GET/repositories/{repo_id}/code-todos

List the repository's code TODOs

list_code_todos

issue:read
A token needs the issue:read scope: Read work items and their settingsGranted by mcp_agent, mcp_agent_write, read_api, read_repository, write_api, write_repository.Every operation this scope unlocks
Single-resource
x-gitmoap-isolation: {"kind":"single_or_self_scoped"}
Paginated
Pass the cursor a page returns to get the next one.

The TODO, FIXME and similar comments found in the repository's code, newest first, each with its file, line, text and author. By default only those not yet promoted to work items; filter by state, by marker keyword or to a path prefix. Pages hold up to 100 TODOs, 20 by default; pass cursor back unchanged. Anyone who can read the repository's code and its work items may call it.

Parameters

Path

repo_idRepositoryId (string · uuid)Repository ID

Query

statestringoptionalindexed (not yet promoted, the default) | promoted | promoted_unstamped (promoted, but the comment does not yet carry the work item's number) | all
markerstringoptionalFilter by marker keyword (TODO, FIXME, …)
path_prefixstringoptionalFilter to a path prefix
limitinteger · int32optionalPage size (1-100, default 20)
cursorstringoptionalPagination cursor

Responses

200The codebase's own backlog — the markers this repository has admitted to itselfapplication/json

itemsarray of CodeTodo
- The CodeTodo schema
- content_digeststringThe TODO's identifier: a SHA-256 digest of its keyword and text, without the (@owner) or (#id) part or the comment syntax. It holds no path or line number, so moving the comment keeps the same TODO.
- first_seen_atstring
- first_seen_shaCommitHash (string)The commit (push head) that first added this marker.
- lineinteger · int320–∞
- markerMarkerKindTODOFIXMEHACKXXXBUGOPTIMIZEThe marker keywords the scanner recognises. Uppercase only — todo: and Todo: are everywhere in prose, README files and variable names, and lowering the case sensitivity to be "helpful" is how a scanner becomes a noise generator.
- pathRepoPath (string)Where the TODO was last seen. It changes as the comment moves; content_digest does not.
- region_digeststringA digest of the TODO's source line as a code region — what the anchor created on promotion starts with as its content_digest. Unlike content_digest, it includes any (#id).
- repository_idRepositoryId (string · uuid)
- textstringThe TODO's text, normalised, at most 255 characters.
- authorActorSummaryoptionalThe author of the commit that added the TODO — the work item's creator if it is promoted.
  - The ActorSummary schema
  - emailstring
  - idstring
  - usernamestring
  - avatar_urlstring or nulloptional
- issue_iidIssueId (integer · int64) or nulloptionalThe number of the work item this TODO was promoted into, in the same repository. Absent until it is promoted. gitmoap todo sync writes it back into the comment as (#id).
- ownerstring or nulloptionalThe @username an author wrote in the marker (without the @), a suggested assignee on promotion. Absent when the marker named no owner.
- promoted_atstring or nulloptional
next_tokenstring or nulloptional

200 exampleSynthesized example

400Bad request — a path parameter is not a well-formed value of its typeapplication/json

Error codes

BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

400 exampleSynthesized example

401Unauthenticated — no credential, or an invalid oneapplication/json

Error codes

UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

401 exampleSynthesized example

403Forbidden — the caller's access level or token scope is insufficientapplication/json

Error codes

FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

403 exampleSynthesized example

404Repository not found or not viewableapplication/json

Error codes

NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does

errorErrorBody
- The ErrorBody schema
- codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
- messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
- fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
- reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
- required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
- violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.

404 exampleSynthesized example

CLI

gitmoap code-todos list

--repo-ididRepository ID (id or owner/repo path)
--cursorstringoptionalPagination cursor
--limitnumberoptionalPage size (1-100, default 20)
--markerstringoptionalFilter by marker keyword (TODO, FIXME, …)
--path-prefixstringoptionalFilter to a path prefix
--statestringoptionalindexed (not yet promoted, the default) | promoted | promoted_unstamped (promoted, but the comment does not yet carry the work item's number) | all

Used in these guides

Linking work to code

Request

curl "https://api.gitmoap.com/repositories//code-todos" \
  -H "Authorization: Bearer $GITMOAP_TOKEN"

gitmoap code-todos list \
  --repo-id

import { createApiClient } from "@gitmoap/backend-types";

const client = createApiClient({
  baseUrl: "https://api.gitmoap.com",
  headers: { Authorization: `Bearer ${process.env.GITMOAP_TOKEN}` },
});

const { data, error } = await client.GET("/repositories/{repo_id}/code-todos", {
  params: {
    path: { repo_id: "" },
  },
});

GET /repositories//code-todos HTTP/1.1
Host: api.gitmoap.com
Authorization: Bearer $GITMOAP_TOKEN

⌘↵

Send to see the sandbox's answer. Nothing leaves your browser.