Todix’i kendi araçlarına bağla

Hızlı başlangıç

Üç adımda ilk isteğin: anahtar oluştur, başlığa ekle, isteği gönder.

1. 1Yukarıdan bir erişim anahtarı oluştur ve kopyala.
2. 2Her isteğe Authorization: Bearer tdx_… başlığını ekle.
3. 3İstekleri https://todix.com.tr/api/v1 adresine gönder. Yanıtlar JSON.

# Your open tasks
curl https://todix.com.tr/api/v1/tasks?assignee=me \
  -H "Authorization: Bearer $TODIX_TOKEN"

# Create a task (safe to retry with the same Idempotency-Key)
curl -X POST https://todix.com.tr/api/v1/tasks \
  -H "Authorization: Bearer $TODIX_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1042" \
  -d '{"title":"Kargo etiketlerini yazdır","priority":"high","due_date":"2026-10-20"}'

# Smart filter: high priority, due today, assigned to me
curl -G https://todix.com.tr/api/v1/tasks \
  -H "Authorization: Bearer $TODIX_TOKEN" \
  --data-urlencode "filter=p1 & bugün & @ben"

İzinler

Sınırlar

• Anahtar başına dakikada 120 istek. Her yanıtta X-RateLimit-Limit, X-RateLimit-Remaining ve X-RateLimit-Reset başlıkları var; sınırı aşınca 429 ve Retry-After döner.
• Gövde en fazla 64 KB JSON. Listeler sayfalıdır: yanıttaki next_cursor değerini ?cursor= ile gönder.
• POST isteklerinde Idempotency-Key başlığı gönderirsen aynı istek iki kez işlenmez (24 saat).
• Hatalar hep aynı biçimde: { "error": { "code", "message" } }.

• GET/api/v1/me—
• GET/api/v1/workspaces—
• GET/api/v1/taskstasks:read
• POST/api/v1/taskstasks:write
• GET/api/v1/tasks/{ref}tasks:read
• PATCH/api/v1/tasks/{ref}tasks:write
• DELETE/api/v1/tasks/{ref}tasks:write
• POST/api/v1/tasks/{ref}/completetasks:write
• POST/api/v1/tasks/{ref}/reopentasks:write
• PUT/api/v1/tasks/{ref}/assigneestasks:write
• PUT/api/v1/tasks/{ref}/labelstasks:write
• GET/api/v1/tasks/{ref}/commentstasks:read
• POST/api/v1/tasks/{ref}/commentscomments:write
• GET/api/v1/projectsprojects:read
• POST/api/v1/projectsprojects:write
• GET/api/v1/projects/{id}projects:read
• PATCH/api/v1/projects/{id}projects:write
• GET/api/v1/projects/{id}/sectionsprojects:read
• POST/api/v1/projects/{id}/sectionsprojects:write
• GET/api/v1/labelstasks:read
• POST/api/v1/labelstasks:write
• GET/api/v1/memberstasks:read
• GET/api/v1/webhookswebhooks:manage
• POST/api/v1/webhookswebhooks:manage
• GET/api/v1/webhooks/{id}webhooks:manage
• PATCH/api/v1/webhooks/{id}webhooks:manage
• DELETE/api/v1/webhooks/{id}webhooks:manage
• POST/api/v1/webhooks/{id}/testwebhooks:manage
• POST/api/v1/webhooks/{id}/rotate-secretwebhooks:manage
• GET/api/v1/webhooks/{id}/deliverieswebhooks:manage

Webhook imzasını doğrulama

Her istekte Todix-Signature: t=<zaman>, v1=<imza> başlığı gelir. İmza, “zaman.gövde” metninin imza anahtarınla HMAC-SHA256 özetidir. Ham gövdeyle hesapla, sabit zamanlı karşılaştır ve 5 dakikadan eski istekleri reddet.

import { createHmac, timingSafeEqual } from 'node:crypto'

// Express: app.post('/todix', express.raw({ type: 'application/json' }), handler)
export function verifyTodix(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    String(header ?? '').split(',').map((p) => p.trim().split('=')),
  )
  const t = Number(parts.t)
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest()
  const given = Buffer.from(parts.v1 ?? '', 'hex')
  return given.length === expected.length && timingSafeEqual(given, expected)
}