Task API Endpoints: CRUD, Kanban, and Task Assignments

All task endpoints require a valid authenticated session and email verification. Visibility is further governed by role: admins see all tasks; editors see tasks they created, are assigned to, or are mentioned in; viewers see only tasks they are directly assigned to. Mutations such as creating or deleting tasks additionally require the admin or editor role.

Task CRUD

GET /tasks

Returns the paginated task list for the current user, filtered by the visibleTo scope. Tasks are ordered by last_activity_at descending, 20 per page. Each task is loaded with its project, creator, and assignment records. Role: any authenticated user Response: HTML view (tasks.index).

GET /tasks/board

Renders the Kanban board with tasks grouped into five status columns: created, accepted, in_progress, in_review, and done. Within each column, tasks are ordered by sort_order then id. The board also flags whether each task is assigned to the currently authenticated user. Role: any authenticated user Response: HTML view (tasks.board).

GET /tasks/create

Displays the new-task form, pre-populated with the list of active projects, available priorities, and available statuses. Role: admin or editor (viewers receive 403) Response: HTML view (tasks.create).

POST /tasks

Creates a new task and optionally assigns users to it. On success, the user is redirected to the new task’s detail page. Role: admin or editor

title

string

required

Task title. Minimum 3 characters, maximum 255 characters.

description

string

Full task description. Maximum 5000 characters. Supports @mention syntax for notifying users.

project_id

integer

ID of an existing active project to associate with the task. Pass null or omit to create an unassigned task.

priority

string

default:"normal"

Task priority. One of: critical, high, normal, low.

due_at

date

Due date in any format accepted by PHP’s date() function (e.g. 2026-08-15 or 2026-08-15T14:00:00). Pass null or omit for no due date.

assignee_ids

array

Array of user IDs to assign to the task. Each ID must exist in the users table. Assignment notifications are sent to each assignee.

Response: 302 redirect to GET /tasks/{id} with status flash "Task created successfully.". Returns 403 for viewers; returns validation errors on invalid input.

GET /tasks/

Displays the full detail view for a single task, including project, creator, assignments, comments, attachments, time entries, tags, dependencies, and subtasks. Role: any authenticated user who can view the task (policy-controlled). Returns 403 if the task is outside the user’s visibility scope. Response: HTML view (tasks.show).

GET /tasks//edit

Displays the edit form for a task. Role: admin, or editor who is the task creator. Returns 403 for viewers and for editors who did not create the task. Response: HTML view (tasks.edit).

PATCH /tasks/

Updates an existing task. Fields are optional — only the fields you send are changed. Role: admin, or editor who created the task (enforced by UpdateTaskRequest::authorize()).

title

string

Updated title. Minimum 3 characters, maximum 255 characters.

description

string

Updated description. Maximum 5000 characters.

priority

string

Updated priority. One of: critical, high, normal, low.

due_at

date

Updated due date. Pass an empty string or null to clear it.

project_id

integer

Updated project association. Pass null to unlink from any project.

Response: 302 redirect to GET /tasks/{id} with status flash "Task updated successfully.".

DELETE /tasks/

Permanently deletes a task and fires the DeleteTaskAction, which handles cascading cleanup and audit logging. Role: admin, or editor who created the task. Response: 302 redirect to GET /tasks with status flash "Task deleted successfully.". Returns 403 on policy denial.

Status and Kanban

PATCH /tasks//change-status

Changes the status of a task from the Kanban board and updates the sort_order of tasks in both the source and destination columns. This is a JSON endpoint used by the drag-and-drop board UI. Role: any authenticated user (policy enforcement is handled inside ChangeTaskStatusAction).

status

string

required

The target status. Must be one of: created, accepted, in_progress, in_review, done.

from_ordered_task_ids

array

required

Array of task IDs representing the new order of the source column after the task is removed, ordered from top to bottom.

to_ordered_task_ids

array

required

Array of task IDs representing the new order of the destination column after the task is inserted, ordered from top to bottom.

Example request:

PATCH /tasks/42/change-status
Content-Type: application/json
X-XSRF-TOKEN: your-csrf-token

{
  "status": "in_progress",
  "from_ordered_task_ids": [3, 1, 5],
  "to_ordered_task_ids": [7, 42]
}

Example success response:

{"success": true}

Example error responses:

{"error": "You are not authorized to change this task status."}

{"error": "Invalid status transition."}

HTTP status codes returned: 200 on success, 403 on authorization failure, 400 on any other exception.

PATCH /tasks//move

Moves a task within or across Kanban columns, supporting drag-and-drop reordering within the same status. If to_status differs from the task’s current status, the ChangeTaskStatusAction is also invoked. Role: any authenticated user (authorization enforced by MoveTaskRequest::authorize()).

to_status

string

required

Target status column. One of: created, accepted, in_progress, in_review, done.

from_ordered_task_ids

array

Updated order of the source column. Optional — drag events can be racy.

to_ordered_task_ids

array

required

Updated order of the destination column after the task is placed.

Response (JSON): {"ok": true} on success. {"message": "..."} with HTTP 403 or 422 on failure.

Assignments

POST /tasks/assignments//accept

Accepts a pending task assignment. If the task’s current status is created, it is automatically transitioned to accepted via ChangeTaskStatusAction. Role: the user who owns the assignment (returns 403 if assignment.user_id !== auth()->id()). Response: 302 redirect to GET /tasks/{task} with success flash "Assignment accepted.".

POST /tasks/assignments//reject

Rejects and removes a pending task assignment, updating last_activity_at on the parent task. Role: the user who owns the assignment. Response: 302 redirect to GET /tasks/{task} with success flash "Assignment rejected.".

DELETE /tasks/assignments/

Removes a user from a task’s assignment list. This is distinct from the assignee rejecting — it is performed by the task creator or an admin. Role: admin, or the user who created the parent task. Response: 302 redirect to GET /tasks/{task} with success flash "User unassigned from task.". Returns 403 if the actor is neither admin nor task creator.

Comments

POST /tasks//comments

Adds a comment to a task. The comment body may include @username mentions, which trigger notifications to the mentioned users via CommentTaskAction. Role: any authenticated user

body

string

required

Comment text. Maximum 5000 characters. Supports @mention syntax.

Response: 302 redirect to GET /tasks/{task} with success flash "Comment added." or error flash on failure.

DELETE /tasks//comments/

Deletes a single comment from a task. Role: the comment author, or any admin. Response: 302 redirect to GET /tasks/{task} with success flash "Comment deleted.". Returns 403 if the actor is neither the author nor an admin.

Attachments

POST /tasks//attachments

Uploads a file and attaches it to a task. The file is stored via UploadTaskAttachmentAction, which creates both a TaskAttachment record and an initial TaskAttachmentVersion. Role: any authenticated user
Content-Type: multipart/form-data

file

required

The file to upload. Maximum size: 100 MB. Any file type is accepted.

label

string

Optional human-readable label for the attachment. Maximum 255 characters.

Response: 302 redirect to GET /tasks/{task} with success flash "File uploaded successfully." or error flash on failure.

GET /tasks//attachments//download

Downloads the latest version of an attachment as a binary file response. Role: any user who can view the parent task (policy-checked). Returns 403 otherwise. Response: Binary file download using the attachment’s original filename. The file is served from Laravel’s public storage disk.

DELETE /tasks//attachments/

Deletes an attachment and all of its stored file versions from disk. Role: the user who uploaded the attachment, or any admin. Response: 302 redirect to GET /tasks/{task} with success flash "Attachment deleted.". Returns 403 if the actor is neither the uploader nor an admin.

Overview

Endpoints

Task API Endpoints: CRUD, Kanban, and Task Assignments

Task CRUD

GET /tasks

GET /tasks/board

GET /tasks/create

POST /tasks

GET /tasks/

GET /tasks//edit

PATCH /tasks/

DELETE /tasks/

Status and Kanban

PATCH /tasks//change-status

PATCH /tasks//move

Assignments

POST /tasks/assignments//accept

POST /tasks/assignments//reject

DELETE /tasks/assignments/

Comments

POST /tasks//comments

DELETE /tasks//comments/

Attachments

POST /tasks//attachments

GET /tasks//attachments//download

DELETE /tasks//attachments/

Build docs developers (and LLMs) love

Overview

Endpoints

Documentation Index

​Task CRUD

​GET /tasks

​GET /tasks/board

​GET /tasks/create

​POST /tasks

​GET /tasks/

​GET /tasks//edit

​PATCH /tasks/

​DELETE /tasks/

​Status and Kanban

​PATCH /tasks//change-status

​PATCH /tasks//move

​Assignments

​POST /tasks/assignments//accept

​POST /tasks/assignments//reject

​DELETE /tasks/assignments/

​Comments

​POST /tasks//comments

​DELETE /tasks//comments/

​Attachments

​POST /tasks//attachments

​GET /tasks//attachments//download

​DELETE /tasks//attachments/

Build docs developers (and LLMs) love

Task CRUD

GET /tasks

GET /tasks/board

GET /tasks/create

POST /tasks

GET /tasks/

GET /tasks//edit

PATCH /tasks/

DELETE /tasks/

Status and Kanban

PATCH /tasks//change-status

PATCH /tasks//move

Assignments

POST /tasks/assignments//accept

POST /tasks/assignments//reject

DELETE /tasks/assignments/

Comments

POST /tasks//comments

DELETE /tasks//comments/

Attachments

POST /tasks//attachments

GET /tasks//attachments//download

DELETE /tasks//attachments/