List customer tasks for a data table

When to use this endpoint

Use Customer_getEventsDT only for the CRM1 Tasks panel on a customer record. Despite “Events” in the function name, it reads tenant task rows whose client_id equals the customer ID.

Callers that need a security-enforced task API should not treat the client-supplied privacy flag as an authorization boundary.

Authentication and permissions

The request must authenticate with signed API-key fields or a logged-in CRM session. The handler performs no additional page or role-permission check.

The lookup and any write use the authenticated tenant; an ID from another tenant cannot be addressed through this call.

Parameters

Parameter	Type	Required	Description
`customer_id`	Integer string	Yes	Value matched to task `client_id`. Zero, negative, and nonexistent customer IDs are not explicitly rejected.
`start`	Integer string	Yes	Zero-based row offset. Presence, not range, is validated.
`length`	Integer string	Yes	Page size. Presence, not range, is validated.
`draw`	Integer string	Yes	DataTables counter copied to the response after integer conversion.
`order[0][dir]`	String	Yes	Exact `desc` selects descending; other values select ascending.
`order[0][column]`	Integer string	No	`1` creation date, `2` assigned-user name, or `5` status. Other and omitted values use creation date.
`search[value]`	String	No	Read and trimmed, but ignored by the implementation; it does not change rows or counts.
`is_superuser`	Integer string	No	When present and equal to `0`, adds a predicate intended to retain tasks assigned to or created by the current user plus rows with `privacy=1`. When omitted or non-zero, no privacy predicate is added. This is client-supplied behavior, not a server-side role check.

Example request

$tasks = FM_api('Customer_getEventsDT', [
	'customer_id' => '1088',
	'start' => '0',
	'length' => '25',
	'draw' => '10',
	'order' => [['column' => '1', 'dir' => 'desc']],
	'is_superuser' => '0',
]);

Example response

{
  "draw": 10,
  "recordsTotal": "2",
  "recordsFiltered": "1",
  "data": [
    ["77", "2026-09-24 09:15:00", ["36","Aoife Murphy"], "Call customer", "Confirm access time", "", "0", ""]
  ]
}

Each positional row is task ID, creation date, [assigned user ID, name], subject, details, resolution, status, and a blank action placeholder.

Errors and unusual responses

Response	Condition
`{"error":"not logged in"}`	No authenticated tenant context is available. Invalid signed credentials can be rejected by the dispatcher before the handler runs.
`{"error":"missing or invalid parameter: start"}`	`start` is absent.
`{"error":"missing or invalid parameter: length"}`	`length` is absent.
`{"error":"missing or invalid parameter: customer_id"}`	`customer_id` is absent.
`{"error":"missing or invalid parameter: [order][0][dir]"}`	The sort direction is absent.
`{"error":"missing or invalid parameter: draw"}`	`draw` is absent.

Legacy application errors may be returned with HTTP 200. Check the decoded response for error, not only the HTTP status.

Behaviour and edge cases

Privacy is not derived from the authenticated user’s role. The endpoint trusts the optional is_superuser request value. CRM1 currently sends a differently named view_private value, which this handler ignores, so the privacy restriction is not applied to that production call.

recordsTotal counts all tasks for the customer. recordsFiltered differs only when the recognized privacy flag is active; search never filters.
The paged data query aliases the task table as t, but the optional privacy predicate refers to the table by its full prefixed name. Database engines that require alias-only references can reject that query; the production CRM1 call does not activate this path.
No task deletion predicate is applied, even though tasks participate in the platform’s soft-delete model. Deleted matching rows can therefore be included.
The endpoint does not verify that the customer exists and does not inspect customer active/deleted state.

See it in Fieldmotion

CRM1

Open a customer and select Tasks. Filter Network requests for Customer_getEventsDT. CRM1 sends view_private, not the handler’s is_superuser parameter; changing the table search sends a value that the endpoint ignores.

CRM2

A source search found no CRM2 caller for this endpoint.

Related endpoints

Customer_get retrieves the customer whose ID is stored as each task’s client_id.
The customer Jobs data-table endpoint is separate and does not return tasks.