curl --request POST \
--url https://go.aiinsurance.io/api/v1/companies/{companyId}/notes \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"entityId": "550e8400-e29b-41d4-a716-446655440200",
"note": "Adjuster called the insured for clarification."
}
'{
"id": "550e8400-e29b-41d4-a716-446655440020"
}Create Note
Adds a note (a file note) to a record: a claim (event), an insured
(exposure), a submission, a quote, a person, an organization or a
policy. When loading notes from another system, send displayDate and
displayAuthor to keep their original date and author. For a follow-up
with a due date, use Create Task (createTask).
Creates a note on a parent entity. The parent entity type is supplied as the
entityType (lowercase kebab-case) query parameter; entityId and note are supplied
in the request body.
Sending privileged (true or false) additionally requires
note.view-privileged; without it the request is refused with 403.
Required permission: note.create.
curl --request POST \
--url https://go.aiinsurance.io/api/v1/companies/{companyId}/notes \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"entityId": "550e8400-e29b-41d4-a716-446655440200",
"note": "Adjuster called the insured for clarification."
}
'{
"id": "550e8400-e29b-41d4-a716-446655440020"
}Authorizations
Headers
Optional key that makes a retry of this operation safe. Send a new value, 1 to 255 printable ASCII characters, for each intended operation, and send the same value with the same request when you retry it. A committed attempt reserves the key for 30 days from admission; retries do not extend that window. After 30 days the same key runs as a new request, even if its body differs. Within that window, a retry after the first request completed returns the original resource or run identity with the same status and response shape, without starting another operation. A failure before the intent commits stores nothing; after an external effect fails, a retry may resume that same committed intent. Keys belong to the credential, so another API key, even one the same user created, cannot replay them. Within 30 days, reusing a key with a different request returns 422 IDEMPOTENCY_KEY_REUSED; an invalid key returns 400 INVALID_IDEMPOTENCY_KEY. The key is compared exactly, so case and surrounding spaces count.
1 - 255^[\x20-\x7E]{1,255}$Query Parameters
Parent entity type (lowercase kebab-case URL slug), e.g. event, exposure,
policy. Selects the per-entity permission enforced for the request and
scopes the note to its parent entity. PascalCase (Event) is rejected with a
400 — matching the /entities/{type} path convention.
event, exposure, quote, submission, person, organization, policy Body
Optional user-visible author label (trimmed; must be non-empty). When set, the note is displayed as authored by this label instead of the creator's name — intended for historical imports carrying the source system's author (or a marker like "Data Import"). Audit attribution stays server-set.
255