Docs

API reference

Every endpoint is scoped to the authenticated account, and the REST API authenticates with the session cookie the web app sets. Scripts and agents use the MCP endpoint instead.

All requests and responses are JSON. Every /api/* route authenticates with the session cookie set by POST /api/auth/login:

curl -X POST https://trydone.app/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"..."}' \
  -c cookies.txt

curl -X GET https://trydone.app/api/tasks -b cookies.txt

An MCP token does not authenticate the REST API. An Authorization: Bearer <mcp-token> header is accepted on exactly one route — GET /api/events, so an agent can subscribe to changes over the credential it already holds. Every other /api/* route answers a bearer token with a 401.

That is deliberate rather than an omission: it keeps a leaked MCP token from driving the account’s whole REST surface. Scripts and agents should talk to POST /mcp instead, which is what the token is for.

curl -X GET https://trydone.app/api/events \
  -H "Authorization: Bearer <your-generated-mcp-token>"

Auth & account

POST/api/auth/signup
Create an account (email + password, plus an optional `ref` referral code).
GET/api/referrals
Your referral link, who has joined through it, and progress toward the next reward.
POST/api/auth/login
Start a session; sets a cookie. With 2FA on, returns a challenge instead — finish at /api/auth/2fa/verify.
POST/api/auth/2fa/verify
Step 2 of a 2FA login: trade the challenge and a code for a real session. No session required.
POST/api/auth/logout
End the current session.
GET/api/auth/me
The current user (including whether the email is confirmed) and whether an MCP token exists.
GET/api/bootstrap
The current user plus every list (tasks, projects, goals, dependencies, tags, task↔tags) in one request — the web client's poll.
PATCH/api/auth/profile
Update the profile — name, timezone, avatar.
POST/api/auth/password/verify
Verify the current password (step 1 of changing it).
POST/api/auth/password
Set a new password — requires a recent /password/verify on this session (step 2).
POST/api/auth/forgot-password
Request a password-reset email.
POST/api/auth/reset-password
Complete a reset with the emailed token.
POST/api/auth/verify-email
Confirm an address with the emailed token. No session required.
POST/api/auth/resend-verification
Re-send the confirmation email to the signed-in account.
POST/api/auth/mcp-token
Generate (or regenerate) the account's full-access MCP token.
DELETE/api/auth/mcp-token
Revoke the full-access MCP token.
GET/api/mcp-tokens
List the account's MCP tokens (full, read-only, single-project).
POST/api/mcp-tokens
Mint a scoped MCP token (read-only or one project).
DELETE/api/mcp-tokens/:id
Revoke one scoped MCP token.
GET/api/auth/2fa
Whether two-factor authentication is on, and how many recovery codes are left.
POST/api/auth/2fa/setup
Begin TOTP enrollment — returns the secret and the otpauth:// URI the QR encodes. Does not switch 2FA on.
POST/api/auth/2fa/enable
Confirm enrollment with a live code. Returns the recovery codes — the only time they exist in plaintext.
DELETE/api/auth/2fa
Turn two-factor authentication off.
POST/api/auth/2fa/recovery-codes
Issue a fresh set of recovery codes, invalidating the old ones.
GET/api/auth/connections
List the OAuth clients you've granted access to.
DELETE/api/auth/connections/:clientId
Revoke one OAuth client's access.
DELETE/api/auth/account
Delete the account and everything in it. Requires the current password.

Tasks

GET/api/tasks
List tasks — filter by status, priority, project, parent; search title/notes.
POST/api/tasks
Create a task.
POST/api/tasks/quick
Create a task from a raw quick-capture string.
GET/api/tasks/:id
Get one task.
PATCH/api/tasks/:id
Update a task.
DELETE/api/tasks/:id
Delete a task (cascades to subtasks) — moves it to Trash, not a hard delete.
POST/api/tasks/bulk-assign
Assign a set of task ids (up to 200) to a user or an AI agent.
POST/api/tasks/bulk-delete
Move a set of task ids to Trash in one call.
POST/api/tasks/bulk-move
Move a set of task ids into a project (or out of one) in one call.
POST/api/tasks/:id/decompose
Split a task into subtasks from a list of titles.
POST/api/tasks/:id/approve
Approve a completion an agent proposed (pending_approval → done).
POST/api/tasks/:id/reject
Reject a pending_approval task, with optional feedback (→ in_progress).
POST/api/tasks/:id/approve-plan
Approve a proposed plan (plan_proposed → in_progress).
POST/api/tasks/:id/reject-plan
Reject a proposed plan, with optional feedback.
GET/api/tasks/:id/evidence
What an approval is being asked to trust: criteria progress, spend against budget, receipts, deliverables and trace links.
GET/api/tasks/:id/runs
The agent runs recorded against one task.
GET/api/tasks/:id/decisions
The questions an agent parked on this task.
POST/api/resurface
Un-wait tasks whose resurface date has arrived.

Trash

GET/api/trash
List deleted tasks, most recent first.
POST/api/tasks/:id/restore
Restore a deleted task (and whichever subtasks were deleted with it).
DELETE/api/trash/:id
Permanently delete one trashed task.
DELETE/api/trash
Empty the trash.

Tags

GET/api/tags
List tags.
POST/api/tags
Create a tag.
DELETE/api/tags/:id
Delete a tag (removed from every task that had it).
GET/api/task-tags
List every task↔tag pairing for the account.
POST/api/tasks/:id/tags
Apply a tag to a task.
DELETE/api/tasks/:id/tags/:tagId
Remove a tag from a task.

