Skip to content
GitmoapAPIBeta
Codecode-todos
POST/repositories/{repo_id}/code-todos/{content_digest}/promote

Promote a code TODO into a work item

promote_code_todo
  • issue:create
    A token needs the issue:create scope: File work itemsGranted by mcp_agent_write, write_api, write_repository.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

  • Quota · open issues per scope

    x-gitmoap-quota: {"kind":"enforced","arg":"open_issues_per_scope"}

Files a work item in the repository from a TODO comment, titled from its text unless you give a title, and pins it to the comment's line: deleting the comment closes the work item. Promoting a TODO that already has one returns that work item. Reporters and above who can read the code may promote; the repository's open work-item limit applies.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository ID
  • content_digeststringThe TODO's marker digest

Request body

application/json
  • assignee_idsarray of PrincipalId (string · uuid)optionalDefaults to the (@owner) the comment names, if any.
  • titleIssueTitle (string) or nulloptionalDefaults to the marker text.
  • work_item_typeWorkItemTypeepicstorybugtaskspikechoreincidentsub_taskor nulloptionalDefaults to the todo_promote_type setting, which is chore unless changed.
Request body exampleSynthesized example
{}

Responses

200The work item — newly minted, or the existing one if the TODO was already promoted (idempotent). Carries a marker anchor: deleting the comment closes itapplication/json
  • created_atstring
  • created_byActorSummaryWho created the work item, as they were when they created it.
  • iidIssueId (integer · int64)
  • root_scope_idGroupId (string · uuid)The top-level group the item's group or repository belongs to.
  • scope_idstring
  • scope_typeScopeTypegrouprepositoryWhether the item lives in a group or a repository. With scope_id and iid it forms the item's current address — the #412 a person types — which changes when the item moves.
  • status_categoryStatusCategorytriagetodoin_progressin_reviewblockeddonecancelledThe fixed category of the item's current status, which boards, filters and progress rollups work from.
  • status_idStatusId (string)
  • titleIssueTitle (string)
  • uidIssueUid (string · uuid)The work item's permanent identifier. Unlike its number, it never changes, even when the item moves to another group or repository.
  • updated_atstringWhen the work item last changed, ISO 8601. Listings order by it, newest first.
  • work_item_typeWorkItemTypeepicstorybugtaskspikechoreincidentsub_taskThe kind of work item. The type decides where an item may live (a group or a repository), which types it may have as children, and which fields it accepts.
  • ancestor_group_idsarray of GroupId (string · uuid)optionalThe groups the item sits beneath, nearest first.
  • ancestor_issue_uidsarray of IssueUid (string · uuid)optionalThe item's ancestors' permanent identifiers, nearest first, for display. It can briefly lag behind a change of parent higher up the chain.
  • assignee_idsarray of PrincipalId (string · uuid)optionalThe people assigned to the work item. Absent when nobody is.
  • author_can_pushboolean or nulloptionalWhether the author can push to where this work item lives — its repository, or a group work item's group. False for a drive-by contributor's text. Absent where it was not computed.
  • closed_atstring or nulloptional
  • closed_byPrincipalId (string · uuid) or nulloptional
  • descriptionMarkdownDoc (string) or nulloptional
  • labelsarray of LabelKey (string)optionalThe keys of the labels applied to the work item. Absent when it has none.
  • milestone_idMilestoneId (string · uuid) or nulloptional
  • milestone_scope_idstring or nulloptional
  • milestone_scope_typeScopeTypegrouprepositoryor nulloptionalWhether the item's milestone belongs to a group or a repository — not necessarily the item's own, since a group milestone can hold work items from several repositories.
  • parent_refIssueRef or nulloptionalThe parent's current address, for display. Absent when the item has no parent.
  • parent_uidIssueUid (string · uuid) or nulloptionalThe parent work item's permanent identifier, if the item has a parent.
  • pointsinteger · int32 or nulloptional0–∞
  • regressed_atstring or nulloptional
  • regressed_at_shaCommitHash (string) or nulloptionalThe commit whose evidence proved the regression — the first known bad commit, and the upper end of the range of suspect commits.
  • regressed_from_shaCommitHash (string) or nulloptionalThe commit at which the item was last verified, kept when it regresses — the last known good commit.
