---
title: "Move a task to another list, by ref"
method: POST
path: "/tasks/{id}/move"
tags: ["Tasks"]
---

# Move a task to another list, by ref

`POST /tasks/{id}/move`

## Request

- Base URL: `https://app.fareeqy.com/api/v1`
- URL: `https://app.fareeqy.com/api/v1/tasks/{id}/move`
- Auth: HTTP bearer

Moves the task to another task list, appended to the end. The destination
may be in another project of the company. With no project in the path,
`target_task_list_slug` must be the list's ref (lst-4m2qp): a slug is not
accepted here. Requires operation `tasks:write`.

## Request body

- object
  - `target_task_list_slug` string, required: The destination task list. On the nested address, its ref, slug or numeric id inside the same project. On the flat address, its ref only, and it may be in another project. Named _slug for compatibility.

## Response `200`

The moved task.

- TaskEnvelope
  - `data` Task
    - `id` string: The task ref. A slug is still accepted anywhere this is passed back.
    - `url` string, nullable: Absolute address of the page a person opens in فريقي.
    - `title` string
    - `notes` string, nullable: Plain-text rendering of the rich-text notes.
    - `completed` boolean
    - `completed_at` string, date-time, nullable
    - `due_at` string, date, nullable: Due DATE (no time component).
    - `time_spent_minutes` integer, nullable: How long the task took, in whole minutes. Always present, null when nobody has measured it — null is not zero. Reading it is ungated; writing needs a plan that carries time tracking.
    - `project_slug` string: The project ref. Named _slug for compatibility.
    - `task_list_slug` string: The task-list ref. Named _slug for compatibility.
    - `assignee` UserRef: A user reference — name for humans, email as the write handle.
      - `name` string
      - `email` string, email
    - `created_at` string, date-time

## Other responses

- `401`: Missing or invalid API key.
- `403`: Two different refusals share this status, and a client must tell them apart by `error.code`. `forbidden` means the key's scope or allowlist does not permit this operation, or Pundit denied the action. `plan_upgrade_required` means the company's plan carries no API access at all, so no key on it can ever succeed and there is nothing to retry.
- `404`: Resource not found or not accessible — also returned for EVERY endpoint when the company's `rest_api` feature flag is disabled (the surface is hidden). Lookups drill through the URL hierarchy, so another company's record is a 404 and never a leak. A path that matches no route at all answers 404 with the distinct code `unknown_endpoint` and echoes the path back, so a mistyped or half-built URL is told apart from a record that is missing or out of reach.
- `409`: A uniqueness/record conflict; retry.
- `422`: A caller-fixable bad request (validation error, bad date, bad enum).
- `429`: Either the company's daily API allowance is spent (`rate_limit_exceeded`), or the per-key / per-IP burst throttle of 300 requests per minute fired. Both come back after a wait, so `Retry-After` is honest here. **The two bodies are not the same shape.** The daily-quota refusal uses the standard error envelope. The burst throttle is served by Rack::Attack ahead of the application, so its body is a flat `{"error": "<string>"}` with no `code`. A client that reads `error.code` has to tolerate `error` being a plain string.

---

[API](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api.md) · [All operations](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fareeqy/apis/fareeqy-rest-api/revisions/dc964e05e3d2?raw)