Create reference

Links a todo to another record.

Note: This endpoint requires a user-bound OAuth token. A plain client_credentials token without a bound user is rejected with 400 invalid_request.

Note: The call is idempotent. If the target is already linked, no duplicate is created — the response returns the existing reference with 200 OK instead of 201 Created.

Note: The check that the target record belongs to the same company only applies when creating new references. Existing references to records of another company — for example created through the Offisy interface — remain readable via GET and can still be removed via DELETE.

Request

POST /api/oauth/v2/resource/todos/{uuid}/references

Header

Header	Value
Authorization	Bearer {access_token}
Content-Type	application/json

URL parameters

Parameter	Type	Required	Description
uuid	string	Yes	Unique todo ID

Body parameters

Field	Type	Required	Description
type	string	Yes	Type of the target (see Required scopes)
uuid	string	Yes	UUID of the target record

Required scopes

In addition to todos, the target's own scope is required. All 24 types are readable and writable.

Additional scope	type values
medicals	MedicalDiagnosis, MedicalDoctorLetter, MedicalPatientLetter, MedicalExternalLetter, MedicalEvidence, MedicalFile, MedicalHealthNotification, MedicalIllnessNotification, MedicalLabResult, MedicalMotherChildPass, MedicalPsychotherapy, MedicalReceipt, MedicalReferral, MedicalRegulation, MedicalSportsExemption, MedicalTransport, MedicalVisitConfirmation, FeeNoteService, Transmission, DVPReportEntry
notices	AdminCustomerNotice
customers	AdminCustomerValue
appointments	Appointment
invoices	Invoice

Response

Success (201 Created / 200 OK)

{
  "data": {
    "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "type": "MedicalDiagnosis",
    "target": "c3d4e5f6-a7b8-9012-cdef-234567890123"
  }
}

201 Created for a newly created reference, 200 OK if the target was already linked.

Response fields

See List references for the full field description of the object.

Beispiele

bash

curl -X POST "https://my.offisy.at/api/oauth/v2/resource/todos/b2c3d4e5-f6a7-8901-bcde-f01234567890/references" \
  -H "Authorization: Bearer {access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "beispiel",
    "uuid": "b2c3d4e5-f6a7-8901-bcde-f01234567890"
  }'

Server

Client-ID

Client-Secret

Parameter

uuid Pfad*string

type *string

uuid Body*string

Zuerst Token anfordern

Possible errors

Status	Code	Description
400	validation_error	type or uuid missing/blank, type is unsupported, or the todo is already deleted
400	validation_error	Target record belongs to a different company than the todo — a todo may only reference records of its own company (error_description: uuid must belong to the same company as the todo.)
400	invalid_request	Access token without user context
401	invalid_client	Invalid or missing access token
403	insufficient_scope	Scope todos or the scope belonging to type not present
404	not_found	Todo not found, uuid is not a valid UUID, or the target record does not exist, or the client is not permitted to see it