fix(api): improve scheduled tasks API with auth, validation, and execution endpoints

- Add authorization checks ($this->authorize) for all read/write operations
- Use customApiValidator() instead of Validator::make() to match codebase patterns
- Add extra field rejection to prevent mass assignment
- Use Application::ownedByCurrentTeamAPI() for consistent query patterns
- Remove non-existent standalone_postgresql_id from hidden fields
- Add execution listing endpoints for both applications and services
- Add ScheduledTaskExecution OpenAPI schema
- Use $request->only() instead of $request->all() for safe updates
- Add ScheduledTaskFactory and feature tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/Http/Controllers/Api/ScheduledTasksController.php

@@ -7,7 +7,6 @@
 use App\Models\ScheduledTask;
 use App\Models\Service;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Validator;
 use OpenApi\Attributes as OA;
 
 class ScheduledTasksController extends Controller
@@ -19,25 +18,44 @@ private function removeSensitiveData($task)
             'team_id',
             'application_id',
             'service_id',
-            'standalone_postgresql_id',
         ]);
 
         return serializeApiResponse($task);
     }
 
-    public function create_scheduled_task(Request $request, Application|Service $resource)
+    private function resolveApplication(Request $request, int $teamId): ?Application
     {
-        $teamId = getTeamIdFromToken();
-        if (is_null($teamId)) {
-            return invalidTokenResponse();
-        }
+        return Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+    }
+
+    private function resolveService(Request $request, int $teamId): ?Service
+    {
+        return Service::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+    }
+
+    private function listTasks(Application|Service $resource): \Illuminate\Http\JsonResponse
+    {
+        $this->authorize('view', $resource);
+
+        $tasks = $resource->scheduled_tasks->map(function ($task) {
+            return $this->removeSensitiveData($task);
+        });
+
+        return response()->json($tasks);
+    }
+
+    private function createTask(Request $request, Application|Service $resource): \Illuminate\Http\JsonResponse
+    {
+        $this->authorize('update', $resource);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof \Illuminate\Http\JsonResponse) {
             return $return;
         }
 
-        $validator = Validator::make($request->all(), [
+        $allowedFields = ['name', 'command', 'frequency', 'container', 'timeout', 'enabled'];
+
+        $validator = customApiValidator($request->all(), [
             'name' => 'required|string|max:255',
             'command' => 'required|string',
             'frequency' => 'required|string',
@@ -46,10 +64,18 @@ public function create_scheduled_task(Request $request, Application|Service $res
             'enabled' => 'boolean',
         ]);
 
-        if ($validator->fails()) {
+        $extraFields = array_diff(array_keys($request->all()), $allowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
             return response()->json([
                 'message' => 'Validation failed.',
-                'errors' => $validator->errors(),
+                'errors' => $errors,
             ], 422);
         }
 
@@ -60,9 +86,15 @@ public function create_scheduled_task(Request $request, Application|Service $res
             ], 422);
         }
 
-        $task = new ScheduledTask();
-        $data = $request->all();
-        $task->fill($data);
+        $teamId = getTeamIdFromToken();
+
+        $task = new ScheduledTask;
+        $task->name = $request->name;
+        $task->command = $request->command;
+        $task->frequency = $request->frequency;
+        $task->container = $request->container;
+        $task->timeout = $request->timeout ?? 300;
+        $task->enabled = $request->enabled ?? true;
         $task->team_id = $teamId;
 
         if ($resource instanceof Application) {
@@ -76,19 +108,18 @@ public function create_scheduled_task(Request $request, Application|Service $res
         return response()->json($this->removeSensitiveData($task), 201);
     }
 
-    public function update_scheduled_task(Request $request, Application|Service $resource)
+    private function updateTask(Request $request, Application|Service $resource): \Illuminate\Http\JsonResponse
     {
-        $teamId = getTeamIdFromToken();
-        if (is_null($teamId)) {
-            return invalidTokenResponse();
-        }
+        $this->authorize('update', $resource);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof \Illuminate\Http\JsonResponse) {
             return $return;
         }
 
