Tasks API¶

List, create, and update tasks in the Fermi app.

Base URL¶

BASE_URL = "https://app.fermi.dev/api/tasks"

There is no https://api.fermi.dev/api/tasks route (404).

Authentication¶

These routes are Fermi app user-session APIs. The Next.js app reads identity from the signed-in user (getUser), not from a service-actor JWT.

A service-actor Authorization: Bearer token returns 401 (Missing required identity headers). Sending X-Fermi-Actor-Id / X-Fermi-Organisation-Id with that token then fails with a different 401 (cookie authToken required). Do not document a header combo for partners — call these APIs only from a logged-in Fermi app session.

List tasks¶

GET /

Query Parameters:

curl --request GET \
  --url "${BASE_URL}?limit=20" \
  --header "Authorization: Bearer <user-session-token>"

The response body is the upstream tasks JSON.

My task¶

GET /todo

curl --request GET \
  --url "${BASE_URL}/todo?limit=20" \
  --header "Authorization: Bearer <user-session-token>"

GET /todo/counts — counts for the My task queue.

GET /counts — overall counts.

Create a task¶

POST /

The API sets tenantId and createdByUserId from the app session. If assignees is empty, it uses assignee or { userId } from the session.

curl --request POST \
  --url "${BASE_URL}" \
  --header "Authorization: Bearer <user-session-token>" \
  --header "Content-Type: application/json" \
  --data '{
    "title": "Follow up with finance"
  }'

Get, update, delete¶

• GET /{id}
• PATCH /{id} — JSON body forwarded upstream
• DELETE /{id}

Complete, comments, attachments¶

• POST /{id}/complete — no body
• POST /{id}/comments — JSON body forwarded
• POST /{id}/attachments — JSON body forwarded
• POST /attachments/upload — multipart file, taskId, optional organizationId, userId
• GET /attachments/download?s3Key=... — { url, expiresIn, s3Key, disposition }

Summary¶

Next Steps¶

• Chat
• Forms
• API Reference