# GET /api/v2/todos

List your todos

- MCP id: todos.index
- Scope: api:read:project_management
- Permission: project_management::view_backlog
- Rate cost: 1 unit, read bucket. `view=detail` makes it 3. Adds: `with_total=1` +2, each include +1, `q` +2.
- Cache-Control: private, no-store

Returns your todos (the unchecked task-list lines in drive documents that mention you), newest first.

This is the list behind the Todos dashboard in plnnrly. The collection is hard-scoped to the authenticated caller with no escape: there is no permission that widens it, `filter[user_id]` accepts `me` and nothing else, and no include reaches another user's rows. ⚠ Rows are auto-derived from document content: every write to a drive item deletes the whole todo set for that item and rebuilds it from the document HTML, so ids are not stable across an edit of a source document. `?q=` substring-matches `todo_content`, and `filter[drive_item_id]` narrows to particular documents. `total` is omitted unless you pass `with_total=1`.

## Parameters
- view (string, optional): Which field set to render.
- per_page (integer 1 to 100, optional): Rows per page. At most 25 when `include` names a to-many relation; a larger value is 400 invalid-query-parameter.
- cursor (string, optional): Opaque keyset cursor from a previous page's links.next. Never construct one by hand.
- with_total (boolean, optional): Whether meta.page.total is counted for this request.
- filter[created_at] (timestamp (YYYY-MM-DDThh:mm:ssZ), optional): Creation timestamp. Pair with `sort=id` for a stable full export. Operators: = gte lt.
- filter[drive_item_id] (integer, optional): Limit to todos parsed out of these drive items. Operators: = in.
- filter[updated_at] (timestamp (YYYY-MM-DDThh:mm:ssZ), optional): Last-write timestamp. Use for incremental sync. Operators: = gte lt.
- filter[user_id] (integer, optional): Whose todos to return. Accepts the literal `me`, and `me` is the only value any caller may name: this collection has no permission that grants access to another user's todos. Operators: = in.
- q (string, optional): Free-text search over `todo_content`. At most one substring match per request: `q` together with a `contains` filter is 400 invalid-query-parameter.
- sort (string, optional): Up to three keys, comma-separated, each optionally prefixed with `-` for descending.
- include (string, optional): Comma-separated names to inline, at most five.
- X-Request-Id (header, optional): A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.
- If-None-Match (header, optional): The ETag a read is conditional on. A match is answered 304 with no body.

## Response 200
- id (integer, required): Unique identifier.
- user_id (integer, required, server-assigned): The user the todo belongs to. Always the authenticated caller: this collection has no way to read or write another user's todos.
- drive_item_id (integer, required): The drive item whose document this todo was parsed out of. Writable on create only; a todo cannot be re-parented. No relation object is exposed for it; read the document with `GET /api/v2/drive-items/{drive_item}`, which applies the drive access rules this collection does not. Archiving a drive item leaves its todos behind, so this id can name an item you can no longer read.
- todo_content (string, required, multiline): The todo line as plain text.
- created_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Creation timestamp.
- updated_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Last-write timestamp; use for incremental sync.
- user (Ref or UserSummary, required): The user the todo belongs to, always the authenticated caller. Expanding it with `?include=user` additionally requires the `users::read` permission and a token scope covering the users prefix.
- links (UserTodoLinks, required)
  - self (url, required): The canonical URI of this record.

## Errors
- 403 forbidden-by-policy | insufficient-permission | insufficient-token-scope: Forbidden.
- 304 : Not modified.
- 400 idempotency-key-required | invalid-cursor | invalid-query-parameter | malformed-request | unsupported-parameter: Bad request.
- 401 token-expired | unauthenticated: Unauthenticated.
- 404 endpoint-not-found | resource-not-found: Not found.
- 406 not-acceptable: Not acceptable.
- 429 rate-limit-exceeded: Too many requests.
- 500 internal-error: Server error.
- 503 tenant-unavailable: Service unavailable.

## Example
```bash
curl -G \
  'https://<your-url>/api/v2/todos' \
  --data-urlencode 'filter[drive_item_id]=1' \
  --data-urlencode 'include=user' \
  --data-urlencode 'with_total=1' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'
```