-        $validator = Validator::make($request->all(), [
+        $allowedFields = ['name', 'command', 'frequency', 'container', 'timeout', 'enabled'];
+
+        $validator = customApiValidator($request->all(), [
             'name' => 'string|max:255',
             'command' => 'string',
             'frequency' => 'string',
@@ -97,10 +128,18 @@ public function update_scheduled_task(Request $request, Application|Service $res
             'enabled' => 'boolean',
         ]);
 
-        if ($validator->fails()) {
+        $extraFields = array_diff(array_keys($request->all()), $allowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
             return response()->json([
                 'message' => 'Validation failed.',
-                'errors' => $validator->errors(),
+                'errors' => $errors,
             ], 422);
         }
 
@@ -116,14 +155,45 @@ public function update_scheduled_task(Request $request, Application|Service $res
             return response()->json(['message' => 'Scheduled task not found.'], 404);
         }
 
-        $data = $request->all();
-        $task->update($data);
+        $task->update($request->only($allowedFields));
 
         return response()->json($this->removeSensitiveData($task), 200);
     }
 
+    private function deleteTask(Request $request, Application|Service $resource): \Illuminate\Http\JsonResponse
+    {
+        $this->authorize('update', $resource);
+
+        $task = $resource->scheduled_tasks()->where('uuid', $request->task_uuid)->first();
+        if (! $task) {
+            return response()->json(['message' => 'Scheduled task not found.'], 404);
+        }
+
+        $task->delete();
+
+        return response()->json(['message' => 'Scheduled task deleted.']);
+    }
+
+    private function getExecutions(Request $request, Application|Service $resource): \Illuminate\Http\JsonResponse
+    {
+        $this->authorize('view', $resource);
+
+        $task = $resource->scheduled_tasks()->where('uuid', $request->task_uuid)->first();
+        if (! $task) {
+            return response()->json(['message' => 'Scheduled task not found.'], 404);
+        }
+
+        $executions = $task->executions()->get()->map(function ($execution) {
+            $execution->makeHidden(['id', 'scheduled_task_id']);
+
+            return serializeApiResponse($execution);
+        });
+
+        return response()->json($executions);
+    }
+
     #[OA\Get(
-        summary: 'List Task',
+        summary: 'List Tasks',
         description: 'List all scheduled tasks for an application.',
         path: '/applications/{uuid}/scheduled-tasks',
         operationId: 'list-scheduled-tasks-by-application-uuid',
@@ -166,23 +236,19 @@ public function update_scheduled_task(Request $request, Application|Service $res
             ),
         ]
     )]
-    public function scheduled_tasks_by_application_uuid(Request $request)
+    public function scheduled_tasks_by_application_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $application = Application::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $application = $this->resolveApplication($request, $teamId);
         if (! $application) {
             return response()->json(['message' => 'Application not found.'], 404);
         }
 
-        $tasks = $application->scheduled_tasks->map(function ($task) {
-            return $this->removeSensitiveData($task);
-        });
-
-        return response()->json($tasks);
+        return $this->listTasks($application);
     }
 
     #[OA\Post(
@@ -218,7 +284,7 @@ public function scheduled_tasks_by_application_uuid(Request $request)
                         'command' => ['type' => 'string', 'description' => 'The command to execute.'],
                         'frequency' => ['type' => 'string', 'description' => 'The frequency of the scheduled task.'],
                         'container' => ['type' => 'string', 'nullable' => true, 'description' => 'The container where the command should be executed.'],
-                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 3600],
+                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 300],
                         'enabled' => ['type' => 'boolean', 'description' => 'The flag to indicate if the scheduled task is enabled.', 'default' => true],
                     ],
                 ),
@@ -249,19 +315,106 @@ public function scheduled_tasks_by_application_uuid(Request $request)
             ),
         ]
     )]
-    public function create_scheduled_task_by_application_uuid(Request $request)
+    public function create_scheduled_task_by_application_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $application = Application::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $application = $this->resolveApplication($request, $teamId);
         if (! $application) {
             return response()->json(['message' => 'Application not found.'], 404);
         }
 
