API routes

All routes live under /api, speak JSON, validate bodies and queries with zod, and require a session cookie — except /api/auth/* and the public invite lookup. Auth uses nuxt-auth-utils sealed session cookies; log in once with POST /api/auth/login and reuse the cookie.

# log in, keep the cookie, then use it
curl -sc tick.cookies -X POST http://localhost:3000/api/auth/login \
  -H 'content-type: application/json' \
  -d '{"email":"mara@example.com","password":"tick-demo"}'
curl -sb tick.cookies http://localhost:3000/api/me

The session cookie is Secure by default, so curl's jar won't send it back to anything but localhost/127.0.0.1 over plain HTTP — use HTTPS, or NUXT_SESSION_COOKIE_SECURE=false on a trusted network (see Security).

Multi-user scoping: catalog and reporting routes operate on the whole org; the timer and entry mutations operate on the current user. Every request re-reads the caller's membership and role from the database, so removing or demoting a member takes effect immediately (see Security).

Auth

Current user

Timers

A user can run up to 10 timers at once. Every timer is named by its entry id, so stopping or editing one leaves the others running.

PATCH and stop answer 404 No timer running. whenever the id is unknown, already stopped, trashed, or someone else's — the message is deliberately identical in all four cases, so it can't be used to prove that an id exists in another org.

Entries

An EntryDto carries the resolved chain and money, so clients never compute either:

{
  "id": "70f73e13-…",
  "name": "Intake form validation",
  "ref": {
    "refType": "task",
    "refId": "4e197f26-…",
    "taskName": "Intake form validation",
    "projectName": "Intake form",
    "clientName": "Northwind Legal",
    "clientColor": "primary-400"
  },
  "billable": true,
  "resolvedRate": 95,
  "rateOverridden": false,
  "start": "2026-09-13T13:00:00.000Z",
  "end": "2026-09-13T14:45:00.000Z",
  "durationSec": 6300,
  "amount": 166.25,
  "tags": []
}

Catalog

Clients, projects, tasks and tags share the same CRUD shape. Cascade endpoints return the counts the cascade dialog shows.

Summaries & export

from/to are ISO datetimes and the range is half-open on entry start — [from, to). billable is all (default) / billable / nonbillable; groupBy is client / project (default) / task / tag. Both exports set Content-Disposition: attachment with a dated filename (tick-export-2026-09-07--2026-09-13.csv, tick-report-2026-09-07_2026-09-13.pdf).

Import

Organization & team

Trash

Errors