Check out, or correct a checkin

PATCHhttps://<your-url>/api/v2/checkins/{checkin}

MCP id checkins.updateAlso on this path: GET Read a checkin, DELETE Delete a checkin

Partially updates a checkin: absent keys are untouched, an empty body is rejected.

Token scope: api:write:checkins
Without it: 403 insufficient-token-scope.
Permission: None. The record's own rules still apply.
Rate cost: 1 unit, write bucket. A write costs the same whatever view you ask for.
Also: Accepts If-Match. Never cached: private, no-store. Unknown body keys are refused, never dropped.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: Clock out

curl -X PATCH \
  'https://<your-url>/api/v2/checkins/1' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'If-Match: *' \
  -d '{
    "checked_out_at": "2026-08-31T16:48:00Z"
  }'

const response = await fetch('https://<your-url>/api/v2/checkins/1', {
  method: 'PATCH',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'If-Match': '*',
  },
  body: JSON.stringify({
    "checked_out_at": "2026-08-31T16:48:00Z"
  }),
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->withHeader('If-Match', '*')
    ->patch('https://<your-url>/api/v2/checkins/1', [
        'checked_out_at' => '2026-08-31T16:48:00Z',
    ]);

import requests
response = requests.request(
    'PATCH',
    'https://<your-url>/api/v2/checkins/1',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json', 'Content-Type': 'application/json', 'If-Match': '*'},
    json={'checked_out_at': '2026-08-31T16:48:00Z'},
)

Response

The shape of the response, with sample values.

{
  "data": {
    "id": 1,
    "user_id": 1,
    "user": {
      "id": 1
    },
    "checked_in_at": "2026-03-04T09:15:00Z",
    "checked_out_at": "2026-08-31T16:48:00Z",
    "created_at": "2026-03-04T09:15:00Z",
    "updated_at": "2026-03-04T09:15:00Z",
    "links": {
      "self": "https://<your-url>/api/v2/work-items/1"
    }
  }
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/precondition-failed",
  "title": "Precondition failed",
  "status": 412,
  "detail": "The record changed since the version named in If-Match. Re-read it and retry.",
  "instance": "/api/v2/work-items/812",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "current_version": 12
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/validation-failed",
  "title": "Validation failed",
  "status": 422,
  "detail": "3 fields failed validation.",
  "instance": "/api/v2/worklogs",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "errors": [
    {
      "pointer": "/date",
      "code": "date_format",
      "detail": "The date does not match the format Y-m-d."
    },
    {
      "pointer": "/minutes",
      "code": "min",
      "detail": "The minutes must be at least 1."
    },
    {
      "pointer": "/description",
      "code": "required",
      "detail": "The description field is required."
    }
  ]
}

Sending checked_out_at is the checkout: there is no actions/check-out route, because the write only ever fails on an invalid value. Send checked_out_at: null to re-open a closed checkin. user_id is not accepted, so a checkin cannot be moved to another employee. Send If-Match with the ETag from your last read to detect a concurrent edit, which answers 412. Treat it as best-effort only: this resource carries no concurrency token, and updated_at is second-precision, so two writes inside the same second are indistinguishable. This operation declares no permission of its own, but it still requires checkins::read; a caller without it gets 404 on every checkin, their own included.

Path parameters

checkinintegerRequired

The Checkin's numeric id.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

viewstring

Which field set to render.

summarydetaildefault

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-Matchstring

The ETag a write is conditional on. A stale validator is 412 precondition-failed.

Request body

Unknown keys are refused with 422, naming the key.

checked_in_attimestamp (YYYY-MM-DDThh:mm:ssZ)

When the employee clocked in.

checked_out_attimestamp (YYYY-MM-DDThh:mm:ssZ) or null

When the employee clocked out, or null while the checkin is still open. A null value marks the checkin plnnrly shows as active.

Must be on or after checked_in_at.

Response 200

Returns a Checkin in the detail view.

Headers

ETag: A strong validator of exactly this representation.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning