The cycles this task MAY JOIN (PT-948) — the read half of the three cycle-membership rules, for a cycle picker
GET/api/projects/:id/tasks/:taskId/eligible-cycles
The cycles this task MAY JOIN (PT-948) — the read half of the three cycle-membership rules, for a cycle picker. A cycle is scoped to a project XOR an initiative XOR a project set, and each arm decides differently: the project arm needs the task's own project, the project-set arm needs a set that NAMES that project, and the initiative arm needs an epic in the task chain tagged to that initiative — the task itself when it is a tagged EPIC, its epic, or its PARENT's epic (a subtask inherits its parent's epic). That last hop is why a client cannot compute this list itself. The result agrees with what a write would accept, on BOTH halves of the PT-895 scope freeze: archived cycles are excluded as targets, and so is every completed cycle — including one the task is ALREADY in, since this answers "may join"; and a task whose CURRENT cycle is completed gets an EMPTY list, because it may not leave that cycle at all. The shape is the same slim cycle-option row (id / name / owner) that GET /api/cycles?options=1 returns. Gated on project access plus tasks.read in the PROJECT's organisation. The project arm works CROSS-ORG, like every project-scoped read. The initiative and project-set arms do NOT: they enumerate an organisation rather than one already-verified project, so they additionally require that organisation to be the caller's ACTIVE one, plus an ACTIVE membership of it, some projects.read, and the same permission gates GET /api/cycles applies. A cross-org caller therefore sees only their project's own cycles until they switch organisation. Treat the subset relationship to GET /api/cycles as intent rather than a guarantee: the two still resolve membership through different lookups (tenant-keyed here, organisation-keyed there), so a membership whose nullable organisation_id is null or divergent is admitted here and refused there. A task that is not in the path project is a 404
Request
Responses
- 200
- 401
- 403
- 404
Successful response
Unauthorized — authentication credentials are missing or invalid
Forbidden — the project is inaccessible or unknown, the project or task id is malformed, the project has no organisation, the caller lacks tasks.read (which a tasks.read.own grant does NOT satisfy: the platform matcher fails closed with no owner context), or the x-act-as-org selector named a non-member org.
Task not found in this project