---
title: "Create note"
method: POST
path: "/api/notes"
tags: ["notes"]
---

# Create note

`POST /api/notes`

## Request

- Base URL: `https://beta.getsales.io/playtables/v1`
- URL: `https://beta.getsales.io/playtables/v1/api/notes`
- Auth: HTTP bearer and API key in header `Team-SID`

Add a plain-text note to exactly one person or company, or a sticker to a workflow canvas (object_type and object_sid must match, the object live in the team). A sticker explains the workflow to its readers: step_id names the step it sits beside (omit it for the whole workflow). No dedup: every call inserts a row. A person or company note writes a note_left activity; a sticker writes none. Not for structured attributes or message content.

Contract:
- MCP tool `create_note`, registry package `mcp.playtables/notes`, mount `playtables.pipeline`.
- Operation `create`, response envelope `create`.
- Flags: none.

## Request body

- CreateNoteRequest: Request body of `create_note`.
  - `object_type` 'person' | 'company' | 'workflow', required: Kind of the object: 'person', 'company', or 'workflow' for a sticker on its canvas. Must match the object_sid prefix (422 validation_failed otherwise).
  - `object_sid` string, required: The person (cr_pp_…), company (cr_co_…) or workflow (wf_wf_…) to pin the note to. Prefix must match object_type (422 validation_failed). Must be live and same-team (422 relation_not_found otherwise). Immutable after create.
  - `body` string, required: Plain-text note body. Rendered as-is - no rich text, no attachments, no @-mentions. 1..65535 chars on a person or company; a sticker may be empty (""). On a sticker: two or three short sentences explaining a choice or a risk of that step.
  - `step_id` integer, nullable: A sticker only: the id of the workflow step it explains, from the workflow's saved steps (422 validation_failed for a step the workflow does not have). Omit for the sticker about the whole workflow. Never on a person or company note.
  - `position` object, nullable: A sticker only, and set by the canvas when a person drags it: leave it out. Without it the canvas places the sticker beside its step.
    - `x` integer, required
    - `y` integer, required

## Response `200`

`create` success envelope.

- CreateNoteResponse
  - `success` true, required
  - `operation` 'create', required
  - `item` object, required
    - `sid` string, required: Note sid (cr_nt_…).
    - `team_sid` string, required: Owning team (ts_tm_…, external - gs.service.id).
    - `object_type` 'person' | 'company' | 'workflow', required: Kind of the annotated object: person | company | workflow (a sticker on its canvas). Fixed at create - a note is never re-homed.
    - `object_sid` string, required: The annotated person (cr_pp_…), company (cr_co_…) or workflow (wf_wf_…); prefix matches object_type.
    - `body` string, required: Plain-text note body, rendered as-is; FULLTEXT-indexed for filter.q. 1..65535 chars on a person or company; a sticker may be empty.
    - `step_id` integer, nullable, required: A sticker only: the workflow step it sits beside; null = the workflow as a whole (and always null on a person or company note).
    - `position` object, nullable, required: A sticker only: where a person dragged it, relative to its step; null = the canvas places it beside its step.
      - `x` integer, required
      - `y` integer, required
    - `created_by` object, required: Actor that authored the note (AccessIdentityValue); shown for accountability.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `deleted_by` object, nullable, required: Actor that soft-deleted the note (tool call or parent cascade); null while live.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `created_at` string, required: ISO 8601 UTC.
    - `updated_at` string, required: ISO 8601 UTC; bumped by body edits.
    - `deleted_at` string, nullable, required: ISO 8601 UTC; null = live (soft delete).
  - `already_exists` boolean, required
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-playtables/revisions/aa394506515d?raw)