ClickUp Certification cheat sheet

A Workspace is the top-level container; every user, Space, and setting belongs to exactly one Workspace.

Hierarchy is Workspace > Space > Folder > List > Task > Subtask; Checklists live inside a task and are not schedulable.

A Space controls permissions and ClickApp availability; a Folder groups Lists; a List is the only level that holds tasks directly.

Roles in ascending privilege: Guest (limited, per-item), Member, Admin, Owner; only Owners can delete the Workspace or transfer ownership.

Guests can be restricted to specific tasks, Lists, or Folders and do not consume paid seats on most plans.

Views (List, Board, Calendar, Gantt, Table, Mind Map, Workload) are saved configurations of the same underlying tasks, not separate data.

Statuses are defined per Space or Folder and inherited by Lists; a task's status determines which status group (Not Started, Active, Done, Closed) it belongs to.

Custom Fields are defined at the Space or Folder level and appear on all Lists beneath; field types include drop-down, number, date, formula, and relationship.

An Agent is configured with a trigger (schedule, event, or manual), a set of permitted actions, and an underlying model.

Agent actions are scoped to the Workspace objects granted at setup; an Agent cannot act on Spaces or Lists it has not been given access to.

Scheduled Agents run on a cron-like cadence defined in Workspace time zone; event Agents fire on task created, status changed, or comment added.

Agent runs are logged with inputs, tool calls, and outputs; failed runs can be inspected and retried from the run history.

Agents can create and update tasks, post comments, assign users, and call connected integrations, but destructive bulk deletes require explicit permission.

An Agent's knowledge can include Workspace Docs, specific Lists, and connected external sources; unselected content is not passed to the model.

Human-in-the-loop approval can be required before an Agent executes write actions, gating the run until a reviewer approves.

Brain AI is invoked in-context: from a task, Doc, comment box, or the global AI assistant, and uses the surrounding object as context.

Brain can summarize a task or thread, draft content, translate, and answer questions grounded in Workspace content the user can already access.

AI answers respect the requesting user's permissions; Brain does not surface content from Spaces or items the user cannot view.

Brain can generate subtasks, checklists, and action items from a task description or a meeting transcript.

Standalone AI features (writing, summarization) are available on most plans; Brain agents and connected-knowledge features depend on plan tier.

Prompts and outputs are associated with the user and object; administrators can review AI usage and disable AI features at the Workspace level.

Brain does not train third-party foundation models on customer Workspace data; data handling is governed by the Workspace's configured AI settings.

ClickApps are modular features toggled per Space, Folder, or List; disabling one hides its UI and behavior for that location and its children.

Common ClickApps include Time Tracking, Dependencies, Custom Fields, Tags, Priorities, Reminders, and Multiple Assignees.

Dependencies link tasks as waiting-on or blocking; a blocking task's status change can notify or move the dependent task.

Automations are if-this-then-that rules scoped to a List, Folder, or Space; conditions include status change, field change, and due-date approach.

Automation actions include changing status, assigning, commenting, creating subtasks, and sending webhooks or emails.

Time Estimates and Time Tracking are separate: estimates are planned effort, tracked time is recorded against a timer or manual entry.

Custom Task IDs let a Space use its own prefix and numbering (for example DEV-142) instead of the default alphanumeric task ID.

Templates capture a List or Folder structure with tasks, fields, and automations and can be applied to new or existing locations.

Chat lives at the Workspace level and in Channels; a Channel can be public to the Workspace or private to invited members.

Chat messages can be converted into tasks, carrying the message text and a link back to the conversation.

Threads keep replies attached to a parent message; replies notify thread participants rather than the whole Channel.

Direct messages are one-to-one or small-group conversations separate from Channels and follow the same permission model.

Chat supports file attachments, mentions, reactions, and message editing; edits and deletions are visible in message history.

Chat notifications are configured separately from task notifications in personal notification settings.

Guests with Chat access can be limited to specific Channels; Chat membership does not automatically grant task access.

Native integrations include GitHub, GitLab, Slack, Google Drive, Zoom, and calendar sync; each is enabled per Workspace or per location.

A GitHub integration links commits and pull requests to tasks by referencing the task ID in the branch, commit, or PR title.

Slack integration posts task notifications to channels and lets users create tasks from Slack messages.

Email integration gives each List an address; emailing it creates a task with the subject as name and body as description.

Webhooks are outbound HTTP POSTs fired by automations or API events to a configured endpoint.

Zapier and Make connect ClickUp to thousands of apps using triggers and actions built on the public API.

Integrations authenticate with OAuth or a personal API token; revoking the token or app authorization stops the integration's access.

The ClickUp API is REST over HTTPS at api.clickup.com/api/v2; requests authenticate with a personal token or OAuth2 bearer token.

Personal API tokens are generated per user in Settings and inherit that user's permissions; they should be treated as secrets.

OAuth2 apps use client ID and secret, an authorization code flow, and scoped access; tokens can be revoked per app.

Rate limits are applied per token and per Workspace; exceeding them returns HTTP 429 with a retry-after header.

Core endpoints cover Workspaces (teams), Spaces, Folders, Lists, Tasks, Comments, Custom Fields, and Webhooks.

The MCP server exposes ClickUp operations as tools to MCP-compatible AI clients, authenticating with the same token model as the API.

Webhook subscriptions are created via the API with a target endpoint and event list; each delivery includes a signature for verification.

Pagination uses page and limit parameters; responses include the total count and the last page indicator.

The ClickUp mobile app is available for iOS and Android and syncs through the same Workspace data as the web app.

Mobile supports task creation, status changes, comments, attachments, and notifications; some admin and automation settings are web-only.

Offline changes are queued locally and synced when connectivity returns; conflicts resolve to the most recent server-side edit.

Push notifications are configured per device and per notification category, independent of email and in-app settings.

Widgets and quick-add let users capture tasks without opening the app; captures land in the default List set in preferences.

Mobile time tracking and timers are available where the Time Tracking ClickApp is enabled.

Biometric lock can be enabled on the device to protect app access without changing the account password.

Data is encrypted in transit with TLS and at rest with provider-managed encryption; enterprise tiers may offer customer-managed keys.

Two-factor authentication can be enforced at the Workspace level; SSO via SAML is available on higher tiers.

Permissions cascade: a user's effective access is the most permissive grant across Workspace role, Space membership, and item-level sharing.

Audit logs record administrative and security-relevant events and are available to Workspace Owners and Admins.

Data retention and deletion follow the Workspace's configured policy; deleted items go to Trash and are permanently removed after the retention window.

Personal data handling is described in the privacy policy and data processing agreement; subprocessors are listed and updated.

API tokens, OAuth secrets, and webhook signing secrets are credentials and must be rotated if exposed.