# API reference

Base URL **`https://api.inittasks.com/v1`**. Every route below is generated from [openapi.json](https://api.inittasks.com/openapi.json) at build time — the same document the server serves, rendered from the schemas that validate the requests. If a page here disagrees with the server, the page is a build artefact of an older deploy; the document wins.

## Resources

- [/attachments](/reference/attachments) — 6 routes
- [/containers](/reference/containers) — 8 routes
- [/filters](/reference/filters) — 6 routes
- [/grants](/reference/grants) — 2 routes
- [/inbox](/reference/inbox) — 6 routes
- [/keys](/reference/keys) — 3 routes
- [/me](/reference/me) — 1 routes
- [/search](/reference/search) — 1 routes
- [/sessions](/reference/sessions) — 2 routes
- [/settings](/reference/settings) — 2 routes
- [/tags](/reference/tags) — 4 routes
- [/todos](/reference/todos) — 12 routes
- [/trash](/reference/trash) — 2 routes
- [/views](/reference/views) — 6 routes
- [/webhooks](/reference/webhooks) — 9 routes

## Conventions

- Every response carries `X-Request-Id`, and `Link: <…/openapi.json>; rel="service-desc"`.
- `/oauth/*`, `/.well-known/*`, `/healthz` and `/openapi.json` sit at the HOST root (https://api.inittasks.com), not under `/v1` — they are not versioned data.
- Lists are cursor-paged: `?limit=` (default 50, max 200) and `?cursor=`. Follow `next_cursor` until it is absent; do not construct cursors.
- `?updated_since=` takes an RFC 3339 instant and filters on the server-side update time.
- Writes accept `Idempotency-Key`. The same key with the same body replays the original response for 24 hours; with a different body it is a `conflict`.