paymoapp / api Goto Github PK

Currently there's no way to check the authenticity of an event received from your API. There are a few approaches that are quite easy to add in:

1. http://resthooks.org/docs/security/
2. https://developers.trello.com/page/webhooks#section-webhook-signatures

Can you tell me if this is something you're taking into consideration in the near future?

Thanks!

Will there be an available subtask list in the API?

Docs for entries indicate that project is a vaid include - but you get the following error if you use it
{"message": "Unknown field, table or reference: project"}
(task.project does work as an include but docs don't indicate this is the only way through to project properties)

It would be great to have ability to subscribe on events that happen with entities on Paymo side.
The great example is Shopify's webhooks - https://help.shopify.com/api/reference/webhook

When i run the api for task creation, it returns complete list of task instead of the task created, also task isn't created

It suddenly started to happen, some time ago it was working properly

With include=user I get the object of the creator of the task.
How I can get the objects of the users that are assigned to the task?
The field 'users' are only ids, I need the objects of the users.

Thanks

According to the Creating a time entry section within entries.md:

If successful, the response will return 201 Created. The response header Location will contain a link for the new time entry.

After successfully creating a time entry using the api I was returned this location: https://app.paymoapp.com/entries/26307114. Browsing to that URL got me this error:

As far as I can tell, there is no direct view of time entries. You must go through the time sheet of the related project. If there is a direct URL to time entries I would be interested in knowing how to do that.

On *.Task event (or whatever tastk event) webhook return full header but empty body.
I'm using php and I've tried with $_POST, $_GET, $_REQUEST and file_get_contents("php://input") but body is always empty

I may be missing something, however, /tasks requests return 'status_id' which contain an ID. However, I am not seeing how to get a list of task statuses. There is a method for getting a list of project statuses, but not task statuses. Am I missing something?

I have a program that pulls in all tasks. This has been working using the following code for a few years and has been pulling down 5900 records recently. Suddenly it is only pulling down 5000 records (not the newer ones). Any reason for this?

curl -u {api key}:X https://app.paymoapp.com/api/tasks?format=xml > c:\api\tasks.xml

Hi Guys, I'm looking to retrieve the total hours spent on a project, but couldn't find them anywhere, am I missing something?

thanks a lot.

Hi, the billable property of the project object allows only a boolean value and setting it to true creates a Time Based project. How can I create a Flat Rated project?

I'm trying to create a task and automaticly set the Time Budget Alert to 90%.
I cant find any params for this on the task object.
Thanks!

Fields to get only fields requested like in include (?include=project.name).
For example:
api/tasks?fields=name,due_date

The Response should be:

{
   "tasks": [      
      {
         "name": "Design",
         "due_date": null
      },
      {
         "name": "Testing",
         "due_date": "2014-10-30"
      }
   ]
}

According to https://github.com/paymoapp/api/blob/master/sections/datetime.md, date and time data needs to have ISO 8601 format. However, when I try it, it seems to work correctly only with Unix timestamps, actual ISO 8601 values do not work.

Demo:

$ curl -u xxxxxxxxxxxx:X  -H 'Accept: application/json' "https://app.paymoapp.com/api/clients?where=updated_on%3E%3D2016-01-01T01%3A01%3A01Z%20and%20updated_on%3C2017-06-01T01%3A01%3A01Z"
{"clients":[]}

$ curl -u xxxxxxxxxxxx:X  -H 'Accept: application/json' "https://app.paymoapp.com/api/clients?where=updated_on%3E%3D1451610061%20and%20updated_on%3C1496278861"
{"clients":[{"id":...............]}

By the way, if one forgets to URL-encode the where value, the API silently fails. It should probably return some kind of error message.

If I complete a Task via API call, it's 'Progress Status' is not updated to 'Done' as I would expect.

Opening and closing a task without any changes triggers the model.update.Task webhook.
Is there a reason that this is considered as an update?

This also reflects on the "Last Events" section in the project overview.

I'm using this hook to trigger custom Slack messages. Is there another possibility to check for actual changes of the task?

Great API btw.
Thanks.

