Skip to main content
POST

Authorizations

​
Authorization
string
header
required

API key authentication. Send your raw API key as the Authorization header value with NO scheme prefix — Authorization: YOUR-API-KEY. Do NOT prefix it with Bearer or ApiKey, and do not use an X-API-Key header; those are not accepted.

Path Parameters

​
companyId
string<uuid>
required

Company identifier

Query Parameters

​
entityType
enum<string>
required

Parent entity type (lowercase kebab-case URL slug), e.g. event, exposure, policy. Selects the per-entity permission enforced for the request and scopes the note to its parent entity. PascalCase (Event) is rejected with a 400 — matching the /entities/{type} path convention.

Available options:
event,
exposure,
quote,
submission,
person,
organization,
policy

Body

application/json
​
entityId
string<uuid>
required

Parent entity identifier

​
note
string
required

The note body (must not be empty)

​
displayDate
string<date-time>

Optional back-datable "as of" ISO 8601 timestamp. When set, lists display and sort the note by this date instead of createdAt — intended for historical imports and integrations. The audit timestamps and creator attribution stay server-set.

​
displayAuthor
string

Optional user-visible author label (trimmed; must be non-empty). When set, the note is displayed as authored by this label instead of the creator's name — intended for historical imports carrying the source system's author (or a marker like "Data Import"). Audit attribution stays server-set.

Maximum string length: 255

Response

Note created successfully

​
id
string<uuid>

The ID of the created note