Vision Developers
GET/api/todo/v1/tasks

view /api/todo/v1/tasks

The approved contract does not provide a longer purpose statement for this operation.

App
To Do
Contract
To Do module API 1.9.0
Lifecycle
preview
Runtime
restricted
Operation ID
mop_BDxdvVvD5ekZwSQs6wYvyyAQoTk9EqlG
Canonical origin
https://api.runonvision.com

Availability: This is a preview contract with runtime status restricted. Publication documents an approved interface; it does not imply public production access.

Purpose and use cases

view /api/todo/v1/tasks

The owning App is Vision To Do. To Do owns task data, domain rules, workspace authorization and command execution. Vision Core brokers human operation grants. Publishing this snapshot creates no new client grants or external access.

Business use cases and out-of-scope behavior are not yet declared in the approved OpenAPI description.

Request

GET https://api.runonvision.com/api/todo/v1/tasks

Authentication and authorization

Send a Vision-issued bearer token for the exact App audience. The token must include the todo entitlement and satisfy the explicit to do workspace bound to the authenticated identity binding.

  • Required scope: todo:tasks:read

Human roles are not declared in OpenAPI. Record-level and business permission checks remain the owning App's authority.

Headers

  • Authorization: Bearer <access-token> — required.
  • Accept: application/json — recommended where a JSON response is declared.

Undeclared tracing, idempotency, conditional-request, and version headers are not assumed on this page.

Path and query parameters

NameLocationTypeRulesDescription
statusquerystringoptional; maximum length 20; pattern ^(?:pending|in_progress|completed|cancelled)$Exact task lifecycle status filter.
sortquerystringoptional; maximum length 20; pattern ^(?:dueAt|priority|createdAt|title|assignee|updatedAt)$Allowlisted active-list sort key. Defaults to dueAt when omitted or unrecognized by the runtime.
dirquerystringoptional; maximum length 4; pattern ^(?:asc|desc)$Sort direction. Defaults to asc when omitted or unrecognized by the runtime.
scopequerystringoptional; maximum length 9; pattern ^(?:active|completed|archived)$Task pile: active, completed, or archived. Defaults to active.
limitquerystringoptional; maximum length 3; pattern ^(?:[1-9]|[1-9][0-9]|100)$Page size, an integer from 1 through 100. Defaults to 50 when omitted. Any other value is rejected with 400 INVALID_REQUEST and fieldIssues [{"path":"limit","code":"invalid_limit"}]; it is never clamped.
cursorquerystringoptional; maximum length 400; pattern ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$Opaque signed keyset cursor returned as nextCursor by the preceding page. It is bound to the scope and active-list sort. A malformed, tampered, or mismatched cursor is rejected with 400 INVALID_REQUEST and fieldIssues [{"path":"cursor","code":"invalid_cursor"}] (not retryable; restart from the first page).
viewquerystringoptional; maximum length 9; pattern ^(?:today|upcoming|overdue|doneToday)$Active-list smart date filter: today, upcoming, or overdue.
qquerystringoptional; maximum length 120Case-insensitive active-list title and description search.
groupquerystringoptional; maximum length 120Active-list group filter by exact list name.
groupByquerystringoptional; maximum length 8; pattern ^(?:list|priority|due)$Not described in the contract.
showDonequerystringoptional; maximum length 1; pattern ^1$Not described in the contract.
whosequerystringoptional; maximum length 4; pattern ^mine$Not described in the contract.

Request body

This operation declares no request body.

Runnable examples

Placeholder values are generated from the approved schema and are not live credentials or customer data. Replace every angle-bracket or shell variable value. Examples cannot be run until the App has a routed base URL and your client has the required grant.

cURL
curl 'https://api.runonvision.com/api/todo/v1/tasks' \
  --request GET \
  --header 'authorization: Bearer ${ACCESS_TOKEN}' \
  --header 'accept: application/json'
JavaScript (server-side)
const response = await fetch('https://api.runonvision.com/api/todo/v1/tasks', {
  method: 'GET',
  headers: {
    authorization: `Bearer ${ACCESS_TOKEN}`,
    accept: 'application/json',
  },
}

if (!response.ok) throw new Error(`Vision API ${response.status}`)
const result = await response.json()
Python 3 standard library
import json
import urllib.parse
import urllib.request

request = urllib.request.Request(
    'https://api.runonvision.com/api/todo/v1/tasks',
    data=None,
    headers={
    "Accept": "application/json",
    "Authorization": "Bearer <ACCESS_TOKEN>"
},
    method='GET',
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)

The current TypeScript reference client covers Platform token exchange and core reads. No native SDK helper is declared for this operation; use the HTTP contract directly and follow the SDK guidance.