Hello,

Tasks created with user_id specified do not retain this as the 'Creator' in the application. The Creator is instead the user who's credentials were used over the API.

Dates are meant to be ISO 8601 format but the due date in tasks comes back as simple yyyy-mm-dd which is of course not ISO 8601 and may imply the incorrect due date if the user has to deal with different time zones .. and more irritatingly it broke my code that uses RestSharp which does not allow you to specify date format at a per field level - just per call - and when I get back my list of clients, their projects and tasks it blows up - because some dates are ISO 8601 as specified but this due date isn't

Hello if I query the tasks endpoint like this:

tasklist_id=10000 and name="Just some name and then something else."

I receive a 400 error with the following message

[message] => Invalid condition in "where" param: then something else."

There must be something up with the string parsing?

The query is being urlencoded correctly - other queries without and in the string filter return successfully.

To help in automating the process of integration, it would help to have the documentation in machine readable format to generate clients for the api

hi,

I have to get the hours spent on a project from the api in a specific month (and current month).
In the first step I dont care about single tasks. Just simple times spent on a project basis.

Is this possible?

Hello.

Please can you look in to expanding the webhook event types to include 'updated' and 'deleted' for all entity types.

i.e

model.update.Client
model.delete.Client

and so on

If i include the field duration in entries i get always a 500 error response.

OrderBy to get a request order by a field.
For example:

• /api/tasks?order=due_date (order due_date ascending)
• /api/tasks?order=-due_date (order due_date descending)

Hi

I have written an export tool using the Paymo API and I have noticed, that recently all time entry descriptions contain html, mostly <p> tags. At first, it was only the ones, entered or edited through the web interface, then it started to affect the ones from the desktop widget as well. I made an export today and all descriptions from every time entry contained the <p> tag and all descriptions were entered through the widget.

This is very inconvenient for processing and a little unusual for an API.

Could you change this back? Or is there a way, you could add an HTML-free version of the description to the output?

Thanks
Steve

Hi, I'm trying to get the list of users, and what I get always is the 'company' data as a response.

If the user is not admin, it at least should retrieve the 'users' with a single user at least, the user asking for the list?

It would be nice to filter included models like:

/api/projects?include=tasks&where tasks.budget_hours != null [before url encoding]

Currently the webhooks are limited to 1 event only.. This is problematic and limiting. It overly complicates consumers and the payload itself does not provide enough context as to what the event is.. (relying on more complicated means to determining that).. Also it does not match the behavior of other webhooks implementations for other task tools.

My proposal is this.
Adjust the payload to this

{
    "action": "model.insert.Task",
    "model": {
        "id":109403,
       "name":"New Task",
       "project_id":59032,
       "tasklist_id":250019,
       "user_id":1093,
       "other_fields": "etc..."
    }
}

And then allow multiple events to be subscribed to by allowing a "events" parameter instead of "event" when creating the webhook. e.g.

{
   "target_url": "https://myapp.com/paymo/notifications/hashyURL",
   "events": [
       "model.insert.Task",
       "model.update.Task",
       "model.delete.Task",
       "model.insert.Tasklist",
       "model.update.Tasklist",
       "model.delete.Tasklist"
    ],
    "secret": "Asecrethash"
}

Then if "events" is used to create the webhook, it can be marked as a "version 2" webhook internally so you can easily know what structure to send the payload in. This will allow backward compatibility with old code as they will still be using "event" and thus not accidentally opt-in to the new payload structure. You could even return a "version" field in the payload list response for easier identification of what type of webhook it is.

Dear Team,
if i try to add a project with more then one user, only the last user is added to the project.
Example:
Post request:
{'name': 'Testofffer 11', 'billable': True, 'client_id': '627795', 'users': [153071, 143143, 143149, 143152, 170937], 'managers': [143152], 'price': '14.00', 'flat_billing': True, 'adjustable_hours': True}
only the user 170937 and the maneger is added to the project. All other users are ignored.

How can i add more then one user to a new project?

Is it possible to add the field 'progress_satus' to the api. So we can see if the task is in todo, progress, done or backlog?