-        return $this->create_scheduled_task($request, $application);
+        return $this->createTask($request, $application);
+    }
+
+    #[OA\Patch(
+        summary: 'Update Task',
+        description: 'Update a scheduled task for an application.',
+        path: '/applications/{uuid}/scheduled-tasks/{task_uuid}',
+        operationId: 'update-scheduled-task-by-application-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Scheduled Tasks'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the application.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+            new OA\Parameter(
+                name: 'task_uuid',
+                in: 'path',
+                description: 'UUID of the scheduled task.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            description: 'Scheduled task data',
+            required: true,
+            content: new OA\MediaType(
+                mediaType: 'application/json',
+                schema: new OA\Schema(
+                    type: 'object',
+                    properties: [
+                        'name' => ['type' => 'string', 'description' => 'The name of the scheduled task.'],
+                        'command' => ['type' => 'string', 'description' => 'The command to execute.'],
+                        'frequency' => ['type' => 'string', 'description' => 'The frequency of the scheduled task.'],
+                        'container' => ['type' => 'string', 'nullable' => true, 'description' => 'The container where the command should be executed.'],
+                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 300],
+                        'enabled' => ['type' => 'boolean', 'description' => 'The flag to indicate if the scheduled task is enabled.', 'default' => true],
+                    ],
+                ),
+            )
+        ),
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'Scheduled task updated.',
+                content: [
+                    new OA\MediaType(
+                        mediaType: 'application/json',
+                        schema: new OA\Schema(ref: '#/components/schemas/ScheduledTask')
+                    ),
+                ]
+            ),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 404,
+                ref: '#/components/responses/404',
+            ),
+            new OA\Response(
+                response: 422,
+                ref: '#/components/responses/422',
+            ),
+        ]
+    )]
+    public function update_scheduled_task_by_application_uuid(Request $request): \Illuminate\Http\JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $application = $this->resolveApplication($request, $teamId);
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        return $this->updateTask($request, $application);
     }
 
     #[OA\Delete(
@@ -319,33 +472,26 @@ public function create_scheduled_task_by_application_uuid(Request $request)
             ),
         ]
     )]
-    public function delete_scheduled_task_by_application_uuid(Request $request)
+    public function delete_scheduled_task_by_application_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $application = Application::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $application = $this->resolveApplication($request, $teamId);
         if (! $application) {
             return response()->json(['message' => 'Application not found.'], 404);
         }
 
-        $task = $application->scheduled_tasks()->where('uuid', $request->task_uuid)->first();
-        if (! $task) {
-            return response()->json(['message' => 'Scheduled task not found.'], 404);
-        }
-
-        $task->delete();
-
-        return response()->json(['message' => 'Scheduled task deleted.']);
+        return $this->deleteTask($request, $application);
     }
 
