Edit a comment

PATCHhttps://<your-url>/api/v2/comments/{comment}

MCP id comments.updateAlso on this path: GET Read a comment, DELETE Delete a comment

Partially updates one comment: body is the only writable key and absent keys are untouched.

Token scope: api:write:project_managementorapi:write:project_driveorapi:write:customer_driveorapi:write:organization_driveorapi:write:user_drive
Without it: 403 insufficient-token-scope.
Permission: project_management::manage_work_items
Without it: 403 insufficient-permission.
Rate cost: 1 unit, write bucket. A write costs the same whatever view you ask for.
Also: Accepts If-Match. Never cached: private, no-store. Unknown body keys are refused, never dropped.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: Fix a typo in your own comment

curl -X PATCH \
  'https://<your-url>/api/v2/comments/1' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'If-Match: *' \
  -d '{
    "body": "<p>Deployed to staging, ready for review.</p>"
  }'

const response = await fetch('https://<your-url>/api/v2/comments/1', {
  method: 'PATCH',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'If-Match': '*',
  },
  body: JSON.stringify({
    "body": "<p>Deployed to staging, ready for review.</p>"
  }),
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->withHeader('If-Match', '*')
    ->patch('https://<your-url>/api/v2/comments/1', [
        'body' => '<p>Deployed to staging, ready for review.</p>',
    ]);

import requests
response = requests.request(
    'PATCH',
    'https://<your-url>/api/v2/comments/1',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json', 'Content-Type': 'application/json', 'If-Match': '*'},
    json={'body': '<p>Deployed to staging, ready for review.</p>'},
)

Response

The shape of the response, with sample values.

{
  "data": {
    "id": 1,
    "body": "<p>Deployed to staging, ready for review.</p>",
    "author_type": "user",
    "author_id": 1,
    "author": {
      "id": 1
    },
    "commentable_type": "work_item",
    "commentable_id": 1,
    "commentable": {
      "id": 1
    },
    "created_at": "2026-03-04T09:15:00Z",
    "updated_at": "2026-03-04T09:15:00Z",
    "links": {
      "self": "https://<your-url>/api/v2/work-items/1"
    }
  }
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/precondition-failed",
  "title": "Precondition failed",
  "status": 412,
  "detail": "The record changed since the version named in If-Match. Re-read it and retry.",
  "instance": "/api/v2/work-items/812",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "current_version": 12
}

{
  "type": "https://developers.plnnrly.com/api/v2/problems/validation-failed",
  "title": "Validation failed",
  "status": 422,
  "detail": "3 fields failed validation.",
  "instance": "/api/v2/worklogs",
  "request_id": "01K4B7Q9YV3PZ2N8T1E6M0XR4S",
  "errors": [
    {
      "pointer": "/date",
      "code": "date_format",
      "detail": "The date does not match the format Y-m-d."
    },
    {
      "pointer": "/minutes",
      "code": "min",
      "detail": "The minutes must be at least 1."
    },
    {
      "pointer": "/description",
      "code": "required",
      "detail": "The description field is required."
    }
  ]
}

This mirrors the edit action on a comment thread in plnnrly and follows the same rules: Editing is author-only. No permission lets a manager edit somebody else's comment, so a PATCH by a non-author is 403 forbidden-by-policy and there is no override to ask for. On top of authorship the caller must still be able to comment on the parent, which is project_management::manage_work_items for a work item and read access to the drive document for a drive item; the token must cover that parent's prefix. Re-parenting is not a field write and is not available: sending commentable_type or commentable_id is a 422. Mention spans present in the body you read may be sent back verbatim and are preserved; note that the response body is sanitised, so it can differ from the exact bytes you sent. Send If-Match with the ETag from your last read to detect a concurrent edit, which answers 412; a comment has no version field, so its ETag is derived from updated_at, and the ETag in the response is the one to send next.

Path parameters

commentintegerRequired

The Comment's numeric id.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

viewstring

Which field set to render.

summarydetaildefault

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-Matchstring

The ETag a write is conditional on. A stale validator is 412 precondition-failed.

Request body

Unknown keys are refused with 422, naming the key.

bodystring≤ 65535

Comment body as rich text. HTML from the plnnrly editor, sanitised on the way out, so what you read back can differ from the bytes you sent. Mention spans (<span data-type="mention" data-id="3">) survive untouched and may be posted back verbatim; constructing a new mention is not supported in v2.0.

Response 200

Returns a Comment in the detail view.

Headers

ETag: A strong validator of exactly this representation.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning

Errors

403 Forbidden.

forbidden-by-policy insufficient-permission insufficient-token-scope

forbidden-by-policy: You did not write this comment. Only its author can edit a comment, and no permission lets anyone else do it. You also get this answer when you can see the work item or drive item the comment belongs to but may not comment on it.

412 Precondition failed.

precondition-failed

415 Unsupported media type.

unsupported-media-type

422 Unprocessable content.

unprocessable-relationship validation-failed

7 errors every operation can return: 400, 401, 404, 406, 429, 500, 503

400 Bad request.

idempotency-key-required invalid-cursor invalid-query-parameter malformed-request unsupported-parameter

401 Unauthenticated.

token-expired unauthenticated

404 Not found.