Create todo

Creates a new todo.

Note: This endpoint requires a user-scoped OAuth token. A pure client_credentials token without user context is rejected with 400 invalid_request.

Request

POST /api/oauth/v2/resource/todos

Header

Header	Value
Authorization	Bearer {access_token}
Content-Type	application/json

Body parameters

Field	Type	Required	Description
name	string	Yes	Title of the todo
description	string	No	Description
priority	string	No	Priority (low, medium, normal, high, critical; default: normal)
dueDate	string	No	Due date (YYYY-MM-DD or ISO 8601 timestamp, offset optional, see note)
customerUuid	string	No	UUID of the assigned customer. Additionally requires the customers scope
assignedToUuid	string	No	UUID of the assigned user. Additionally requires the users scope
statusUuid	string	No	UUID of the status. See Get statuses for available statuses. If omitted, the todo automatically gets the company's status of type open (or the first configured status if none has type open)
tagUuids	array (string)	No	UUIDs of the assigned tags

Note: dueDate is a day. You send YYYY-MM-DD or an ISO 8601 timestamp. The offset is optional; without an offset the server time zone applies. A timestamp counts for the day it falls on in the server time zone, not the client's: during daylight saving time (+02:00), 2026-06-10T23:30:00Z becomes June 11. The time of day is discarded. The returned value always carries the start of the day (00:00:00). An impossible date such as 2026-02-31 returns 400 validation_error.

Response

Success (201 Created)

{
  "data": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "number": "A-0001",
    "name": "Call back patient",
    "description": "Call back about rescheduling the appointment",
    "priority": "normal",
    "dueDate": "2026-06-10T00:00:00+02:00",
    "status": "c3d4e5f6-a7b8-9012-cdef-345678901234",
    "tags": ["e5f6a7b8-9012-3456-ef01-567890123456"],
    "assignedTo": "d4c5b6a7-8901-2345-6789-0abcdef12345",
    "customer": "f0e1d2c3-b4a5-6789-fedc-ba9876543210",
    "createdAt": "2026-06-01T08:15:00+02:00",
    "updatedAt": "2026-06-01T08:15:00+02:00",
    "createdBy": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
    "updatedBy": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
    "deleted": false,
    "deletedAt": null
  }
}

Response fields

See Get todo for the full field description.

Beispiele

bash

curl -X POST "https://my.offisy.at/api/oauth/v2/resource/todos" \
  -H "Authorization: Bearer {access_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Muster GmbH",
    "description": "beispiel",
    "priority": "normal",
    "dueDate": "2026-04-15T10:00:00",
    "customerUuid": "b2c3d4e5-f6a7-8901-bcde-f01234567890",
    "assignedToUuid": "b2c3d4e5-f6a7-8901-bcde-f01234567890",
    "statusUuid": "b2c3d4e5-f6a7-8901-bcde-f01234567890",
    "tagUuids": "b2c3d4e5-f6a7-8901-bcde-f01234567890"
  }'

Server

Client-ID

Client-Secret

Parameter

name *string

description string

priority string

dueDate string

customerUuid string

assignedToUuid string

statusUuid string

tagUuids string

Zuerst Token anfordern

Possible errors

Status	Code	Description
400	validation_error	Invalid request data (e.g. name missing)
400	validation_error	priority contains an invalid value (true or 1 are invalid too)
400	validation_error	dueDate is neither a valid date nor a valid ISO 8601 timestamp (Invalid dueDate. Expected a date (YYYY-MM-DD) or an ISO 8601 timestamp.)
400	validation_error	assignedToUuid must belong to the same company as the todo.
400	validation_error	tagUuids must belong to the same company as the todo: <uuid>
400	validation_error	statusUuid must belong to the same company as the todo.
400	invalid_request	Access token without user context
401	invalid_client	Invalid or missing access token
403	insufficient_scope	Scope todos not present, or customerUuid/assignedToUuid used without the additionally required customers/users scope
403	access_denied	The owning user of your API access does not have permission to create todos in the OAuth client's company (error_description: Insufficient permission for this resource.)
404	not_found	statusUuid is not a valid UUID, or one of the UUIDs in tagUuids is not a valid UUID