-    #[OA\Patch(
-        summary: 'Update Task',
-        description: 'Update a scheduled task for an application.',
-        path: '/applications/{uuid}/scheduled-tasks/{task_uuid}',
-        operationId: 'update-scheduled-task-by-application-uuid',
+    #[OA\Get(
+        summary: 'List Executions',
+        description: 'List all executions for a scheduled task on an application.',
+        path: '/applications/{uuid}/scheduled-tasks/{task_uuid}/executions',
+        operationId: 'list-scheduled-task-executions-by-application-uuid',
         security: [
             ['bearerAuth' => []],
         ],
@@ -370,32 +516,17 @@ public function delete_scheduled_task_by_application_uuid(Request $request)
                 )
             ),
         ],
-        requestBody: new OA\RequestBody(
-            description: 'Scheduled task data',
-            required: true,
-            content: new OA\MediaType(
-                mediaType: 'application/json',
-                schema: new OA\Schema(
-                    type: 'object',
-                    properties: [
-                        'name' => ['type' => 'string', 'description' => 'The name of the scheduled task.'],
-                        'command' => ['type' => 'string', 'description' => 'The command to execute.'],
-                        'frequency' => ['type' => 'string', 'description' => 'The frequency of the scheduled task.'],
-                        'container' => ['type' => 'string', 'nullable' => true, 'description' => 'The container where the command should be executed.'],
-                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 3600],
-                        'enabled' => ['type' => 'boolean', 'description' => 'The flag to indicate if the scheduled task is enabled.', 'default' => true],
-                    ],
-                ),
-            )
-        ),
         responses: [
             new OA\Response(
                 response: 200,
-                description: 'Scheduled task updated.',
+                description: 'Get all executions for a scheduled task.',
                 content: [
                     new OA\MediaType(
                         mediaType: 'application/json',
-                        schema: new OA\Schema(ref: '#/components/schemas/ScheduledTask')
+                        schema: new OA\Schema(
+                            type: 'array',
+                            items: new OA\Items(ref: '#/components/schemas/ScheduledTaskExecution')
+                        )
                     ),
                 ]
             ),
@@ -407,25 +538,21 @@ public function delete_scheduled_task_by_application_uuid(Request $request)
                 response: 404,
                 ref: '#/components/responses/404',
             ),
-            new OA\Response(
-                response: 422,
-                ref: '#/components/responses/422',
-            ),
         ]
     )]
-    public function update_scheduled_task_by_application_uuid(Request $request)
+    public function executions_by_application_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $application = Application::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $application = $this->resolveApplication($request, $teamId);
         if (! $application) {
             return response()->json(['message' => 'Application not found.'], 404);
         }
 
-        return $this->update_scheduled_task($request, $application);
+        return $this->getExecutions($request, $application);
     }
 
     #[OA\Get(
@@ -472,23 +599,19 @@ public function update_scheduled_task_by_application_uuid(Request $request)
             ),
         ]
     )]
-    public function scheduled_tasks_by_service_uuid(Request $request)
+    public function scheduled_tasks_by_service_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $service = $this->resolveService($request, $teamId);
         if (! $service) {
             return response()->json(['message' => 'Service not found.'], 404);
         }
 
-        $tasks = $service->scheduled_tasks->map(function ($task) {
-            return $this->removeSensitiveData($task);
-        });
-
-        return response()->json($tasks);
+        return $this->listTasks($service);
     }
 
     #[OA\Post(
@@ -524,7 +647,7 @@ public function scheduled_tasks_by_service_uuid(Request $request)
                         'command' => ['type' => 'string', 'description' => 'The command to execute.'],
                         'frequency' => ['type' => 'string', 'description' => 'The frequency of the scheduled task.'],
                         'container' => ['type' => 'string', 'nullable' => true, 'description' => 'The container where the command should be executed.'],
-                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 3600],
+                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 300],
                         'enabled' => ['type' => 'boolean', 'description' => 'The flag to indicate if the scheduled task is enabled.', 'default' => true],
                     ],
                 ),
@@ -555,19 +678,106 @@ public function scheduled_tasks_by_service_uuid(Request $request)
             ),
         ]
     )]
-    public function create_scheduled_task_by_service_uuid(Request $request)
+    public function create_scheduled_task_by_service_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $service = $this->resolveService($request, $teamId);
         if (! $service) {
             return response()->json(['message' => 'Service not found.'], 404);
         }
 
