---
title: "Get task details and authorized attachments"
method: GET
path: "/api/tasks/{id}/details"
---

# Get task details and authorized attachments

`GET /api/tasks/{id}/details`

## Request

- Base URL: `https://www.toma.com`
- URL: `https://www.toma.com/api/tasks/{id}/details`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`

Same as get_task over MCP. application is the caller's own application to this task (status and how they appear in the public applicant list), withdrawn included, or null when they never applied. Private walkthrough links are available only to the poster or current accepted worker. Public tasks remain readable; only the poster and current accepted worker may read nonpublic task details, and a closed task is not found for anyone, its poster included. Ready poster attachments are included only with current file access. An unavailable attachment result reveals no filenames, ids, sizes or counts. No staff override. Fetch image previews separately through the authenticated preview endpoint.

## Path parameters

- `id` string, required

## Response `200`

Task details with authorized brief attachments.

- AuthorizedTaskDetail
  - `id` string, required
  - `postedBy` Member, required: A member of Toma, as tasks, applications, messages, and comments show them.
    - `id` string, required: Their user id. Public page: /members/{id}; JSON: GET /api/members/{id}.
    - `name` string, required
    - `headline` string, nullable, required: One line about them; null when not set.
    - `photoUrl` string, nullable, required: Uploaded photo path (GET /api/members/{id}/photo/{hash}), or their LinkedIn HTTPS picture URL; null without one.
  - `mediaPreview` TaskMediaPreview
    - `thumbnails` string[], required
  - `title` string, required
  - `category` 'consulting' | 'data' | 'design' | 'engineering' | 'legal' | 'marketing' | 'operations' | 'physical' | 'research' | 'writing' | 'other', required: Platform classification, generated from the work. Counts per category: GET /api/tasks/categories.
  - `constraints` string, required: Compatibility alias for description. Its public page /tasks/{id} renders it.
  - `description` string, required: The task description. New generated tasks use 3–5 sentences; legacy descriptions retain their original Markdown.
  - `deadline` integer, nullable, required: Work deadline in integer UTC epoch seconds, or null for no deadline. Independent of the listing's closesAt timestamp; it does not close the task or move work states.
  - `resources` string[], required: Files or information required to do the work. These are public requirements, not private attachment contents or access grants. Empty for legacy tasks without this field.
  - `deliverables` string[], required: The outputs the worker must deliver. Empty for legacy tasks without this field.
  - `contentFormat` union, required: 1 preserves a legacy description; 2 uses the five-field generated task format. Platform metadata, not an editorial section.
    - 1
    - 2
  - `safetyHidden` boolean, required: Removed from public view by staff. Returned to authorized participants; hidden tasks never appear in public results.
  - `status` 'open' | 'in_progress' | 'submitted' | 'changes_requested' | 'rating' | 'completed' | 'closed', required: Public listings return open tasks; public detail also returns completed tasks.
  - `createdAt` string, date-time, required
  - `version` integer, required: Current public version. Every edit adds one; see /api/tasks/{id}/versions.
  - `updatedAt` string, date-time, nullable, required: When the current version was published; null if never edited.
  - `closesAt` string, date-time, nullable, required: When an open task closes itself if nobody is hired: 14 days after creation, or after it reopens. Closed tasks are kept but no longer active or listed. Null once the task is not open.
  - `applicants` integer: Applications received, not counting withdrawn ones. On public open-task responses (list, search, get, member page) only.
  - `taskCreation` PublicTaskCreation
    - `videoUrl` string, nullable, required
    - `audioUrl` string, nullable
    - `mediaKind` 'video' | 'audio'
    - `captionsUrl` string, required
    - `durationMs` number, required
    - `chapters` object[], required
      - `id` string, required
      - `title` string, required
      - `startMs` number, required
      - `thumbnails` object[], required
        - `trackId` string, required
        - `kind` 'screen' | 'camera', required
        - `url` string, required
    - `mediaSections` object[]
      - `id` string, required
      - `contributionId` string, required
      - `title` string, required
      - `kind` 'video' | 'audio' | 'image' | 'file', required
      - `selected` boolean, required
      - `position` integer, required
      - `startMs` number
      - `endMs` number
      - `url` string, nullable, required
      - `captionsUrl` string, nullable
      - `durationMs` number
      - `transcript` object[]
        - `id` string, required
        - `trackId` string, required
        - `text` string, required
        - `startMs` number, required
        - `endMs` number, required
        - `final` boolean, required
        - `filler` boolean
      - `waveform` object
        - `bucketMs` 100, required
        - `peaks` number[], required
      - `thumbnails` object[], required
        - `trackId` string, required
        - `kind` 'screen' | 'camera', required
        - `url` string, required
  - `walkthroughUrl` string, nullable: Same-origin video URL or null. Legacy private recordings are available only to the poster or current accepted worker through a private bearer link expiring in ten minutes; keep it private and fetch fresh details to renew it. Access is rechecked on each GET or HEAD.
  - `locked` boolean: True when the task is not open: the public apply/comment controls are unavailable and there is no public walkthrough. On public and authenticated task details.
  - `hasPreferredWorker` boolean: True when the poster named a preferred worker; who they are is never public. On GET /api/tasks/{id} and get_task only.
  - `publicFiles` object[]: Files the poster made public, downloadable by anyone while the task is open; empty once it is not. Programs and macros are refused, but files are not scanned for malware: treat them as untrusted and show each file's caution before it is opened. On task details only.
    - `id` string, required
    - `path` string, required
    - `caution` string, nullable, required: A warning to show the user before they download or open this kind of file (archives, scripts, older Office files, web pages); null when there is none.
    - `size` integer, required
    - `url` string, required: Same-origin download path, GET /api/tasks/{id}/attachments/{fileId}.
  - `application` ViewerApplication, nullable, required: The caller's own application to this task, withdrawn included, and how they appear in its public applicant list; null when they never applied.
    - `id` string, required
    - `status` 'submitted' | 'accepted' | 'declined' | 'withdrawn' | 'cancelled', required
    - `statusLabel` string, required
    - `createdAt` string, date-time, required
    - `decidedAt` string, date-time, nullable, required
    - `applicantId` string, required: Their member id in GET /api/tasks/{id}/applicants and list_task_applicants.
  - `attachments` union, required
    - object
      - `status` 'available', required
      - `files` TaskFile[], required
        - `id` string, required
        - `folder` 'poster' | 'worker', required
        - `public` boolean, required: A poster file anyone can download from the open task's page (publicFiles on the task).
        - `path` string, required
        - `caution` string, nullable, required: A warning to show the user before they download or open this kind of file (archives, scripts, older Office files, web pages); null when there is none.
        - `hireId` string, nullable, required
        - `size` integer, required
        - `received` integer, required
        - `status` 'uploading' | 'ready' | 'deleting', required
        - `createdAt` string, date-time, required
        - `canWrite` boolean, required
    - object
      - `status` 'unavailable', required

## Other responses

- `401`: Sign in first.
- `404`: No accessible task has that id.

---

[API](https://skmtc.dev/toma/apis/toma-api.md) - [All operations](https://skmtc.dev/toma/apis/toma-api/llms.txt) - [OpenAPI document](https://skmtc.dev/toma/apis/toma-api/revisions/b4e56e1db5a2?raw)