I can see retainer_id but not any endpoints to get retainer info beyond this. Is it possible to access this info through the API?

In the definition of the entry object you don't list the description field - although example show it being used.

Is there any way to filter includes - e.g. I have a GUI app I have written to add time on a caleendar with more precision and extra features compared to the timesheets web app (e.g. wrap one entry around another etc) - in this I need to load a list of clients, their projects and the taskslist and tasks for each project - but I noramally only want the active ones - so I was going to use a call to clients with where active=True and include of projects,projects.tasklists,projects.tasklists.tasks to get the client's projects and tasklists with child tasks for each. But how can I get just active ones on these child parts?

Hi, by default for a normal user it gives me the tasks of that user, I'm also getting the time entries

tasks?include=entries

But the administrator (I mean the one who is paying for Paymo, adding users, ...) is receiving all tasks, even if I filter like this

tasks?where=mytasks=true&include=entries

The authentication is by API Key.

There is an API to get current user ID? And why is not working the where=mytasks=true for the administrator?

As it's impossile to track the total number of tasks per project without either tracking the entire tasklist, or resyncing the project systematically.

With the project_id included, a model.delete.Task webhook could be used to track progress of projects.

Every Request with api/tasks?where=project_id=[ProjectId] and with api/projects/[ProjectID]
returns 'Access to project denied' but with the same token and request I can get the full list of Projects and also of Tasks.

Would it be possible to add pagination fields (like size and page) to all endpoints which are expected to return a list? i.e. endpoints like

• Getting projects
• Getting discussions
• Getting tasks
  etc...

Commonly these two fields would be in the query parameter, with size dictating maximum number of items in the response array and page indicating the offset of the results.

All attempts to use an API Key with JS generate a 401 response from cloudfront.net.

After stripping all code down to the bare essential native JS, the issue persists, even with newly generated API Keys. Am I missing something? (maybe I should ask StackOverflow, but I doubt I'll get much help there)

Available Documentation on Authentication is CURL specific, and not helpful in this regard. Further, none of the samples use an API-Key for auth.

Update/Resolution:

From your sample is see you use "apikey:ACTUAL_API_KEY", when you should use "ACTUAL_API_KEY:anystring". You API key should be provided as the username, that is the part before single colon (:). For the password (the part after the single colon) you can use any string, the examples use "XXX".

var xhr = new XMLHttpRequest();
xhr.timeout = 2000;
xhr.ontimeout = function() {
  console.log('XHR Timeout');
};
xhr.onreadystatechange = function() {
  if (xhr.readyState == 4) {
    if (xhr.status == 200) {
      console.log(xhr.responseText);
    } else {
      console.log('HT '+xhr.status+': '+xhr.statusText);
    }
  }
};

xhr.open('GET', 'https://app.paymoapp.com/api/projects', true);
xhr.setRequestHeader('Authorization', 'Basic ' +btoa(apikey:XXXXX'));
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.setRequestHeader('Accept', 'application/json');
xhr.send(null);

The insert hooks currently provided are not enough for most integrations. To make the API really useful, we also need update hooks. These can trigger any time an entry is edited. They don't have to contain information on the edit itself, it can be pulled separately. Use-case examples are:

• For tasks: there is currently no way to detect that a task has been marked "complete", so no full integration with a to-do app is possible
• For invocices no way to detect the status change from "Draft" to "Send". This is super important as one can save an invoice a couple of times while creating it, but only need an integration when it is complete (like send it to the accountants office)
• For clients so we would be able to update an address book when contacts change

I'm trying to create a task with the POST /api/task resource and send the following JSON data:

{
    "name":"TYS-123456 issue name",
    "description":"some description",
    "project_id":123456,
    "tasklist_id":654321
}

After sending this I get a "Missing required params: name, tasklist_id or project_id". However, all three parameters are given and are valid.

task list objects include a project id - but the API docs don't mention it

I suggest adding a way to create multiple tasks in one request. I'm working in a project that loads projects to paymo and I have to create many tasks at once. This is not good either for you or me, I have to make a lot of calls sequentially and I'm pretty sure your server is not happy about it.