# POST /api/v2/notes

Create a note

- MCP id: notes.store
- Scope: api:write:project_drive
- Scope: api:write:customer_drive
- Scope: api:write:organization_drive
- Scope: api:write:user_drive
- Permission: project_drive::create
- Rate cost: 1 unit, write bucket. A write costs the same whatever `view` you ask for.
- Cache-Control: private, no-store

Attaches a note to a project, a customer or a work item and returns it with a `Location` header, mirroring the Notes sub-page in plnnrly.

The parent is named by the `notable_type`/`notable_id` pair (one of the few flat creates that accepts a type and id pair), and a parent the caller cannot read is refused exactly as a nonexistent one is. Writing a note also needs the parent's own note permission, as in plnnrly: `projects::notes` for a project, `customers::update` for a customer and `project_management::manage_work_items` for a work item; without it the request is `403` `forbidden-by-policy`. The author is always the authenticated user and cannot be set; the sort position is assigned by the server. The declared permission is `project_drive::create`; the other three drive prefixes apply by owner type.

## Parameters
- view (string, optional): Which field set to render.
- X-Request-Id (header, optional): A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.
- Idempotency-Key (header, optional): A caller-chosen key that makes this POST safe to retry. Replaying it returns the original response with Idempotency-Replayed: true.

## Request body
- content (string ≤ 500000, required): Note body as rich-text HTML, sanitised on read.
- notable_type (string, required): The project, customer or work item this note is attached to.
- notable_id (integer, required): The project, customer or work item this note is attached to.

Unknown keys are refused with `422` validation-failed, naming the key.

## Response 201
- id (integer, required): Unique identifier.
- content (html, required): Note body as rich-text HTML, sanitised on read.
- order_column (integer, required, server-assigned): Sort position within the parent record. Assigned by the server; reordering is not exposed in v2.0. Positions are not counted per parent, so the sequence is effectively creation order across the whole organisation.
- user_id (integer or null, required, server-assigned): Author of the note. Always the authenticated user at create time; `null` where the author has since been deleted.
- created_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Creation timestamp.
- updated_at (timestamp (YYYY-MM-DDThh:mm:ssZ), required): Last-write timestamp; use for incremental sync.
- notable_type (string, required): The kind of record `notable` points at; it says which branch of `notable` applies.
- notable_id (integer, required): The id of the record `notable` points at.
- notable (Ref or ProjectSummary or CustomerSummary or WorkItemSummary, required): The project, customer or work item this note is attached to.
- user (Ref or UserSummary or null, required): Author of the note.
- links (NoteLinks, required)
  - self (url, required): The canonical URI of this record.

## Errors
- 403 forbidden-by-policy | insufficient-permission | insufficient-token-scope: Forbidden.
- 409 idempotency-key-in-flight | idempotency-key-reused: Conflict.
- 415 unsupported-media-type: Unsupported media type.
- 422 unprocessable-relationship | validation-failed: Unprocessable content.
- 400 idempotency-key-required | invalid-cursor | invalid-query-parameter | malformed-request | unsupported-parameter: Bad request.
- 401 token-expired | unauthenticated: Unauthenticated.
- 404 endpoint-not-found | resource-not-found: Not found.
- 406 not-acceptable: Not acceptable.
- 429 rate-limit-exceeded: Too many requests.
- 500 internal-error: Server error.
- 503 tenant-unavailable: Service unavailable.

## Example
```bash
curl -X POST \
  'https://<your-url>/api/v2/notes' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: <key>' \
  -d '{
    "notable_type": "project",
    "notable_id": 1,
    "content": "<p>Kick-off moved to Monday; the client will confirm scope by Friday.</p>"
  }'
```