-        return $this->create_scheduled_task($request, $service);
+        return $this->createTask($request, $service);
+    }
+
+    #[OA\Patch(
+        summary: 'Update Task',
+        description: 'Update a scheduled task for a service.',
+        path: '/services/{uuid}/scheduled-tasks/{task_uuid}',
+        operationId: 'update-scheduled-task-by-service-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Scheduled Tasks'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the service.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+            new OA\Parameter(
+                name: 'task_uuid',
+                in: 'path',
+                description: 'UUID of the scheduled task.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            description: 'Scheduled task data',
+            required: true,
+            content: new OA\MediaType(
+                mediaType: 'application/json',
+                schema: new OA\Schema(
+                    type: 'object',
+                    properties: [
+                        'name' => ['type' => 'string', 'description' => 'The name of the scheduled task.'],
+                        'command' => ['type' => 'string', 'description' => 'The command to execute.'],
+                        'frequency' => ['type' => 'string', 'description' => 'The frequency of the scheduled task.'],
+                        'container' => ['type' => 'string', 'nullable' => true, 'description' => 'The container where the command should be executed.'],
+                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 300],
+                        'enabled' => ['type' => 'boolean', 'description' => 'The flag to indicate if the scheduled task is enabled.', 'default' => true],
+                    ],
+                ),
+            )
+        ),
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'Scheduled task updated.',
+                content: [
+                    new OA\MediaType(
+                        mediaType: 'application/json',
+                        schema: new OA\Schema(ref: '#/components/schemas/ScheduledTask')
+                    ),
+                ]
+            ),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 404,
+                ref: '#/components/responses/404',
+            ),
+            new OA\Response(
+                response: 422,
+                ref: '#/components/responses/422',
+            ),
+        ]
+    )]
+    public function update_scheduled_task_by_service_uuid(Request $request): \Illuminate\Http\JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $service = $this->resolveService($request, $teamId);
+        if (! $service) {
+            return response()->json(['message' => 'Service not found.'], 404);
+        }
+
+        return $this->updateTask($request, $service);
     }
 
     #[OA\Delete(
@@ -625,33 +835,26 @@ public function create_scheduled_task_by_service_uuid(Request $request)
             ),
         ]
     )]
-    public function delete_scheduled_task_by_service_uuid(Request $request)
+    public function delete_scheduled_task_by_service_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $service = $this->resolveService($request, $teamId);
         if (! $service) {
             return response()->json(['message' => 'Service not found.'], 404);
         }
 
-        $task = $service->scheduled_tasks()->where('uuid', $request->task_uuid)->first();
-        if (! $task) {
-            return response()->json(['message' => 'Scheduled task not found.'], 404);
-        }
-
-        $task->delete();
-
-        return response()->json(['message' => 'Scheduled task deleted.']);
+        return $this->deleteTask($request, $service);
     }
 
-    #[OA\Patch(
-        summary: 'Update Task',
-        description: 'Update a scheduled task for a service.',
-        path: '/services/{uuid}/scheduled-tasks/{task_uuid}',
-        operationId: 'update-scheduled-task-by-service-uuid',
+    #[OA\Get(
+        summary: 'List Executions',
+        description: 'List all executions for a scheduled task on a service.',
+        path: '/services/{uuid}/scheduled-tasks/{task_uuid}/executions',
+        operationId: 'list-scheduled-task-executions-by-service-uuid',
         security: [
             ['bearerAuth' => []],
         ],
@@ -676,32 +879,17 @@ public function delete_scheduled_task_by_service_uuid(Request $request)
                 )
             ),
         ],
-        requestBody: new OA\RequestBody(
-            description: 'Scheduled task data',
-            required: true,
-            content: new OA\MediaType(
-                mediaType: 'application/json',
-                schema: new OA\Schema(
-                    type: 'object',
-                    properties: [
-                        'name' => ['type' => 'string', 'description' => 'The name of the scheduled task.'],
-                        'command' => ['type' => 'string', 'description' => 'The command to execute.'],
-                        'frequency' => ['type' => 'string', 'description' => 'The frequency of the scheduled task.'],
-                        'container' => ['type' => 'string', 'nullable' => true, 'description' => 'The container where the command should be executed.'],
-                        'timeout' => ['type' => 'integer', 'description' => 'The timeout of the scheduled task in seconds.', 'default' => 3600],
-                        'enabled' => ['type' => 'boolean', 'description' => 'The flag to indicate if the scheduled task is enabled.', 'default' => true],
-                    ],
-                ),
-            )
-        ),
         responses: [
             new OA\Response(
                 response: 200,
-                description: 'Scheduled task updated.',
+                description: 'Get all executions for a scheduled task.',
                 content: [
                     new OA\MediaType(
                         mediaType: 'application/json',
-                        schema: new OA\Schema(ref: '#/components/schemas/ScheduledTask')
+                        schema: new OA\Schema(
+                            type: 'array',
+                            items: new OA\Items(ref: '#/components/schemas/ScheduledTaskExecution')
+                        )
                     ),
                 ]
             ),
@@ -713,24 +901,20 @@ public function delete_scheduled_task_by_service_uuid(Request $request)
                 response: 404,
                 ref: '#/components/responses/404',
             ),
-            new OA\Response(
-                response: 422,
-                ref: '#/components/responses/422',
-            ),
         ]
     )]
-    public function update_scheduled_task_by_service_uuid(Request $request)
+    public function executions_by_service_uuid(Request $request): \Illuminate\Http\JsonResponse
     {
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
 