Responses

StatusMeaningSchema
200Successful responseobject
400Invalid request parameters or body (INVALID_REQUEST)object
401Vision credential missing or invalid (AUTHENTICATION_REQUIRED or INVALID_CREDENTIAL)object
403Scope, grant, identity class, or workspace role denied (PERMISSION_DENIED)object
503Database, authorization dependency, or other required dependency unavailable (DEPENDENCY_UNAVAILABLE)object

Success response schema

FieldTypeRulesDescription
followUpCountintegeroptional; minimum 0; maximum 9007199254740991Not described in the contract.
includesSampletrueoptionalNot described in the contract.
itemsarrayrequiredNot described in the contract.
nextCursorstring | nullrequired; default nullNot described in the contract.
schemaVersion"todo.tasks.v1"requiredNot described in the contract.
totalCountintegerrequired; minimum 0; maximum 9007199254740991Not described in the contract.
200 illustrative response
{
  "followUpCount": 0,
  "includesSample": true,
  "items": [
    {
      "allDay": true,
      "archived": true,
      "archiveOffer": "archive",
      "assignedTo": {
        "displayName": "<displayName>",
        "id": "00000000-0000-4000-8000-000000000001",
        "subject": "<subject>"
      },
      "canRemove": true,
      "canWork": true,
      "completedAt": "2026-08-21T18:00:00Z",
      "createdAt": "2026-08-21T18:00:00Z",
      "deadlineAt": "2026-08-21T18:00:00Z",
      "description": "<description>",
      "dueAt": "2026-08-21T18:00:00Z",
      "dueBucket": "Running late",
      "estimatedMinutes": 1,
      "id": "00000000-0000-4000-8000-000000000001",
      "isSample": true,
      "listColor": "<listColor>",
      "listId": "00000000-0000-4000-8000-000000000001",
      "listName": "<listName>",
      "position": 0,
      "priority": "none",
      "recurrenceFrom": "due",
      "recurrenceLabel": "<recurrenceLabel>",
      "recurrenceRule": "<recurrenceRule>",
      "starred": true,
      "startAt": "2026-08-21T18:00:00Z",
      "status": "pending",
      "subtaskDone": 0,
      "subtaskTotal": 0,
      "timeZone": "<timeZone>",
      "title": "<title>",
      "updatedAt": "2026-08-21T18:00:00Z"
    }
  ],
  "nextCursor": null,
  "schemaVersion": "todo.tasks.v1",
  "totalCount": 0
}

Errors and troubleshooting

Error bodies and codes are shown only where the approved contract declares them. Use status, the declared error schema, and any correlation identifier returned by the App; do not infer that two Apps share one envelope.

  • 400 — Invalid request parameters or body (INVALID_REQUEST)
  • 401 — Vision credential missing or invalid (AUTHENTICATION_REQUIRED or INVALID_CREDENTIAL)
  • 403 — Scope, grant, identity class, or workspace role denied (PERMISSION_DENIED)
  • 503 — Database, authorization dependency, or other required dependency unavailable (DEPENDENCY_UNAVAILABLE)

Collection behavior

Pagination: declared through the parameters above. Filtering/search: declared through the parameters above. Sorting: declared.

Cursor lifetime, cursor binding, stable ordering, maximum traversal, and unknown-filter behavior are not assumed unless stated by a parameter description or schema constraint above.

Operational behavior

  • Rate limit: No operation-specific limit or 429 response is declared.
  • Retry: Retry only when the documented error model or response headers authorize it. Timeout and backoff values are not declared by this operation.
  • Idempotency: No idempotency header or replay window is declared.
  • Concurrency: No ETag, If-Match, or optimistic-version header is declared.

Security and privacy

  • Keep client credentials and bearer tokens on trusted servers.
  • Send only to the exact approved HTTPS origin and audience.
  • Treat response data according to the owning App's classification and retention policy; the OpenAPI contract does not itself grant data access.
  • Do not log credentials, tokens, complete private payloads, or secrets.

Edge cases and known documentation gaps

  • No detailed operation description.
  • One or more parameters have no field-level description.
  • Business roles, timeout, retry budget, rate value, idempotency window, and concurrency behavior are absent unless explicitly stated above.

Contract history and evidence