Strange API now, taking application and entity and then ignoring them. In other places, we validate that those passed in match the actual. Here, probably better to deprecate this and take only the taskId.