Sync desktop activity summaries

Request

POST https://www.tracktimer.app/api/v1/activity/sync with Authorization: Bearer YOUR_API_KEY and Content-Type: application/json. The current activity:classify scope also covers summary sync, so existing desktop keys keep working. Send 1–20 total episode uploads and deletion IDs per request; the complete body is limited to 65536 bytes. Unknown fields are rejected.

An episode contains its UUID, 64-character lowercase evidence revision, start and end timestamps with timezone (end after start, at most 20 minutes apart), title (1–100 characters), summary (1–600 characters), category, optional canonical projectId, and up to 12 app names. Send no OCR text, window titles, screenshots, observation samples, or provider credentials. If a project is no longer in the key owner's assigned, active roster, the episode is saved without that project link. deletedEpisodeIds removes matching episodes owned by this key's user and workspace. Repeating the same batch is safe.

{"episodes":[{"episodeId":"11111111-1111-4111-8111-111111111111","revision":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","start":"2026-09-23T09:00:00Z","end":"2026-09-23T09:15:00Z","title":"Reviewed project tests","summary":"Reviewed visible test results in the terminal.","category":"development","projectId":null,"applications":["Terminal"]}],"deletedEpisodeIds":[]}

Response — 200

{"accepted":1,"deleted":0}

The counts acknowledge the requested items, including already-synced episodes or deletion IDs that were already absent. The server selects workspace and user from the key, and never creates or edits tracked time. My Time shows these personal activity summaries and can suggest a description for a completed entry when a project-matched episode overlaps its timer interval. People choose whether to save that description.

Privacy and errors

These generated summaries, time ranges, category, project link, and app names are persisted in the workspace database. Local screenshots and OCR are not uploaded by this endpoint. Responses are private and no-store. API key authentication/scope failures return 401/403; malformed JSON or fields return 400; oversized bodies return 413; non-JSON content returns 415; shared rate limits return 429. Retry transport and 5xx failures with bounded backoff; a successful retry cannot duplicate episodes. See authentication and errors and retries.