

greptile-apps · 2026-07-16T03:09:48Z

Greptile Summary

This PR adds a full ClickUp integration to Sim. The main changes are:

Twenty-three tools for tasks, comments, tags, members, custom fields, and workspace hierarchy.
OAuth and personal API-token authentication.
An internal attachment-upload route with file access checks.
ClickUp block configuration, registry wiring, icons, and documentation.

Confidence Score: 4/5

The list-operation validation bug should be fixed before merging; the upload limit and documentation navigation also need cleanup.

List operations can reach execution without either required parent identifier.
Oversized resolved files can consume memory before the upload limit rejects them.
Both ClickUp documentation links are registered twice.
Authentication headers, source-file ownership checks, and most tool parameter mappings are consistent.

apps/sim/blocks/blocks/clickup.ts, apps/sim/app/api/tools/clickup/upload-attachment/route.ts, apps/docs/content/docs/en/integrations/meta.json

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/clickup/upload-attachment/route.ts	Adds an authenticated upload proxy with file ownership and size checks, but oversized content is fully buffered before the final limit is enforced.
apps/sim/blocks/blocks/clickup.ts	Defines the ClickUp block and operation mappings, but list operations can be configured without either required parent identifier.
apps/sim/tools/clickup/shared.ts	Adds shared authorization, response mapping, and error extraction used consistently across the ClickUp tools.
apps/sim/lib/credentials/token-service-accounts/validators/clickup.ts	Adds personal-token validation through ClickUp's user endpoint with explicit credential and provider failure handling.
apps/docs/content/docs/en/integrations/meta.json	Registers the ClickUp documentation pages twice, producing duplicate navigation entries.

_{Reviews (1): Last reviewed commit: "fix(docs): restore clickup-service-accou..." | Re-trigger Greptile}

…g-time list parent validation, upload memory cap, unique icon gradient ids - Remove duplicated clickup entries in docs meta.json and integrations.json introduced by a double docs regeneration - Add a Location dropdown for Get Lists / Create List so the folder ID or space ID is conditionally required at configuration time instead of failing at run time - Pass the 100MB cap into downloadServableFileFromStorage so oversized files abort during download instead of after full buffering - Use useId()-derived SVG gradient ids for ClickUpIcon in both icon files

waleedlatif1 · 2026-07-16T03:20:44Z

@greptile

waleedlatif1 · 2026-07-16T03:20:45Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d0fbad1. Configure here.}

waleedlatif1 · 2026-07-16T03:42:34Z

@greptile

…and block - create_task: add doc-backed sprint points param (parity with update) - get_tasks/search_tasks: expose include_markdown_description - update_task legacy numeric priority in list responses mapped instead of dropped; create_comment omits absent response fields instead of emitting sentinel ''/0 values - order_by only sent when explicitly chosen (Default sentinel); comment text no longer UI-required for update_comment (resolve-only and assignee-only updates are valid per the tool contract, which still rejects an empty body) - add_tag_to_task sends no request body per docs; upload tool tolerates non-JSON error responses

waleedlatif1 · 2026-07-16T05:05:47Z

@greptile

waleedlatif1 · 2026-07-16T05:05:48Z

@cursor review

The task/list member endpoints document a flat member object; accept the workspace-members-style nested { user: {...} } wrapper as well so both shapes map correctly.

waleedlatif1 · 2026-07-16T05:18:40Z

@greptile

waleedlatif1 · 2026-07-16T05:18:41Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 09da11f. Configure here.}

waleedlatif1 · 2026-07-16T06:03:23Z

@greptile

waleedlatif1 · 2026-07-16T06:03:25Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 35c8490. Configure here.}

…, tolerant time-entry envelopes, richer mappings - Set Custom Field Value uses POST per the live reference OpenAPI (the llms mirror shows PUT; the reference console spec is authoritative) - delete_time_entry maps the documented array envelope; create_time_entry tolerates both data-wrapped and flat echo bodies - Time entries surface task_tags and task_location so the include switches are observable; checklists carry date_created - Custom field value input parses any JSON literal (numbers, booleans, arrays, objects) and passes plain text through - Update Time Entry supports duration edits; single-assignee time ops get their own field so a comma-separated list can't silently NaN out

waleedlatif1 · 2026-07-16T06:14:36Z

@greptile

waleedlatif1 · 2026-07-16T06:14:37Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8af98b5. Configure here.}

The due/start date-time switches previously only transmitted true; a timed date could never be flipped back to date-only. The flag is now sent as an explicit boolean whenever the corresponding date is provided and omitted otherwise.

waleedlatif1 · 2026-07-16T06:45:32Z

@greptile

waleedlatif1 · 2026-07-16T06:45:33Z

@cursor review

…ildren, tolerant comment date - Checklist items surface the documented children array of nested item IDs - create_comment tolerates a string-typed date in the response

waleedlatif1 · 2026-07-16T06:55:50Z

@greptile

waleedlatif1 · 2026-07-16T06:55:51Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

2 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4aa17bf. Configure here.}

…r, matching sibling update tools

waleedlatif1 · 2026-07-16T07:09:24Z

@greptile

waleedlatif1 · 2026-07-16T07:09:25Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 33caff5. Configure here.}

waleedlatif1 · 2026-07-16T07:17:16Z

@greptile

waleedlatif1 added 3 commits July 15, 2026 20:04

fix(docs): restore clickup-service-account guide and shield it from d…
ca53128
…oc generation The generator prunes integration pages it does not derive from blocks; add the hand-written ClickUp API-token guide to HANDWRITTEN_INTEGRATION_DOCS so regeneration cannot delete it.