AssetCenter
Sign in Start for free

↑ ↓ to navigate · ↵ to open See all results
PATCH /api/v1/locations/{record}/todos/{todo}

Update a location to-do

Change only the supplied fields on this to-do.

Last updated

Request

PATCH /api/v1/locations/{record}/todos/{todo}

Requires locations:todos. See token permissions. Every listed permission is required for this endpoint.

Send Authorization: Bearer YOUR_API_TOKEN and Accept: application/json. Send request bodies as JSON with Content-Type: application/json, or as multipart/form-data when uploading attachments. This workflow write requires Idempotency-Key. Reuse the same key only when retrying the same action.

record is the numeric location ID in your token’s organization. todo is the numeric to-do ID belonging to this record; obtain it from the to-do list.

Query parameters

This endpoint does not use query parameters.

Request body

Field Type Usage
name string Required on creation; optional on PATCH, but cannot be empty. Up to 255 characters.
notes string or null Optional. Plain text, up to 10,000 characters.
due_date string or null Optional. YYYY-MM-DD.
assigned_to integer or null Optional. Organization user ID from the to-do options endpoint. A user is a login account; it is distinct from an inventory person.
is_complete boolean Optional. Set true to complete or false to reopen.
attachments[] file array Optional. Up to 10 files, each up to 10 MB: PNG, JPG, PDF, Word (.doc, .docx) or Excel (.xls, .xlsx). Requires a multipart/form-data body.
comments[] string array Optional. Up to 20 comments, each plain text up to 10,000 characters. Works in JSON or multipart bodies.

Example

Set ASSETCENTER_API_TOKEN as described in the quick start. Replace example record and option IDs with values from your organization. Set IDEMPOTENCY_KEY to a new UUID for this action; keep it for retries.

cURL / Bash 
curl --request PATCH "https://my.assetcenter.app/api/v1/locations/123/todos/77" \
  --header "Authorization: Bearer $ASSETCENTER_API_TOKEN" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --data '{"is_complete":true}'

To upload files, send multipart/form-data instead of JSON. Let curl set the Content-Type header, and send booleans as 1 or 0.

cURL / Bash 
curl --globoff --request PATCH "https://my.assetcenter.app/api/v1/locations/123/todos/77" \
  --header "Authorization: Bearer $ASSETCENTER_API_TOKEN" \
  --header "Accept: application/json" \
  --header "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --form "is_complete=1" \
  --form "comments[]=Photos taken on site." \
  --form "attachments[]=@report.pdf"

Response

200 OK. Illustrative response structure. Event arrays, to-do/space values, and current state depend on the action and the record.

JSON 
{
  "data": {
    "resource": "locations",
    "record_id": 123,
    "person_location_event_ids": [],
    "asset_event_ids": [],
    "subscription_event_ids": [],
    "todo": {
      "id": 77,
      "name": "Verify inventory",
      "notes": null,
      "due_date": null,
      "assigned_to": null,
      "created_by": 4,
      "is_complete": true,
      "created_at": "2026-09-07T16:00:00.000000Z",
      "updated_at": "2026-09-07T16:00:00.000000Z"
    },
    "space": null,
    "state": {
      "status": "active"
    },
    "attachments_count": 0,
    "comments_count": 0
  }
}

Behavior and constraints

Supply at least one supported field. The child must belong to this record. To-do notes are treated as plain text on input and may be HTML in responses.

Attachments and comments are saved on the to-do, and attachments_count and comments_count in the response confirm how many were added. Files are stored privately and count toward your plan’s storage; a request that would exceed it returns 422 with a plan error and changes nothing. If any file fails to save, the whole action is rolled back. An Idempotency-Key retry must resend the same files; a different file is a different request and returns 409.

Errors

401 means the token is missing, expired, revoked, or not a customer API token. 403 means a required permission or administrator access is missing. 404 means the record or child record is unavailable in this organization. 422 identifies invalid or unsupported input; inspect the errors object when present. 409 indicates a conflicting state or concurrent change; inspect the message and refresh the record before deciding how to proceed. Reusing an idempotency key with a different method, path, or body also returns 409. 429 means a rate limit was reached. See error handling and rate limits.