Dependencies

GET/api/dependencies
List all blocked-by relationships for the account.
GET/api/tasks/:id/dependencies
List a task's blockers.
POST/api/tasks/:id/dependencies
Add a blocker (cycle-checked).
DELETE/api/tasks/:id/dependencies/:blockerId
Remove a blocker.

Activity

GET/api/tasks/:id/comments
List a task's activity feed (comments + status history).
POST/api/tasks/:id/comments
Add a comment, authored by you or an AI agent.
GET/api/activity
The board-wide activity rail — what happened across every task you can see, newest first. ?limit= caps it.
GET/api/claude-shipped
The agent-work feed: what Claude actually shipped. ?days=1|7|30 sets the window.

Digest & review

GET/api/digest
Overdue, due-today, stalled, and recently-completed tasks.
GET/api/review
The weekly review roll-up.
GET/api/stats
Completion trend, streak, and open-task breakdowns by priority/project.

Goals

GET/api/goals
List goals.
POST/api/goals
Create a goal.
PATCH/api/goals/:id
Update a goal.
DELETE/api/goals/:id
Delete a goal.
POST/api/goals/:id/breakdown
File a Claude-assigned breakdown task under the goal — the “Propose steps” action.

Capture inbox

GET/api/capture
Agent-proposed tasks awaiting triage, plus the accept/dismiss health numbers. ?state=pending|accepted|dismissed|all.
POST/api/capture/sweep
Scan the calendar for things worth suggesting, and file them as suggestions.
POST/api/capture/:id/accept
Turn a suggestion into a real task. The task always starts gated (agent_ok: false).
POST/api/capture/:id/dismiss
Dismiss a suggestion without creating anything.

Grooming

GET/api/grooming
The stale sweep — open work that has gone quiet, with the evidence to decide about it. ?days= sets the threshold, ?limit= caps it.
GET/api/grooming/proposals
Bundled grooming proposals. ?state=open|resolved|all.
POST/api/grooming/items/:id/approve
Apply one item's proposed disposition.
POST/api/grooming/items/:id/dismiss
Decline one item, leaving the task as it is.

Autonomy & agents

GET/api/autonomy
The autonomy ledger — where agent_ok has been earned, per project and tag class. A read; it grants nothing.
POST/api/autonomy/revoke
Take a class’s grant back, pulling its tasks behind the approval gate again.
GET/api/agents
The agent roster — what each named agent has done. ?days= sets the window. Counts and timestamps only.
GET/api/fleet
Live fleet status: who is working what right now.
GET/api/projects/:id/rejections
Recent rejections in one project — the record autonomy decay reads from.
GET/api/decisions
Every open decision an agent is waiting on, across the board.
POST/api/decisions/:id/answer
Answer a parked decision and unblock its task.

Routine & budget

GET/api/routine
The caps a scheduled routine stops on.
PATCH/api/routine
Update those caps.
GET/api/routine/night
Spend against tonight’s budget. ?since= overrides the default 12-hour window.

Projects

GET/api/projects
List projects.
POST/api/projects
Create a project.
PATCH/api/projects/:id
Update a project.
DELETE/api/projects/:id
Delete a project.

Workspaces & sharing

GET/api/workspaces
List the workspaces you belong to.
GET/api/workspaces/:id/members
List a workspace's members.
DELETE/api/workspaces/:id/members/:memberId
Remove a member from a workspace.
POST/api/invites
Create an invite to a workspace or a single project.
POST/api/invites/accept
Redeem an invite token to join.

Agent runs

GET/api/runs
Recent agent runs, plus aggregate status/tool-call/token stats.

Calendar & Google sync

GET/api/calendar
Calendar/scheduling settings and the ICS feed token.
PUT/api/calendar
Update calendar and scheduling-window settings.
POST/api/calendar/token
Generate the subscribable ICS feed token.
DELETE/api/calendar/token
Revoke the ICS feed token.
POST/api/calendar/oauth/start
Begin connecting a Google Calendar — returns the consent URL to send the browser to.
GET/api/google/accounts
List connected Google Calendar accounts.
POST/api/google/sync
Sync busy times from Google Calendar.
DELETE/api/google/accounts/:id
Disconnect a Google account.
GET/api/calendar/events
List cached calendar events (titles, people) in a date range.
GET/api/calendar/matches
Suggested task↔event matches, by task, by event, or by date range.
GET/api/tasks/:id/calendar-links
List the calendar events linked to a task.
POST/api/tasks/:id/calendar-links
Link a task to the calendar event it's about.
DELETE/api/tasks/:id/calendar-links/:eventId
Unlink a task from a calendar event.

Notifications & live

GET/api/notifications
Get notification preferences (email digest).
PUT/api/notifications
Update notification preferences.
GET/api/events
Server-sent stream of task and activity changes.
GET/api/export
Export tasks as CSV or Markdown.
PUT/api/view-prefs
Persist view preferences (sort, grouping, which rails are open).
PUT/api/saved-views
Replace the account’s saved views.
GET/api/widget
A compact board snapshot for the home-screen widget. ?limit=, ?days=, and an X-Client-Date header for the device’s own today.

MCP

POST/mcp
The remote MCP endpoint — JSON-RPC over Streamable HTTP. See MCP setup.