  • regressed_run_idPipelineRunId (string · uuid) or nulloptional
  • severitySeveritycriticalhighmediumlowor nulloptional
  • type_profileBlueprintRef or nulloptionalThe custom type this item was filed as, pointing at the group or repository where the blueprint is defined. work_item_type still decides where the item may live, its children and its fields; the blueprint adds a display label and facets. Absent for an item filed as a plain built-in type.
  • verificationVerificationStateunverifiedverifiedregressedoptionalWhether CI has proved the work item's acceptance criteria. unverified until a pipeline run proves them, verified once one has, and regressed when a later run shows that evidence no longer holds.
  • verified_atstring or nulloptional
  • verified_at_shaCommitHash (string) or nulloptionalThe commit at which CI proved the acceptance criteria. Absent until a pipeline run has.
  • verified_run_idPipelineRunId (string · uuid) or nulloptional
  • versioninteger · int64optional0–∞The work item's revision, incremented on every change. Send it back with an update; if the item has changed since you read it, the update is refused with a 409.
200 exampleSynthesized example
{
"created_at": "2026-10-16T15:00:39Z",
"created_by": {
"email": "mara@acme.example",
"id": "id-43a0",
"username": "tomas",
"avatar_url": "https://gitmoap.example/acme/7ddf0c1f"
},
"iid": 7,
"root_scope_id": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"scope_id": "df5014db-7e99-4710-b395-093b3ded5303",
"scope_type": "group",
"status_category": "triage",
"status_id": "415027e0-e1f8-4585-ae77-ba29da1684ad",
"title": "Stream pipeline status into the run header",
"uid": "c4dfee59-8570-427b-a141-7ff3295f999f",
"updated_at": "2026-10-16T05:07:41Z",
"work_item_type": "epic",
"ancestor_group_ids": [
"4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
],
"ancestor_issue_uids": [
"065deef3-2925-447d-9fdb-e9def6e2da52"
],
"assignee_ids": [
"eba7140c-7cd4-4db7-af91-e8ab485fba41",
"cf3f1e04-6d40-4b33-ab77-ae87042c1f60"
],
"author_can_push": false,
"closed_at": "2026-10-08T21:59:35Z",
"closed_by": "b7e2d1c0-9f8e-4d7c-a6b5-c4d3e2f1a0b9",
"description": "Renders each region as density contours of its operations.",
"labels": [
"labels-3b16",
"labels-ee1b"
],
"milestone_id": "2087a0f6-3e77-4ca3-b1b9-53bb4ebf19f0",
"milestone_scope_id": "e09a30be-19d3-47af-a106-3a7b395e636c",
"milestone_scope_type": "group",
"parent_ref": {
"iid": 38,
"scope": {
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
}
},
"parent_uid": "56fa1296-9635-421b-9184-7db8c5406339",
"points": 51,
"regressed_at": "2026-10-16T19:32:38Z",
"regressed_at_sha": "7f650b290310abfbf859df91a0bc7f50eba5894a",
"regressed_from_sha": "083c3a30857020703b01001168d91544faaf32f5",
"regressed_run_id": "9e2b7c41-3d5a-4f8e-b1c2-7a6d5e4f3c2b",
"severity": "critical",
"type_profile": {
"blueprint_id": "c6b1a286-cd60-42d6-ae07-5a1b177b5541",
"scope": {
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
}
},
"verification": "unverified",
"verified_at": "2026-10-09T03:57:58Z",
"verified_at_sha": "4ed0fc677b3fa39ab8dd3a548e70cff3657d48c3",
"verified_run_id": "9e2b7c41-3d5a-4f8e-b1c2-7a6d5e4f3c2b",
"version": 0
}
400Bad request — a path parameter is not a well-formed value of its typeapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-4ebd",
"message": "Pin a page's payload to the build that rendered it"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-fcc2",
"message": "Stream pipeline status into the run header"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-969d",
"message": "Label every synthesized example"
}
}
404No such code TODOapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-51aa",
"message": "Draw the region map from operation density"
}
}
409A concurrent promotion won the race for this TODOapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-06c6",
"message": "Inline scalar newtypes but keep their brand"
}
}
429The scope has reached its open-work-item limitapplication/json
Error codes
  • TOO_MANY_REQUESTSRetryableA quota, a rate limit or a transfer budget is spent. When the response carries Retry-After, retry after that many seconds
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
429 exampleSynthesized example
{
"error": {
"code": "code-1d7e",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap code-todos promote

  • --repo-ididRepository ID (id or owner/repo path)
  • --content-digeststringThe TODO's marker digest
  • --assignee-idsjsonoptionalDefaults to the `(@owner)` the comment names, if any.
  • --titlestringoptional
  • --work-item-typeepic | story | bug | task | spike | chore | incident | sub_taskoptional

Used in these guides