diff --git a/src/API/TimesheetController.php b/src/API/TimesheetController.php
index cc159901..e7c3c9f9 100644
--- a/src/API/TimesheetController.php
+++ b/src/API/TimesheetController.php
@@ -409,8 +409,6 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @Security("is_granted('delete_own_timesheet') or is_granted('delete_other_timesheet')")
-     *
      * @param int $id
      * @return Response
      */
@@ -523,8 +521,6 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @Security("is_granted('stop_own_timesheet') or is_granted('stop_other_timesheet')")
-     *
      * @param int $id
      * @return Response
      * @throws \App\Repository\RepositoryException
@@ -568,9 +564,7 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @Rest\RequestParam(name="copy", requirements="all|tags|description", strict=true, nullable=true, description="Whether description and tags are copied to the new entry. Allowed values: all, tags, description (default: nothing is copied)")
-     *
-     * @Security("is_granted('start_own_timesheet') or is_granted('start_other_timesheet')")
+     * @Rest\RequestParam(name="copy", requirements="all|tags|description", strict=true, nullable=true, description="Whether description and tags are copied to the new entry. Allowed values: all, tags, description, meta (default: nothing is copied)")
      *
      * @param int $id
      * @return Response
@@ -582,8 +576,6 @@ class TimesheetController extends BaseApiController
     {
         /** @var Timesheet $timesheet */
         $timesheet = $this->repository->find($id);
-        /** @var User $user */
-        $user = $this->getUser();
 
         if (null === $timesheet) {
             throw new NotFoundException();
@@ -593,6 +585,9 @@ class TimesheetController extends BaseApiController
             throw new AccessDeniedHttpException('You are not allowed to re-start this timesheet');
         }
 
+        /** @var User $user */
+        $user = $this->getUser();
+
         $entry = new Timesheet();
         $entry
             ->setBegin($this->dateTime->createDateTime())
@@ -611,6 +606,13 @@ class TimesheetController extends BaseApiController
                     $entry->addTag($tag);
                 }
             }
+
+            if (in_array($copy, ['meta', 'all'])) {
+                foreach ($timesheet->getMetaFields() as $metaField) {
+                    $metaNew = clone $metaField;
+                    $entry->setMetaField($metaNew);
+                }
+            }
         }
 
         $errors = $validator->validate($entry);
@@ -650,8 +652,6 @@ class TimesheetController extends BaseApiController
      *      required=true,
      * )
      *
-     * @Security("is_granted('edit_export_own_timesheet') or is_granted('edit_export_other_timesheet')")
-     *
      * @param int $id
      * @return Response
      */
diff --git a/tests/API/TimesheetControllerTest.php b/tests/API/TimesheetControllerTest.php
index df19ab95..a0e10332 100644
--- a/tests/API/TimesheetControllerTest.php
+++ b/tests/API/TimesheetControllerTest.php
@@ -12,7 +12,9 @@ namespace App\Tests\API;
 use App\Entity\Activity;
 use App\Entity\Customer;
 use App\Entity\Project;
+use App\Entity\Tag;
 use App\Entity\Timesheet;
+use App\Entity\TimesheetMeta;
 use App\Entity\User;
 use App\Tests\DataFixtures\TimesheetFixtures;
 use App\Tests\Mocks\Security\UserDateTimeFactoryFactory;
@@ -720,14 +722,19 @@ class TimesheetControllerTest extends APIControllerBaseTest
     {
         $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
 
-        $data = [
-            'description' => 'foo',
-            'tags' => 'another,testing,bar'
-        ];
-        $this->request($client, '/api/timesheets/1', 'PATCH', [], json_encode($data));
-        $this->assertTrue($client->getResponse()->isSuccessful());
-
         $em = $client->getContainer()->get('doctrine.orm.entity_manager');
+        /** @var Timesheet $timesheet */
+        $timesheet = $em->getRepository(Timesheet::class)->find(1);
+        $timesheet->setDescription('foo');
+        $timesheet->addTag((new Tag())->setName('another'));
+        $timesheet->addTag((new Tag())->setName('testing'));
+        $timesheet->addTag((new Tag())->setName('bar'));
+        $timesheet->setMetaField((new TimesheetMeta())->setName('sdfsdf')->setValue('nnnnn')->setIsVisible(true));
+        $timesheet->setMetaField((new TimesheetMeta())->setName('xxxxxxx')->setValue('asdasdasd'));
+        $timesheet->setMetaField((new TimesheetMeta())->setName('1234567890')->setValue('1234567890')->setIsVisible(true));
+        $em->persist($timesheet);
+        $em->flush($timesheet);
+
         $timesheet = $em->getRepository(Timesheet::class)->find(1);
         $this->assertEquals('foo', $timesheet->getDescription());
 
@@ -737,6 +744,7 @@ class TimesheetControllerTest extends APIControllerBaseTest
         $result = json_decode($client->getResponse()->getContent(), true);
         $this->assertDefaultStructure($result, true);
         $this->assertEquals('foo', $result['description']);
+        $this->assertEquals([['name' => 'sdfsdf', 'value' => 'nnnnn'], ['name' => '1234567890', 'value' => '1234567890']], $result['metaFields']);
         $this->assertEquals(['another', 'testing', 'bar'], $result['tags']);
 
         $em = $client->getContainer()->get('doctrine.orm.entity_manager');
@@ -808,7 +816,7 @@ class TimesheetControllerTest extends APIControllerBaseTest
         $client = $this->getClientForAuthenticatedUser(User::ROLE_USER);
 
         $this->request($client, '/api/timesheets/1/export', 'PATCH');
-        $this->assertApiResponseAccessDenied($client->getResponse(), 'Access denied.');
+        $this->assertApiResponseAccessDenied($client->getResponse(), 'You are not allowed to lock this timesheet');
     }
 
     public function testExportThrowsNotFound()