Read Goal Detail
Changed onOne goal in full, for the conversation that settled it.
The owner's read: the page every reader gets (#3057), plus the goal id every write takes, the status, and whether an app holds it. Owning it means holding the goals cookie, exactly as it does for publishing: an athlete settles goals before they have an account, so the browser session IS the identity here (#1851). Since #2635 an install's Firebase uid resolves that same session, and on the bearer the account that holds the goal reads it too (:func:_readable_goal_or_404), so the app reads every goal its account holds and nobody else's.
Safe, so the cookie alone is enough — no CSRF token and no Origin, like the conversation read. A goal owned by someone else 404s rather than 403s, so the status code cannot be used to tell a real goal id from an invented one.
Request
- Base URLhttps://api.imperfect.co (the document declares no server; this is the origin it was published from)
- URLhttps://api.imperfect.co/goals/{goal_id}
- AuthHTTP bearer
Path parameters
Headers
Response
Successful Response
Changes
- warning
removed the optional property
//from the response with the status - info
added the optional property
//to the response with the status
- warning
- info
added the optional property
to the response with the status
- info