Add input while work is open
curl -sS https://tycoon.us/api/public/tasks/cm.../messages \
-H "Authorization: Bearer $TYCOON_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: launch-research-followup-1" \
-d '{"message":"Prioritize competitors selling to teams under 50 people."}'
message is required and limited to 20,000 characters. The first accepted
response is 202. A same-body replay is 200 and does not create another
Comment or wake. A message to a terminal Task returns 409.
Resolve a required action from your backend
When GET /tasks/{id} or a task.requires_action webhook returns an action
with api_resolvable: true, resolve that exact version through the canonical
ApprovalRequest owner:
curl -sS https://tycoon.us/api/public/tasks/cm.../actions/apr.../resolve \
-H "Authorization: Bearer $TYCOON_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: organic-growth-decision-1" \
-d '{
"action": "approve",
"action_version": 7,
"answers": [{
"item_id": "cm...::q1",
"value": "Technical SEO"
}]
}'
An accepted first decision returns 202; a same-body replay returns 200:
{
"task_id": "cm...",
"approval_id": "apr...",
"accepted": true,
"status": "approved",
"idempotent_replay": false
}
Use action: "reject" with no selection or answers to reject. For a choice or
free-text question, include one answers entry for each required item. A
choice that disallows custom input accepts only the safe option labels returned
by GET; use selected_item_ids for itemized approve/confirm decisions. The
client must send the current action_version: if the request was changed or
settled concurrently, Tycoon returns 409 and the caller should fetch the
Task again. The endpoint records the same canonical decision, action effects,
and durable wake as the authenticated app; it does not reveal its hidden
execution state.
An action with api_resolvable: false needs that interactive safe flow (for
example, encrypted browser credential entry) and cannot be bypassed by an API
key — follow the authenticated action_url in those cases. The endpoint does
not accept credentials. Actions raised by hidden child execution are projected
on the root Task, so callers do not need access to the child graph.