diff --git a/lib/api/index.js b/lib/api/index.js
index e440071..5c58cc5 100644
--- a/lib/api/index.js
+++ b/lib/api/index.js
@@ -3,6 +3,11 @@ import { ownerOnly } from '../auth/owner.js';
 import { errorMiddleware, NotFoundError } from './errors.js';
 import { router as spacesRouter } from './routes/spaces.js';
 import { router as projectsRouter, spacesScopedRouter as projectsBySpaceRouter } from './routes/projects.js';
+import {
+  router as tasksRouter,
+  spacesScopedRouter as tasksBySpaceRouter,
+  projectsScopedRouter as tasksByProjectRouter
+} from './routes/tasks.js';
 
 export function mountApi(app) {
   const api = Router();
@@ -10,7 +15,10 @@ export function mountApi(app) {
 
   api.use('/spaces', spacesRouter);
   api.use('/spaces/:space_id/projects', projectsBySpaceRouter);
+  api.use('/spaces/:space_id/tasks', tasksBySpaceRouter);
   api.use('/projects', projectsRouter);
+  api.use('/projects/:project_id/tasks', tasksByProjectRouter);
+  api.use('/tasks', tasksRouter);
 
   api.use((_req, _res, next) => next(new NotFoundError('route not found')));
 
diff --git a/lib/api/routes/tasks.js b/lib/api/routes/tasks.js
new file mode 100644
index 0000000..f145161
--- /dev/null
+++ b/lib/api/routes/tasks.js
@@ -0,0 +1,92 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import * as repo from '../../db/repos/tasks.js';
+import { validate } from '../validate.js';
+import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
+
+const STATUSES = ['todo', 'doing', 'blocked', 'done'];
+
+const createSchema = z.object({
+  project_id: z.string().uuid().nullable().optional(),
+  title: z.string().min(1).max(500),
+  body: z.string().optional(),
+  priority: z.number().int().optional(),
+  due_at: z.string().datetime().nullable().optional(),
+  position: z.number().int().optional()
+});
+
+const patchSchema = z.object({
+  project_id: z.string().uuid().nullable().optional(),
+  title: z.string().min(1).max(500).optional(),
+  body: z.string().nullable().optional(),
+  status: z.enum(STATUSES).optional(),
+  priority: z.number().int().nullable().optional(),
+  due_at: z.string().datetime().nullable().optional(),
+  position: z.number().int().nullable().optional()
+});
+
+const idParams = z.object({ id: z.string().uuid() });
+const spaceParams = z.object({ space_id: z.string().uuid() });
+const projectParams = z.object({ project_id: z.string().uuid() });
+
+export const router = Router();
+export const spacesScopedRouter = Router({ mergeParams: true });
+export const projectsScopedRouter = Router({ mergeParams: true });
+
+spacesScopedRouter.get('/',
+  validate({ params: spaceParams, query: z.object({ status: z.enum(STATUSES).optional() }) }),
+  asyncWrap(async (req, res) => {
+    res.json(await repo.listBySpace(req.params.space_id, { status: req.validatedQuery.status }));
+  })
+);
+
+spacesScopedRouter.post('/',
+  validate({ params: spaceParams, body: createSchema }),
+  asyncWrap(async (req, res) => {
+    try {
+      const row = await repo.create({ ...req.body, space_id: req.params.space_id }, req.actor);
+      res.status(201).json(row);
+    } catch (e) {
+      if (e.code === '23503') throw new ValidationError('invalid space or project', {
+        space_id: req.params.space_id, project_id: req.body.project_id
+      });
+      throw e;
+    }
+  })
+);
+
+projectsScopedRouter.get('/',
+  validate({ params: projectParams }),
+  asyncWrap(async (req, res) => {
+    res.json(await repo.listByProject(req.params.project_id));
+  })
+);
+
+router.get('/:id',
+  validate({ params: idParams }),
+  asyncWrap(async (req, res) => {
+    const row = await repo.getById(req.params.id);
+    if (!row) throw new NotFoundError('task not found');
+    res.json(row);
+  })
+);
+
+router.patch('/:id',
+  validate({ params: idParams, body: patchSchema }),
+  asyncWrap(async (req, res) => {
+    const existing = await repo.getById(req.params.id);
+    if (!existing) throw new NotFoundError('task not found');
+    const row = await repo.update(req.params.id, req.body, req.actor);
+    res.json(row);
+  })
+);
+
+router.delete('/:id',
+  validate({ params: idParams }),
+  asyncWrap(async (req, res) => {
+    const existing = await repo.getById(req.params.id);
+    if (!existing) throw new NotFoundError('task not found');
+    await repo.del(req.params.id, req.actor);
+    res.status(204).end();
+  })
+);
diff --git a/tests/api/tasks.test.js b/tests/api/tasks.test.js
new file mode 100644
index 0000000..11df101
--- /dev/null
+++ b/tests/api/tasks.test.js
@@ -0,0 +1,68 @@
+import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
+import request from 'supertest';
+import { setup } from './helpers.js';
+import * as spaces from '../../lib/db/repos/spaces.js';
+import * as projects from '../../lib/db/repos/projects.js';
+
+let app, ownerHeaders, space, project;
+const owner = { kind: 'user', id: null };
+
+beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
+beforeEach(async () => {
+  space   = await spaces.create({ slug: `s-${Date.now()}-${Math.random().toString(36).slice(2,5)}`, name: 'S' }, owner);
+  project = await projects.create({ space_id: space.id, slug: 'p', name: 'P' }, owner);
+});
+
+describe('tasks routes', () => {
+  it('POST sibling task (no project_id)', async () => {
+    const res = await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'standalone' });
+    expect(res.status).toBe(201);
+    expect(res.body.project_id).toBeNull();
+    expect(res.body.space_id).toBe(space.id);
+  });
+
+  it('POST child task (with project_id)', async () => {
+    const res = await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'child', project_id: project.id });
+    expect(res.status).toBe(201);
+    expect(res.body.project_id).toBe(project.id);
+  });
+
+  it('GET /api/projects/:id/tasks ordered by position then created_at', async () => {
+    await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'second', project_id: project.id, position: 2 });
+    await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'first', project_id: project.id, position: 1 });
+    const res = await request(app).get(`/api/projects/${project.id}/tasks`).set(ownerHeaders);
+    expect(res.status).toBe(200);
+    expect(res.body.map(t => t.title)).toEqual(['first', 'second']);
+  });
+
+  it('PATCH status=done sets completed_at', async () => {
+    const c = await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'finish me' });
+    const res = await request(app).patch(`/api/tasks/${c.body.id}`).set(ownerHeaders)
+      .send({ status: 'done' });
+    expect(res.status).toBe(200);
+    expect(res.body.status).toBe('done');
+    expect(res.body.completed_at).not.toBeNull();
+  });
+
+  it('GET /api/spaces/:id/tasks?status=todo filters', async () => {
+    const a = await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'a' });
+    await request(app).patch(`/api/tasks/${a.body.id}`).set(ownerHeaders).send({ status: 'done' });
+    await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders).send({ title: 'b' });
+    const res = await request(app).get(`/api/spaces/${space.id}/tasks?status=todo`).set(ownerHeaders);
+    expect(res.body.length).toBe(1);
+    expect(res.body[0].title).toBe('b');
+  });
+
+  it('DELETE returns 204', async () => {
+    const c = await request(app).post(`/api/spaces/${space.id}/tasks`).set(ownerHeaders)
+      .send({ title: 'x' });
+    const del = await request(app).delete(`/api/tasks/${c.body.id}`).set(ownerHeaders);
+    expect(del.status).toBe(204);
+  });
+});