-        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $request->uuid)->first();
+        $service = $this->resolveService($request, $teamId);
         if (! $service) {
             return response()->json(['message' => 'Service not found.'], 404);
         }
 
-        return $this->update_scheduled_task($request, $service);
+        return $this->getExecutions($request, $service);
     }
 }

app/Models/ScheduledTask.php

@@ -29,6 +29,11 @@ class ScheduledTask extends BaseModel
 
     protected $guarded = [];
 
+    public static function ownedByCurrentTeamAPI(int $teamId)
+    {
+        return static::where('team_id', $teamId)->orderBy('created_at', 'desc');
+    }
+
     protected function casts(): array
     {
         return [

app/Models/ScheduledTaskExecution.php

@@ -3,7 +3,23 @@
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use OpenApi\Attributes as OA;
 
+#[OA\Schema(
+    description: 'Scheduled Task Execution model',
+    type: 'object',
+    properties: [
+        'uuid' => ['type' => 'string', 'description' => 'The unique identifier of the execution.'],
+        'status' => ['type' => 'string', 'enum' => ['success', 'failed', 'running'], 'description' => 'The status of the execution.'],
+        'message' => ['type' => 'string', 'nullable' => true, 'description' => 'The output message of the execution.'],
+        'retry_count' => ['type' => 'integer', 'description' => 'The number of retries.'],
+        'duration' => ['type' => 'number', 'nullable' => true, 'description' => 'Duration in seconds.'],
+        'started_at' => ['type' => 'string', 'format' => 'date-time', 'nullable' => true, 'description' => 'When the execution started.'],
+        'finished_at' => ['type' => 'string', 'format' => 'date-time', 'nullable' => true, 'description' => 'When the execution finished.'],
+        'created_at' => ['type' => 'string', 'format' => 'date-time', 'description' => 'When the record was created.'],
+        'updated_at' => ['type' => 'string', 'format' => 'date-time', 'description' => 'When the record was last updated.'],
+    ],
+)]
 class ScheduledTaskExecution extends BaseModel
 {
     protected $guarded = [];

database/factories/ScheduledTaskFactory.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Database\Factories;
+
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+class ScheduledTaskFactory extends Factory
+{
+    public function definition(): array
+    {
+        return [
+            'name' => fake()->word(),
+            'command' => 'echo hello',
+            'frequency' => '* * * * *',
+            'timeout' => 300,
+            'enabled' => true,
+            'team_id' => 1,
+        ];
+    }
+}

routes/api.php

@@ -107,7 +107,7 @@
 
     /**
      * @deprecated Use POST /api/v1/services instead. This endpoint creates a Service, not an Application and is a unstable duplicate of POST /api/v1/services.
-     */    
+     */
     Route::post('/applications/dockercompose', [ApplicationsController::class, 'create_dockercompose_application'])->middleware(['api.ability:write']);
 
     Route::get('/applications/{uuid}', [ApplicationsController::class, 'application_by_uuid'])->middleware(['api.ability:read']);
@@ -177,11 +177,13 @@
     Route::post('/applications/{uuid}/scheduled-tasks', [ScheduledTasksController::class, 'create_scheduled_task_by_application_uuid'])->middleware(['api.ability:write']);
     Route::patch('/applications/{uuid}/scheduled-tasks/{task_uuid}', [ScheduledTasksController::class, 'update_scheduled_task_by_application_uuid'])->middleware(['api.ability:write']);
     Route::delete('/applications/{uuid}/scheduled-tasks/{task_uuid}', [ScheduledTasksController::class, 'delete_scheduled_task_by_application_uuid'])->middleware(['api.ability:write']);
+    Route::get('/applications/{uuid}/scheduled-tasks/{task_uuid}/executions', [ScheduledTasksController::class, 'executions_by_application_uuid'])->middleware(['api.ability:read']);
 
