Settings and reset

One row, for the whole installation. The catalogue of each toggle is in Settings.

GET/api/settings

Role: Admin

The installation's settings: the single row that holds for every workspace.

Request

curl -s http://localhost:3000/api/settings \
  -H "Authorization: Bearer $TOKEN"

Response200

{
  "allowCrossProjectLinks": false,
  "cardInfoDisplay": "MODAL",
  "cardIdVisibility": "ALWAYS",
  "epicsEnabled": true,
  "createDefaultAction": "CARD",
  "calendarEnabled": true,
  "epicReorderEnabled": true,
  "uploadMode": "ALL",
  "tenantCreationEnabled": true,
  "columnManagementEnabled": true,
  "columnScope": "TENANT",
  "backupScheduleMode": "DAILY",
  "backupScheduleTime": "08:30",
  "backupScheduleWeekdays": [],
  "backupScheduleCron": null
}

Error responses

Code	When it happens
`401`	No credential, or one that no longer holds. Send the session cookie or the `Authorization: Bearer` header.
`403`	The account is not an admin. This prefix requires `ADMIN` in every method, reading included.

PATCH/api/settings

Role: Admin

Edits the settings. An absent field is not touched.

Request body

Field	Type	Description
`allowCrossProjectLinks`	`boolean`
`cardInfoDisplay`	`enum`	ACCORDION · MODAL
`cardIdVisibility`	`enum`	ALWAYS · HOVER
`epicsEnabled`	`boolean`	Turning it off deletes every epic, which is why it requires the phrase.
`createDefaultAction`	`enum`	CARD · PROJECT · EPIC
`calendarEnabled`	`boolean`
`epicReorderEnabled`	`boolean`
`uploadMode`	`enum`	`NONE` deletes no attachment: it applies to new uploads.NONE · IMAGE · ALL
`tenantCreationEnabled`	`boolean`
`columnManagementEnabled`	`boolean`
`columnScope`	`enum`	Switching it moves the cards into the new set's columns, in the same transaction.TENANT · PROJECT
`backupSchedule`	`objeto`	Goes in as an OBJECT (`mode`, `time`, `weekdays`, `cron`) and rearms the timer. `WEEKLY` with no day and `CRON` with no expression have no next occurrence.
`confirm`	`"REMOVER EPICS"`	Only alongside `epicsEnabled: false`.

Request

# the schedule goes in WHOLE, not field by field
curl -s -X PATCH http://localhost:3000/api/settings \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "backupSchedule": {
      "mode": "WEEKLY",
      "time": "03:00",
      "weekdays": [1, 4],
      "cron": null
    }
  }'

# turning epics off DELETES all of them: hence the phrase
curl -s -X PATCH http://localhost:3000/api/settings \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "epicsEnabled": false, "confirm": "REMOVER EPICS" }'

Response200

{
  "allowCrossProjectLinks": false,
  "cardInfoDisplay": "MODAL",
  "cardIdVisibility": "ALWAYS",
  "epicsEnabled": true,
  "createDefaultAction": "CARD",
  "calendarEnabled": true,
  "epicReorderEnabled": true,
  "uploadMode": "ALL",
  "tenantCreationEnabled": true,
  "columnManagementEnabled": true,
  "columnScope": "TENANT",
  "backupScheduleMode": "WEEKLY",
  "backupScheduleTime": "03:00",
  "backupScheduleWeekdays": [1, 4],
  "backupScheduleCron": null
}

Error responses

Code	When it happens
`401`	No credential, or one that no longer holds. Send the session cookie or the `Authorization: Bearer` header.
`403`	The account is not an admin. This prefix requires `ADMIN` in every method, reading included.
`403`	The installation is in demo mode, where backup, storage and accounts are off the air.
`422`	The confirmation phrase is missing, or came different. A destructive route requires the exact phrase in the body.
`422`	The body did not pass the schema. The `details` field carries zod's `fieldErrors` and `formErrors`, field by field.

POST/api/reset

Role: Admin

Deletes EVERYTHING: cards, projects, epics, labels, workspaces and the files.

Accounts are not deleted: deleting a user is /api/users/[id]. The response says how many records fell from each table.

Request body

Field	Type	Description
`confirm`required	`"APAGAR TUDO"`	Exactly `APAGAR TUDO`.

Request

curl -s -X POST http://localhost:3000/api/reset \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "confirm": "APAGAR TUDO" }'

Response200

{
  "cards": 42,
  "projects": 3,
  "epics": 5,
  "tags": 8,
  "relations": 11,
  "comments": 27,
  "attachments": 14,
  "tenants": 2,
  "columns": 10
}

Error responses

Code	When it happens
`401`	No credential, or one that no longer holds. Send the session cookie or the `Authorization: Bearer` header.
`403`	The account is not an admin. This prefix requires `ADMIN` in every method, reading included.
`403`	The installation is in demo mode, where backup, storage and accounts are off the air.
`422`	The confirmation phrase is missing, or came different. A destructive route requires the exact phrase in the body.