Requesters see download server names and raw download statuses on their requests #1646

Regular users can see server details on their own requests that only mean something to an admin. GET /api/v2/requests/mine and GET /api/v2/requests/{id} return every request target's instance_name, integration_kind, external_id and external_status to the requester. external_status is the raw status from Radarr or Sonarr, such as completed/importBlocked or delay/downloading. For Seerr targets it is a numeric media status such as 3 or 5.

The Android phone and TV apps print these fields in the My Requests row. For example, a requester sees Stub Radarr • 1080p • downloading • completed/importBlocked under "Waiting for import". That tells a requester nothing useful, and on a shared server it exposes how the admin named their download servers. No release names, file paths or indexer names were exposed.

Expected

Decide what a requester sees on a request target. Quality, status and download are enough for the requester views; the admin request endpoints would keep the rest. Removing fields for non-admins changes the v2 contract, so it is simpler before /api/v2 locks. The Android row, and any other client that prints these fields, would follow.

Notes

• Found while validating Show download progress on requests while Sonarr or Radarr downloads them #1643 in a sandbox. This predates that change: origin/main returns the same fields.
• Requester-facing targets are built in mediaRequestOf in internal/apiv2/requests.go.

AI disclosure

• Harness: T3 Code (Claude Code agent harness)
• Tool(s): Claude Code, GitHub CLI
• Model(s): claude-opus-5-5
• Involvement: AI-assisted; filed at the maintainer's request
• Adversarial review: n/a