Codi Personal Assistant API

RESTful API for the Codi Personal Assistant. Supports both session-based authentication (for web/mobile clients) and API key authentication (for programmatic/agent access).

Version: 1.0.0 Base URL: https://codi.metavert.io

Authentication

The API supports two authentication methods:

1. Session Authentication (Web/Mobile)

Used by the web and mobile apps. Authenticate via Google OAuth at /api/auth/google.

2. API Key Authentication (Programmatic/Agent Access)

Create API keys in Settings. Include the key in the Authorization header:

Authorization: Bearer pa_your_api_key_here

Endpoints marked with session-or-api-key accept either method.

Authentication

GET /api/auth/status
none agent-friendly

Check authentication status

Returns the current authentication state, user email if logged in, and available auth methods.

Response

{
  "authenticated": boolean,
  "user_email": "string (if authenticated)",
  "auth_provider": "google|dev",
  "dev_mode": boolean,
  "auth_url": "string (Google OAuth URL if not authenticated)"
}
POST /api/auth/logout
session

Log out current session

Invalidates the current session. Does not affect API keys.

Todos

GET /api/todos
session-or-api-key agent-friendly

List all todos

Returns all todos for the authenticated user, including completed and backlogged items. Todos shared with others include sharing info.

Response

[{
  "id": "string",
  "description": "string",
  "completed": boolean,
  "frequency": "one-time|daily|weekly|monthly",
  "sharedWith": ["email@example.com"],
  "listItems": [{"id": "string", "text": "string", "completed": boolean}],
  "workoutExercises": [...],
  "linkedNoteId": "string (optional)",
  "linkedNoteTitle": "string (optional)",
  "createdAt": "ISO8601 timestamp",
  "completedAt": "ISO8601 timestamp (if completed)",
  "deletedAt": "ISO8601 timestamp (if deleted)",
  "isBacklogged": boolean,
  "remindAt": "ISO8601 timestamp (if scheduled)"
}]
POST /api/todos
session-or-api-key agent-friendly

Create a new todo

Creates a new todo. Use @email in description to auto-share with other users. Supports hashtags like #urgent, #important, #list, #workout.

Request Body

{
  "description": "string (required) - supports @mentions and #hashtags",
  "frequency": "one-time|daily|weekly|monthly (default: one-time)"
}

Response

{
  "id": "string",
  "description": "string",
  "completed": false,
  "frequency": "string",
  "createdAt": "ISO8601 timestamp"
}
GET /api/todos/{id}
session-or-api-key agent-friendly

Get a specific todo

Returns a single todo by ID.

Path Parameters

NameTypeDescription
id (required)stringTodo ID
PUT /api/todos/{id}
session-or-api-key agent-friendly

Update a todo

Updates a todo's properties. Only include fields you want to change.

Path Parameters

NameTypeDescription
id (required)stringTodo ID

Request Body

{
  "completed": boolean,
  "description": "string",
  "frequency": "string",
  "sharedWith": ["email@example.com"],
  "listItems": [...],
  "workoutExercises": [...],
  "linkedNoteId": "string",
  "linkedNoteTitle": "string"
}
DELETE /api/todos/{id}
session-or-api-key agent-friendly

Delete a todo

Soft-deletes a todo. Can be restored later.

Path Parameters

NameTypeDescription
id (required)stringTodo ID
POST /api/todos/{id}/restore
session-or-api-key agent-friendly

Restore a deleted todo

Restores a previously deleted todo.

POST /api/todos/{id}/backlog
session-or-api-key agent-friendly

Move todo to backlog

Moves a todo to the backlog, optionally with a reminder date.

Request Body

{
  "remind_at": "ISO8601 timestamp (optional)"
}
POST /api/todos/{id}/unbacklog
session-or-api-key agent-friendly

Move todo from backlog

Moves a todo back from the backlog to active.

GET /api/todos/shared-with-me
session-or-api-key agent-friendly

List todos shared with me

Returns todos that other users have shared with the current user.

Response

[{
  "id": "string",
  "description": "string",
  "ownerEmail": "string",
  "ownerName": "string",
  "ownerAvatar": "base64 (optional)",
  ...todo fields
}]

Notes

GET /api/notes
session-or-api-key agent-friendly

List all notes

Returns all notes for the user, including shared notes. Shared notes include owner info and 'isNew' status.