     Route::get('/services/{uuid}/scheduled-tasks', [ScheduledTasksController::class, 'scheduled_tasks_by_service_uuid'])->middleware(['api.ability:read']);
     Route::post('/services/{uuid}/scheduled-tasks', [ScheduledTasksController::class, 'create_scheduled_task_by_service_uuid'])->middleware(['api.ability:write']);
     Route::patch('/services/{uuid}/scheduled-tasks/{task_uuid}', [ScheduledTasksController::class, 'update_scheduled_task_by_service_uuid'])->middleware(['api.ability:write']);
     Route::delete('/services/{uuid}/scheduled-tasks/{task_uuid}', [ScheduledTasksController::class, 'delete_scheduled_task_by_service_uuid'])->middleware(['api.ability:write']);
+    Route::get('/services/{uuid}/scheduled-tasks/{task_uuid}/executions', [ScheduledTasksController::class, 'executions_by_service_uuid'])->middleware(['api.ability:read']);
 });
 
 Route::group([

tests/Feature/ScheduledTaskApiTest.php

@@ -0,0 +1,365 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\ScheduledTaskExecution;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::factory()->create(['server_id' => $this->server->id]);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function authHeaders($bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+describe('GET /api/v1/applications/{uuid}/scheduled-tasks', function () {
+    test('returns empty array when no tasks exist', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson("/api/v1/applications/{$application->uuid}/scheduled-tasks");
+
+        $response->assertStatus(200);
+        $response->assertJson([]);
+    });
+
+    test('returns tasks when they exist', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        ScheduledTask::factory()->create([
+            'application_id' => $application->id,
+            'team_id' => $this->team->id,
+            'name' => 'Test Task',
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson("/api/v1/applications/{$application->uuid}/scheduled-tasks");
+
+        $response->assertStatus(200);
+        $response->assertJsonCount(1);
+        $response->assertJsonFragment(['name' => 'Test Task']);
+    });
+
+    test('returns 404 for unknown application uuid', function () {
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson('/api/v1/applications/nonexistent-uuid/scheduled-tasks');
+
+        $response->assertStatus(404);
+    });
+});
+
+describe('POST /api/v1/applications/{uuid}/scheduled-tasks', function () {
+    test('creates a task with valid data', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$application->uuid}/scheduled-tasks", [
+                'name' => 'Backup',
+                'command' => 'php artisan backup',
+                'frequency' => '0 0 * * *',
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonFragment(['name' => 'Backup']);
+
+        $this->assertDatabaseHas('scheduled_tasks', [
+            'name' => 'Backup',
+            'command' => 'php artisan backup',
+            'frequency' => '0 0 * * *',
+            'application_id' => $application->id,
+            'team_id' => $this->team->id,
+        ]);
+    });
+
+    test('returns 422 when name is missing', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$application->uuid}/scheduled-tasks", [
+                'command' => 'echo test',
+                'frequency' => '* * * * *',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('returns 422 for invalid cron expression', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$application->uuid}/scheduled-tasks", [
+                'name' => 'Test',
+                'command' => 'echo test',
+                'frequency' => 'not-a-cron',
+            ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonPath('errors.frequency.0', 'Invalid cron expression or frequency format.');
+    });
+
+    test('returns 422 when extra fields are present', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$application->uuid}/scheduled-tasks", [
+                'name' => 'Test',
+                'command' => 'echo test',
+                'frequency' => '* * * * *',
+                'unknown_field' => 'value',
+            ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('defaults timeout and enabled when not provided', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->postJson("/api/v1/applications/{$application->uuid}/scheduled-tasks", [
+                'name' => 'Test',
+                'command' => 'echo test',
+                'frequency' => '* * * * *',
+            ]);
+
+        $response->assertStatus(201);
+
+        $this->assertDatabaseHas('scheduled_tasks', [
+            'name' => 'Test',
+            'timeout' => 300,
+            'enabled' => true,
+        ]);
+    });
+});
+
