Microsoft Azure Microsoft To Do API (Graph)

What authentication does the Microsoft To Do API use?

The API uses OAuth 2.0 bearer tokens issued by Microsoft identity platform, sent in the standard Authorization header as configured by the bearerAuth scheme. The token must be granted Tasks.ReadWrite delegated permission for the signed-in user. Through Jentic, the bearer token is held in the encrypted vault and never exposed to the agent's context.

Can I create checklist items under a task with this API?

Yes. After creating a task with POST /me/todo/lists/{todoTaskListId}/tasks, you can add granular subtasks using the checklist items endpoints under that task. The same data appears as the in-app checklist beneath the task in Microsoft To Do.

What are the rate limits for the Microsoft To Do API?

Microsoft Graph applies per-app and per-user throttling limits documented under the Graph throttling guidance. To Do operations fall under the Outlook service limits, typically 10,000 requests per 10 minutes per app per mailbox. Expect a 429 response with a Retry-After header when limits are hit.

How do I create a task in Microsoft To Do through Jentic?

Run pip install jentic, then use the Python SDK to search for 'create a task in microsoft to do', load the schema for POST /me/todo/lists/{todoTaskListId}/tasks, and execute with the list id and task body. Jentic injects the scoped Graph token automatically.

Does this API cover team or shared task lists?

No. The endpoints in this spec target /me/todo, which is the signed-in user's personal To Do data. For team task management on the same Graph, use Microsoft Planner or Microsoft Teams APIs instead.

Can I limit what my agent is allowed to do with the Microsoft To Do API?

Yes. Because you run Jentic One yourself, your own rules decide which Microsoft Graph To Do operations the agent may call, so you can allow it to create and read tasks while withholding operations like DELETE /me/todo/lists/{todoTaskListId} that rename or delete a list. Since Graph puts the list in the URL path (/me/todo/lists/{todoTaskListId}/tasks), a rule can pin the agent to a single task list rather than the whole account. The scoped Graph bearer token stays in your instance and is injected only for the operations you permit, so the agent never sees the raw credential.