# UserTodo

A todo: one unchecked task-list line in a drive document that mentions you. This is the list behind the Todos dashboard in plnnrly. ⚠ The collection is a derived copy of document content, not user-authored data: every write to a drive item rebuilds the whole todo set for that item from its HTML, deleting and re-creating the todos, so a todo has no stable identity across an edit of its source document and anything written through this collection is discarded on the next such edit. Completing a todo for real means unchecking-to-checking the task item in the document. The collection is hard-scoped to the authenticated caller with no escape: there is no permission, filter value or include that reads another user's todos.

## Used by
- GET /api/v2/todos: List your todos (UserTodoList)
- POST /api/v2/todos: Create a todo (UserTodo)
- GET /api/v2/todos/{todo}: Read a todo (UserTodo)
- PATCH /api/v2/todos/{todo}: Update a todo (UserTodo)

## UserTodo fields
- id (integer, required): Unique identifier.
- user_id (integer, required, server-assigned): The user the todo belongs to. Always the authenticated caller: this collection has no way to read or write another user's todos.
- drive_item_id (integer, required): The drive item whose document this todo was parsed out of. Writable on create only; a todo cannot be re-parented. No relation object is exposed for it; read the document with `GET /api/v2/drive-items/{drive_item}`, which applies the drive access rules this collection does not. Archiving a drive item leaves its todos behind, so this id can name an item you can no longer read.
- todo_content (string, required, multiline): The todo line as plain text.
- created_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Creation timestamp.
- updated_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Last-write timestamp; use for incremental sync.
- user (Ref or UserSummary, required): The user the todo belongs to, always the authenticated caller. Expanding it with `?include=user` additionally requires the `users::read` permission and a token scope covering the users prefix.
- links (UserTodoLinks, required)
  - self (url, required): The canonical URI of this record.

## Variants

### UserTodoList

What a collection returns, and what `?view=summary` returns on a single record.

8 fields.
Identical to the detail object above.

### UserTodoSummary

The embedded form: what you get when another resource carries this one and you did not `include` it.

2 fields.
Omits: user_id, drive_item_id, created_at, updated_at, user, links

### UserTodoLinks

The `links` object on this resource.

Keys: self

## Example
```json
{
  "id": 1,
  "user_id": 1,
  "drive_item_id": 1,
  "todo_content": "Confirm the kick-off date with the client",
  "created_at": "2026-03-04T09:15:00Z",
  "updated_at": "2026-03-04T09:15:00Z",
  "user": {
    "id": 1
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1"
  }
}
```