+describe('PATCH /api/v1/applications/{uuid}/scheduled-tasks/{task_uuid}', function () {
+    test('updates task with partial data', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $task = ScheduledTask::factory()->create([
+            'application_id' => $application->id,
+            'team_id' => $this->team->id,
+            'name' => 'Old Name',
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}/scheduled-tasks/{$task->uuid}", [
+                'name' => 'New Name',
+            ]);
+
+        $response->assertStatus(200);
+        $response->assertJsonFragment(['name' => 'New Name']);
+    });
+
+    test('returns 404 when task not found', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$application->uuid}/scheduled-tasks/nonexistent", [
+                'name' => 'Test',
+            ]);
+
+        $response->assertStatus(404);
+    });
+});
+
+describe('DELETE /api/v1/applications/{uuid}/scheduled-tasks/{task_uuid}', function () {
+    test('deletes task successfully', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $task = ScheduledTask::factory()->create([
+            'application_id' => $application->id,
+            'team_id' => $this->team->id,
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$application->uuid}/scheduled-tasks/{$task->uuid}");
+
+        $response->assertStatus(200);
+        $response->assertJson(['message' => 'Scheduled task deleted.']);
+
+        $this->assertDatabaseMissing('scheduled_tasks', ['uuid' => $task->uuid]);
+    });
+
+    test('returns 404 when task not found', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$application->uuid}/scheduled-tasks/nonexistent");
+
+        $response->assertStatus(404);
+    });
+});
+
+describe('GET /api/v1/applications/{uuid}/scheduled-tasks/{task_uuid}/executions', function () {
+    test('returns executions for a task', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $task = ScheduledTask::factory()->create([
+            'application_id' => $application->id,
+            'team_id' => $this->team->id,
+        ]);
+
+        ScheduledTaskExecution::create([
+            'scheduled_task_id' => $task->id,
+            'status' => 'success',
+            'message' => 'OK',
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson("/api/v1/applications/{$application->uuid}/scheduled-tasks/{$task->uuid}/executions");
+
+        $response->assertStatus(200);
+        $response->assertJsonCount(1);
+        $response->assertJsonFragment(['status' => 'success']);
+    });
+
+    test('returns 404 when task not found', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson("/api/v1/applications/{$application->uuid}/scheduled-tasks/nonexistent/executions");
+
+        $response->assertStatus(404);
+    });
+});
+
+describe('Service scheduled tasks API', function () {
+    test('can list tasks for a service', function () {
+        $service = Service::factory()->create([
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'environment_id' => $this->environment->id,
+        ]);
+
+        ScheduledTask::factory()->create([
+            'service_id' => $service->id,
+            'team_id' => $this->team->id,
+            'name' => 'Service Task',
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->getJson("/api/v1/services/{$service->uuid}/scheduled-tasks");
+
+        $response->assertStatus(200);
+        $response->assertJsonCount(1);
+        $response->assertJsonFragment(['name' => 'Service Task']);
+    });
+
+    test('can create a task for a service', function () {
+        $service = Service::factory()->create([
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'environment_id' => $this->environment->id,
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->postJson("/api/v1/services/{$service->uuid}/scheduled-tasks", [
+                'name' => 'Service Backup',
+                'command' => 'pg_dump',
+                'frequency' => '0 2 * * *',
+            ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonFragment(['name' => 'Service Backup']);
+    });
+
+    test('can delete a task for a service', function () {
+        $service = Service::factory()->create([
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'environment_id' => $this->environment->id,
+        ]);
+
+        $task = ScheduledTask::factory()->create([
+            'service_id' => $service->id,
+            'team_id' => $this->team->id,
+        ]);
+
+        $response = $this->withHeaders(authHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/services/{$service->uuid}/scheduled-tasks/{$task->uuid}");
+
+        $response->assertStatus(200);
+        $response->assertJson(['message' => 'Scheduled task deleted.']);
+    });
+});