# init.Tasks API

> The public REST API and MCP server for init.Tasks. Task data is end-to-end encrypted: the server stores ciphertext and cannot read titles, notes, tags or dates.

Machine contract: https://api.inittasks.com/openapi.json  (servers[0] is https://api.inittasks.com/v1)

## Start

- [init.Tasks API](https://devs.inittasks.com/index.md): build on task data the server cannot read
- [Quickstart](https://devs.inittasks.com/quickstart.md): a key, a curl, your first to-do

## Guides

- [Authentication](https://devs.inittasks.com/authentication.md): tokens, the approval flow, scopes
- [Encryption](https://devs.inittasks.com/encryption.md): what the server sees, and what a grant hands over
- [Webhooks](https://devs.inittasks.com/webhooks.md): thin events, verified signatures, and honest delivery guarantees
- [MCP](https://devs.inittasks.com/mcp.md): connect Claude, ChatGPT, Cursor and friends

## Reference

- [API reference](https://devs.inittasks.com/reference.md): 70 routes, generated from openapi.json
- [/attachments](https://devs.inittasks.com/reference/attachments.md): 6 routes
- [/containers](https://devs.inittasks.com/reference/containers.md): 8 routes
- [/filters](https://devs.inittasks.com/reference/filters.md): 6 routes
- [/grants](https://devs.inittasks.com/reference/grants.md): 2 routes
- [/inbox](https://devs.inittasks.com/reference/inbox.md): 6 routes
- [/keys](https://devs.inittasks.com/reference/keys.md): 3 routes
- [/me](https://devs.inittasks.com/reference/me.md): 1 routes
- [/search](https://devs.inittasks.com/reference/search.md): 1 routes
- [/sessions](https://devs.inittasks.com/reference/sessions.md): 2 routes
- [/settings](https://devs.inittasks.com/reference/settings.md): 2 routes
- [/tags](https://devs.inittasks.com/reference/tags.md): 4 routes
- [/todos](https://devs.inittasks.com/reference/todos.md): 12 routes
- [/trash](https://devs.inittasks.com/reference/trash.md): 2 routes
- [/views](https://devs.inittasks.com/reference/views.md): 6 routes
- [/webhooks](https://devs.inittasks.com/reference/webhooks.md): 9 routes

## Errors

- [unauthorized](https://devs.inittasks.com/errors/unauthorized.md): HTTP 401
- [grant_revoked](https://devs.inittasks.com/errors/grant_revoked.md): HTTP 401
- [grant_expired](https://devs.inittasks.com/errors/grant_expired.md): HTTP 401
- [forbidden_scope](https://devs.inittasks.com/errors/forbidden_scope.md): HTTP 403
- [not_found](https://devs.inittasks.com/errors/not_found.md): HTTP 404
- [duplicate_id](https://devs.inittasks.com/errors/duplicate_id.md): HTTP 409
- [conflict](https://devs.inittasks.com/errors/conflict.md): HTTP 409
- [payload_too_large](https://devs.inittasks.com/errors/payload_too_large.md): HTTP 413
- [unsupported_media_type](https://devs.inittasks.com/errors/unsupported_media_type.md): HTTP 415
- [validation_failed](https://devs.inittasks.com/errors/validation_failed.md): HTTP 422
- [account_too_large](https://devs.inittasks.com/errors/account_too_large.md): HTTP 422
- [rate_limited](https://devs.inittasks.com/errors/rate_limited.md): HTTP 429
- [internal](https://devs.inittasks.com/errors/internal.md): HTTP 500

## Meta

- [Rate limits](https://devs.inittasks.com/rate-limits.md): the buckets, the headers, and how to behave
- [Versioning](https://devs.inittasks.com/versioning.md): what can change under you, and how you find out
- [Changelog](https://devs.inittasks.com/changelog.md): additive changes ship without a bump