Read a timer

GEThttps://<your-url>/api/v2/timers/{timer}

MCP id timers.showAlso on this path: PATCH Correct a timer, DELETE Discard a timer

Returns one timer.

Token scope: api:read:hours
Without it: 403 insufficient-token-scope.
Permission: hours::read
Without it: 403 insufficient-permission.
Rate cost: 1 unit, read bucket.
Also: If-None-Match answers 304 when nothing changed. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: One timer with its target and owner expanded

curl -G \
  'https://<your-url>/api/v2/timers/1' \
  --data-urlencode 'include=timeable,user' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/timers/1?include=timeable%2Cuser', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2/timers/1?include=timeable%2Cuser');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2/timers/1?include=timeable%2Cuser',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": {
    "id": 1,
    "user_id": 1,
    "user": {
      "id": 1
    },
    "timeable_type": "work_item",
    "timeable_id": 41,
    "timeable": {
      "id": 1
    },
    "started_at": "2026-03-04T09:15:00Z",
    "created_at": "2026-03-04T09:15:00Z",
    "updated_at": "2026-03-04T09:15:00Z",
    "links": {
      "self": "https://<your-url>/api/v2/work-items/1"
    }
  }
}

The summary and detail views are identical on this resource: every field is small enough for a list row. A timer belonging to another employee is 404 unless the caller holds times::update_others; the row is invisible, so its existence stays invisible. user and timeable render as {"id": N} references; ?include=timeable,user expands them, and each expansion additionally requires the read permission and token scope of its own target prefix. A timer on an Outlook calendar event keeps the bare {"id": N} form with timeable_type intact even under ?include=timeable, because that record type is not published by this API. Elapsed time is derived from started_at by the client; the API publishes no elapsed counter.

Path parameters

timerintegerRequired

The Timer's numeric id.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

viewstring

Which field set to render.

summarydetaildefault

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a Timer in the detail view.

Headers

ETag: A strong validator of exactly this representation.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning