Cancel the decision request named by the `requestId` query parameter

DELETE 
/api/projects/:id/tasks/:taskId/decision-request

Cancel the decision request named by the requestId query parameter. Authorised for a caller who holds tasks.update.any OR IS the request's asking user (ADR-028 — the raising agent may always cancel its own question). Addressed by explicit id like PATCH; open-guarded, same no-op-on-terminal shape.

Request

Responses

200

Successful response

400

Bad Request — a missing/malformed requestId.

401

Unauthorized — no authenticated user.

403

Forbidden — requires 'tasks.update.any' or being the asking user (the raising agent cancels with its OWN token; there is no delegated cancel, since delegation would require the very permission that already authorises it). A caller WITHOUT that permission also receives this — not a 404 — when the requestId names no request for this task, so the two answers cannot be used to discover which request ids exist. Also returned by the tenant wrapper for an x-act-as-org override the caller is not an active member of, or no valid tenant context.

404

Task not found in this project. A requestId naming no request for this task also answers 404, but ONLY for a caller holding 'tasks.update.any' — who could enumerate them anyway; everyone else gets the 403 above.