# POST /api/v2/timers

Start a timer

- MCP id: timers.store
- Scope: api:write:hours
- Permission: none, the record's own rules still apply
- Rate cost: 1 unit, write bucket. A write costs the same whatever `view` you ask for.
- Cache-Control: private, no-store

Starts a stopwatch on a work item or a planning event for the authenticated user and returns it with a `Location` header.

`user_id` is not accepted: a timer always belongs to the caller, and there is no way to start one for another employee. Send `timeable_type` and `timeable_id` together; omit `started_at` to start now. A second timer on the same record for the same caller is a `422` with code `unique` (there is at most one timer per employee per record), so `Idempotency-Key` is optional here rather than required: a retry meets that rule anyway. There is no stop action: to book the elapsed minutes, read `started_at`, POST the hours to `/api/v2/worklogs` and then DELETE this timer. Those two calls are not atomic: a client that deletes first loses the minutes, and one that crashes between them leaves the timer running. This operation declares no permission of its own, and a caller can only ever create their own timer. plnnrly also hides its Start button on a record you may not log time on; the API does not check that when the timer starts. Nothing unbillable can be booked that way regardless: `POST /api/v2/worklogs` applies that gate when the hours are actually written.

## Parameters
- view (string, optional): Which field set to render.
- X-Request-Id (header, optional): A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.
- Idempotency-Key (header, optional): A caller-chosen key that makes this POST safe to retry. Replaying it returns the original response with Idempotency-Replayed: true.

## Request body
- timeable_type (string, required): The record being timed. Expanding it with `?include=timeable` additionally requires the read permission and token scope of the target's own prefix, per branch: `project_management` for a work item, events for a planning event.
- timeable_id (integer → WorkItem.id, optional, unique): The record being timed. Expanding it with `?include=timeable` additionally requires the read permission and token scope of the target's own prefix, per branch: `project_management` for a work item, events for a planning event. Required when timeable_type is present. Must be unique across Timer.
- started_at (timestamp (YYYY-MM-DDThh:mm:ssZ), optional): When the stopwatch was started. Elapsed time is this value against the client's own clock; the API publishes no elapsed counter.

Unknown keys are refused with `422` validation-failed, naming the key.

## Response 201
- id (integer, required): Unique identifier.
- user_id (integer, required, server-assigned): Employee this timer belongs to. Always the authenticated user; a timer cannot be started for someone else.
- user (Ref or UserSummary, required): The employee this timer belongs to. Expanding it with `?include=user` additionally requires the `users::read` permission and a token scope covering the users prefix.
- timeable_type (string, required): The kind of record `timeable` points at; it says which branch of `timeable` applies.
- timeable_id (integer, required): The id of the record `timeable` points at.
- timeable (Ref or WorkItemSummary or EventSummary, required): The record being timed. Expanding it with `?include=timeable` additionally requires the read permission and token scope of the target's own prefix, per branch: `project_management` for a work item, events for a planning event.
- started_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): When the stopwatch was started. Elapsed time is this value against the client's own clock; the API publishes no elapsed counter.
- created_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Creation timestamp.
- updated_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Last-write timestamp; use for incremental sync.
- links (TimerLinks, required)
  - self (url, required): The canonical URI of this record.

## Errors
- 403 forbidden-by-policy | insufficient-permission | insufficient-token-scope: Forbidden.
- 409 idempotency-key-in-flight | idempotency-key-reused: Conflict.
- 415 unsupported-media-type: Unsupported media type.
- 422 unprocessable-relationship | validation-failed: Unprocessable content.
- 400 idempotency-key-required | invalid-cursor | invalid-query-parameter | malformed-request | unsupported-parameter: Bad request.
- 401 token-expired | unauthenticated: Unauthenticated.
- 404 endpoint-not-found | resource-not-found: Not found.
- 406 not-acceptable: Not acceptable.
- 429 rate-limit-exceeded: Too many requests.
- 500 internal-error: Server error.
- 503 tenant-unavailable: Service unavailable.

## Example
```bash
curl -X POST \
  'https://<your-url>/api/v2/timers' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: <key>' \
  -d '{
    "timeable_type": "work_item",
    "timeable_id": 41
  }'
```