Tasks
API

The endpoint answers one question: what is still open in this family right now? It returns every member of the family — so a consumer knows who to draw, even for people with nothing to do — each member's open tasks in display order, and any unclaimed pool tasks that nobody has taken yet.

It is strictly read-only. There is no way to create, complete, edit or delete a task through this API. A leaked join code exposes task titles and deadlines to whoever holds it — it can never be used to change anything.

The endpoint is part of the Klar unlock. Families without it receive 403 with {"error": "This feature requires Klar Premium"}. The unlock is per family, not per device, so any member's purchase enables the API for the whole household.

GET https://api.studiocato.io/klar/tasks?code=KLAR-XXXX-XXXX

CORS is open (Access-Control-Allow-Origin: *), so the endpoint can be called directly from a browser context if needed. Fetching from a server-side process is still recommended — it keeps the join code out of the browser. See polling.

Authentication is the join code itself, passed as the code query parameter. There is no bearer token, no API key, no session.

?code=KLAR-1234-5678

The code is case-insensitive and whitespace-trimmed; klar-1234-5678 works.

Only Owner and Parent codes are accepted. A child's join code returns 403. A child's code grants visibility into their own tasks in the app, and this endpoint returns the whole family — so it requires a code that already has family-wide visibility.

Find a code in the Klar app under Settings → Join code, or for another member under Settings → Manage family.

10 requests per hour, per public IP address.

This endpoint's budget is tracked separately from the Klar app's own join-code rate limit, so display polling never locks anyone out of joining the family.

curl -s "https://api.studiocato.io/klar/tasks?code=KLAR-1234-5678"

With status code and pretty printing, which is what you want while setting up:

curl -s -w "\nHTTP %{http_code}\n" \
  "https://api.studiocato.io/klar/tasks?code=KLAR-1234-5678" \
  | jq .

200 OK

{
  "family": "Lindqvist",
  "generated_at": "2026-05-23T13:00:00.000Z",
  "members": [
    {
      "name": "Maja",
      "role": "child",
      "tasks": [
        {
          "title": "Walk the dog",
          "deadline": "2026-05-23T16:00:00.000Z",
          "overdue": true,
          "compensation": null
        },
        {
          "title": "Clean the bathroom",
          "deadline": "2026-05-24T10:00:00.000Z",
          "overdue": false,
          "compensation": null
        }
      ]
    },
    {
      "name": "Lukas",
      "role": "child",
      "tasks": [
        {
          "title": "Empty the dishwasher",
          "deadline": "2026-05-23T17:00:00.000Z",
          "overdue": false,
          "compensation": null
        }
      ]
    }
  ],
  "pool": [
    {
      "title": "Mow the lawn",
      "deadline": null,
      "compensation": 75
    }
  ]
}

Task order within a member — overdue first, then by nearest deadline, then tasks with no deadline last. Render the array as-is; it is already in display order.

Pool entries have no overdue field — an unclaimed task has no one to be late. They are sorted by nearest deadline, with undated tasks last. Once someone claims a pool task it leaves this array and appears under that member instead, with an overdue field like any other task.

Every error is JSON in the shape {"error": "..."}.

Both premium and permission failures use 403, so branch on the error string, not the status code, to show a distinct message.

Members are identified by name alone. Two members with the same name are indistinguishable in this payload.

Recommended interval: 10 minutes (600000 ms). The rate limit is 10 requests per hour and every request counts, which puts a hard ceiling on poll frequency.

A 10-minute interval is plenty in practice. Klar's own reminder engine only runs every 15 minutes, so a consumer is never more stale than the notifications the family already receives.

A complete polling client is about fifteen lines. The three things that matter are the fetch interval, the split between fatal and transient errors, and holding on to the last good payload.

const ENDPOINT  = "https://api.studiocato.io/klar/tasks";
const JOIN_CODE = "KLAR-1234-5678";   // Owner or Parent code — treat as a password
const INTERVAL  = 10 * 60 * 1000;     // 10 minutes — see Polling

let cached = null;

async function poll() {
    const res = await fetch(`${ENDPOINT}?code=${encodeURIComponent(JOIN_CODE)}`);

    if (res.status === 401 || res.status === 403) {
        const { error } = await res.json();
        stop(error);   // configuration error — stop polling, surface the message
        return;
    }
    if (!res.ok) return;   // 429 or 500 — keep the cached payload, try again next tick

    cached = await res.json();
    render(cached);
}

poll();
setInterval(poll, INTERVAL);

Additive changes — new fields on existing objects — may ship in a v1 response without notice. Parse defensively and ignore unknown fields. Anything that removes or renames a field, or changes a type, will ship as a new endpoint path and be recorded here.