Sorry but I'm not able to reproduce.

GET {{url}}/api/rest/issues/:issue_id
the fields "version" and "fixed_in_version" are returned, but not "target_version".

Works for me, e.g. on this tracker GET https://mantisbt.org/bugs/api/rest/issues/37256

{
  "issues": [
    {
      "id": 37256,
      "summary": "Incorrect log message regarding sent email",
      ---snip---
      "version": {
        "id": 250,
        "name": "1.3.0"
      },
      "fixed_in_version": {
        "id": 384,
        "name": "2.28.4"
      },
      "target_version": {
        "id": 384,
        "name": "2.28.4"
      },
      ---snip---
  ]
}

I tested the PATCH endpoint too (in my local dev env), and I do get the target version in the response JSON as well.

Not on my instance. See screenshot. I'm running version 2.28.4

Thanks for the credentials, but I am not going to use them. I work on Mantis in my spare time and I will not spend what little I have of it to analyze your system. Thanks for your understanding.

One hint for you, this tracker runs on master branch, and there's quite a few fixes and improvements to REST API pending release, so try again using a nightly build.

Found the culprit in mc_issue_api.php:
if( $t_fields === null || isset( $t_fields['target_version'] ) ) {
if( access_has_bug_level( config_get( 'roadmap_view_threshold' ), $t_id ) ) {
$t_issue['target_version'] = mci_get_version( $p_issue_data->target_version, $p_issue_data->project_id );
}
}

The roadmap_view_threshold was set to NOBODY on my machine.

So, the bug is, that I'm allowed to change the target_version even if I'm not allowed to see it.

I see nothing wrong with that, since roadmap_view_threshold only determines the ability to view the roadmap and the target version.

Updating is controlled by roadmap_update_threshold.

In mc_issue_update() function, line 1175

    if( access_has_project_level( config_get( 'roadmap_update_threshold' ), $t_bug_data->project_id, $t_user_id ) ) {
        $t_bug_data->target_version = $fn_set_version_field( $t_target_version_id );
    }

ok, you're right. Maybe you think about a warning message somewhere if a view threshold is configured higher than the corresponding update threshold. But this would be a feature request.

Feel free to close this issue.

Thanks for the feedback.