PT-611 write-guard-aligned Assignee picker options for the task-detail Assignee field and the task create / add-subtask form
GET/api/projects/:id/assignable-users
PT-611 write-guard-aligned Assignee picker options for the task-detail Assignee field and the task create / add-subtask form. The people analogue of /api/projects/{id}/epic-options. Unlike mentionable-users?assignable=true — a visibility list that offers every ACTIVE non-guest org member — this endpoint offers only users who pass the same predicate the task write guard (assertAssigneeAssignable → verifyUserProjectAccess) enforces on save: the project creator, an ACTIVE collaborator (including cross-org collaborators), or an INTERNAL member with full-scope projects.read. Guest Customers and synthetic agent users are excluded. An INTERNAL member holding only projects.read.own who is neither creator nor collaborator is therefore NOT offered — the picker no longer surfaces candidates the PATCH would reject with a 400. The candidate pool is the same requester-scoped visibility set mentionable-users builds, then narrowed, so a scoped caller can never enumerate more org members here than there. Options are the minimal { id, name } picker shape (no email), sorted by name. The guard is evaluated against fetch-time state; the PATCH independently re-validates on save.
Request
Responses
- 200
- 401
- 403
Successful response
Unauthorized — authentication credentials are missing or invalid
Forbidden — the caller cannot read the project. A malformed (non-UUID) path id collapses to the same uniform 403, so the endpoint is not a project-existence oracle.