diff --git a/be/routes/api.php b/be/routes/api.php
index 27df575..109c178 100644
--- a/be/routes/api.php
+++ b/be/routes/api.php
@@ -87,13 +87,21 @@ Route::middleware(['auth:sanctum', 'abilities:full-access'])->group(function ()
     Route::post('/v1/mastertasks/{id}/subtasks', SubTaskController::class . '@store');
     Route::put('/v1/subtasks/{id}', SubTaskController::class . '@update');
 
-    Route::get('/v1/subtasks/{id}', function ($id) {
+    Route::get('/v1/subtasks/{id}', function ($id, Request $request) {
         $subtask = SubTask::find($id);
         
         if (!$subtask) {
             return response()->json(['message' => 'Subtask not found.'], 404);
         }
         
+        // draft môže vidieť len jeho vlastník
+        if ($subtask->is_draft) {
+            $userId = User::getUserIdFromBearerToken($request->bearerToken());
+            if ($subtask->user_id != $userId && $subtask->created_by != $userId) {
+                return response()->json(['message' => 'Subtask not found.'], 404);
+            }
+        }
+        
         return new SubTaskResource($subtask);
     });
     Route::post('/v1/subtasks/{id}/timesheet', SubTaskController::class . '@submitTimesheet');