Passa al contenuto principale

Update Task

PUT 
/v1/tasks/:task_id

Object-gated at EDIT 2026-09-09 — a Creator holding only a view-only grant on the viz could edit and delete its tasks. That was the residue of the write-route audit, which role-gated this route on 2026-09-08 with require_creator_or_admin; that closed WHO may write. WHAT they may write to was still resolved at PermissionType.VIEW — a Creator holding only a VIEW-level share on the viz (the same grant a Viewer legitimately holds) could still reach this handler and mutate the task, because get_access_filter's non-admin branch makes no VIEW/EDIT distinction. task_editor (this route's object gate) now resolves the row's viz at PermissionType.EDIT — the same axis models/viz/routes.py::viz_editor checks — and raises the same 404/403 this handler used to raise inline; only the layer moved.

Request​

Responses​

Successful Response