API reference

Base URL https://api.inittasks.com/v1. Every route below is generated from openapi.json at build time. It is the same document the server serves, rendered from the schemas that validate the requests. If a page here disagrees with the server, the page is a build artefact of an older deploy; the document wins.

Resources

• /attachment-places, 1 route
• /attachments, 10 routes
• /containers, 8 routes
• /export, 1 route
• /filters, 8 routes
• /grants, 3 routes
• /headings, 7 routes
• /inbox, 10 routes
• /keys, 4 routes
• /link-title, 1 route
• /me, 1 route
• /note-folders, 8 routes
• /note-links, 1 route
• /note-note-links, 1 route
• /note-places, 1 route
• /note-versions, 1 route
• /notes, 22 routes
• /search, 1 route
• /sessions, 3 routes
• /settings, 2 routes
• /tags, 7 routes
• /todos, 18 routes
• /trash, 2 routes
• /views, 11 routes
• /webhooks, 9 routes

Conventions

• Every response carries X-Request-Id, and Link: <…/openapi.json>; rel="service-desc".
• /oauth/*, /.well-known/*, /healthz and /openapi.json sit at the HOST root (https://api.inittasks.com), not under /v1. They are not versioned data.
• Lists are cursor-paged: ?limit= (default 50, max 200) and ?cursor=. next_cursor is always present on a paged list; follow it until it comes back null. Only GET /v1/webhooks is unpaged and omits the key. Do not construct or parse a cursor.
• ⚠ Request bodies reject unknown fields. A row you read back carries server-owned fields a PATCH will not accept, so GET-then-PATCH round-tripping fails. Send only the fields you are changing.
• ?updated_since= takes an RFC 3339 instant and filters on the server-side update time.
• Writes accept Idempotency-Key. The same key with the same body replays the original response for 24 hours; with a different body it is a conflict.