Response

[{
  "id": "string",
  "title": "string",
  "content": "string (markdown)",
  "isDraft": boolean,
  "isNew": boolean,
  "tags": ["string"],
  "linkedTaskId": "string (optional)",
  "linkedTaskName": "string (optional)",
  "userEmail": "string (owner)",
  "ownerName": "string (for shared notes)",
  "createdAt": "ISO8601",
  "updatedAt": "ISO8601"
}]
POST /api/notes
session-or-api-key agent-friendly

Create a new note

Creates a new note. Can optionally link to a task.

Request Body

{
  "title": "string (required)",
  "content": "string (markdown)",
  "isDraft": boolean (default: false),
  "tags": ["string"],
  "linkedTaskId": "string (optional)",
  "linkedTaskName": "string (optional)",
  "linkedTaskData": "string (optional - serialized task data)"
}
GET /api/notes/{id}
session-or-api-key agent-friendly

Get a specific note

Returns a single note by ID.

PUT /api/notes/{id}
session-or-api-key agent-friendly

Update a note

Updates a note. Supports optimistic concurrency via version field.

Request Body

{
  "title": "string",
  "content": "string",
  "isDraft": boolean,
  "tags": ["string"],
  "version": number (for conflict detection)
}
DELETE /api/notes/{id}
session-or-api-key agent-friendly

Delete a note

Soft-deletes a note. Can be restored later.

POST /api/notes/{id}/restore
session-or-api-key agent-friendly

Restore a deleted note

Restores a previously deleted note.

GET /api/notes/search
session-or-api-key agent-friendly

Search notes

Full-text search across note titles and content.

Query Parameters

NameTypeDescription
q (required)stringSearch query
PUT /api/notes/{id}/share
session-or-api-key agent-friendly

Share a note

Updates the list of users a note is shared with.

Request Body

{
  "sharedWith": ["email@example.com"]
}

Profile

GET /api/profile
session-or-api-key agent-friendly

Get user profile

Returns the current user's profile including display name, avatar, and timezone.

Response

{
  "display_name": "string",
  "avatar_data": "base64 (optional)",
  "timezone": "string (e.g., America/New_York)"
}
PUT /api/profile
session-or-api-key agent-friendly

Update user profile

Updates the current user's profile.

Request Body

{
  "display_name": "string",
  "timezone": "string"
}

Connections

GET /api/connections
session-or-api-key agent-friendly

List connections

Returns all connections (friends/collaborators) for sharing tasks and notes.

Response

[{
  "email": "string",
  "displayName": "string",
  "avatarData": "base64 (optional)",
  "status": "pending|accepted|rejected"
}]
POST /api/connections
session-or-api-key agent-friendly

Send connection invite

Sends a connection invitation to another user.

Request Body

{
  "email": "string (required)"
}
PUT /api/connections/{email}
session-or-api-key agent-friendly

Accept or reject connection

Responds to a connection invitation.

Request Body

{
  "action": "accept|reject"
}
DELETE /api/connections/{email}
session-or-api-key agent-friendly

Remove connection

Removes a connection or cancels a pending invitation.

Hashtags

GET /api/hashtags
session-or-api-key agent-friendly

Get hashtag configurations

Returns configured hashtags and their settings (priority, type, form fields).

PUT /api/hashtags
session-or-api-key agent-friendly

Update hashtag configurations

Updates the hashtag configurations.

API Keys

GET /api/api-keys
session

List API keys

Returns all API keys for the user (keys are masked, only prefix shown).

Response

[{
  "id": "string",
  "name": "string",
  "key_prefix": "pa_xxxx...",
  "created_at": "ISO8601",
  "last_used_at": "ISO8601 (optional)"
}]
POST /api/api-keys
session

Create API key

Creates a new API key. The full key is only shown once in the response.

Request Body

{
  "name": "string (required)"
}

Response

{
  "id": "string",
  "name": "string",
  "key": "pa_... (SAVE THIS - only shown once!)",
  "key_prefix": "pa_xxxx...",
  "created_at": "ISO8601"
}
DELETE /api/api-keys/{id}
session

Revoke API key

Permanently revokes an API key.

Exercise

GET /api/exercise-history
session-or-api-key agent-friendly

Get exercise history

Returns the user's exercise/workout history.

GET /api/workout-summaries
session-or-api-key agent-friendly

Get workout summaries

Returns summarized workout data.

GET /api/workout-analytics
session-or-api-key agent-friendly

Get workout analytics

Returns analytics for a specific exercise.

Query Parameters

NameTypeDescription
name (required)stringExercise name
mode (required)stringduration|volume|max

Analytics

GET /api/task-completion-stats
session-or-api-key agent-friendly

Get task completion stats

Returns task completion statistics over time.

Query Parameters

NameTypeDescription
filterstringall|important|urgent|both