diff --git a/be/routes/api.php b/be/routes/api.php
index 3d2bae2..109c178 100644
--- a/be/routes/api.php
+++ b/be/routes/api.php
@@ -87,8 +87,22 @@ Route::middleware(['auth:sanctum', 'abilities:full-access'])->group(function ()
     Route::post('/v1/mastertasks/{id}/subtasks', SubTaskController::class . '@store');
     Route::put('/v1/subtasks/{id}', SubTaskController::class . '@update');
 
-    Route::get('/v1/subtasks/{id}', function ($id) {
-        return new SubTaskResource( SubTask::published()->find($id));
+    Route::get('/v1/subtasks/{id}', function ($id, Request $request) {
+        $subtask = SubTask::find($id);
+        
+        if (!$subtask) {
+            return response()->json(['message' => 'Subtask not found.'], 404);
+        }
+        
+        // draft môže vidieť len jeho vlastník
+        if ($subtask->is_draft) {
+            $userId = User::getUserIdFromBearerToken($request->bearerToken());
+            if ($subtask->user_id != $userId && $subtask->created_by != $userId) {
+                return response()->json(['message' => 'Subtask not found.'], 404);
+            }
+        }
+        
+        return new SubTaskResource($subtask);
     });
     Route::post('/v1/subtasks/{id}/timesheet', SubTaskController::class . '@submitTimesheet');