tag:devs.inittasks.com,2026:api-changelog 2026-09-15T00:00:00Z tag:devs.inittasks.com,2026-09-15:webhooks 2026-09-15T00:00:00Z Subscribe to thin events over `/webhooks`: create, rotate a secret with a 24-hour overlap, ping, read the last 100 deliveries, redeliver one. Events carry an id and a type, never the object — the server cannot read your content. There is deliberately no `todo.completed`: `status` is encrypted, so the server cannot tell a completion from a rename. Fetch the object and decide. Inbound is best-effort and at-most-once. Reconcile with `updated_since` polling. tag:devs.inittasks.com,2026-09-15:v1 2026-09-15T00:00:00Z The first public version: containers, to-dos, inbox, tags, attachments, filters, views, search, trash and settings, plus `/keys`, `/grants` and `/sessions`. Personal access tokens for your own scripts; OAuth 2.1 with PKCE and native approval for apps. Fine-grained scopes. RFC 9457 problem+json on every error. Cursor pagination in a stable order. `Idempotency-Key` on writes.