---
title: "Fetch the caller's OWN note on an entry, public or private (auth required)"
method: GET
path: "/api/reading-list/{slug}/my-note"
---

# Fetch the caller's OWN note on an entry, public or private (auth required)

`GET /api/reading-list/{slug}/my-note`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/reading-list/{slug}/my-note`
- Auth: none declared

A8 #311 (2026-07-28) — the missing own-note read.

Auth required, ANY tier (a private reading note is not a paid
feature; `require_min_tier` is deliberately absent, so this route
401s for anon and never 402s).

Why this route exists. The annotation form pre-filled itself from
the PUBLIC `GET .../notes/{username}` endpoint, which returns None
for a private note by design (`pg_get_reading_list_note` filters
`is_public = TRUE` so anonymous readers cannot probe for private
notes). Private is the DEFAULT visibility, so the common case was:
user writes a private note, returns to the entry page, sees an
EMPTY textarea with no indication a note exists, types something,
hits Save — and the `(user_id, slug)` UPSERT silently overwrites
the note they could not see. Silent loss of user-authored content
(`feedback_user_trust`). `mcp_tools/writes.py` already guarded the
sibling half of this exact hazard by reading the existing row
before its UPSERT; the browser path had no equivalent read.

Deliberately a SEPARATE path (`/my-note`), not `/notes/me`: a
literal `me` segment would shadow a real user whose username is
"me" on the `/notes/{username}` route, and route-order shadowing
is invisible at review time.

Path is NOT the public URL shape — nothing here is indexable, and
the response carries `no-store` so a shared cache can never hold
one caller's private note.

## Path parameters

- `slug` string, required

## Response `200`

Successful Response

- ReadingListMyNoteResponse: `GET /api/reading-list/<slug>/my-note` — the CALLER's own note. Distinct from `ReadingListNoteResponse` (the anonymous public read) in exactly one way that matters: this endpoint returns the caller's note whether it is public OR private, and answers `200 {status: 'ok', note: null}` when no note exists yet — never 404. Why the 200-with-null shape (A8 #311, 2026-07-28): the annotation form uses this to PRE-FILL the textarea. It previously pre-filled from the public-only GET, which 404s on a private note — so a user with an existing PRIVATE note (the default visibility!) opened an empty form, and Save overwrote the note they could not see. A 404 for "no note yet" would leave the form unable to distinguish absent-note from read-failure, which is the same ambiguity that caused the overwrite. `note: null` is the honest-absent answer.
  - `status` string, required: 'ok' on success.
  - `note` ReadingListNote: A single user's note on a single reading-list entry. Spike: `docs/plans/A8_DESIGN_SPIKE_READING_LIST_ANNOTATIONS.md`. DB: `reading_list_notes` table (v77). Body is capped at 500 chars at the API layer (DESIGN ratification 2026-05-14); the DB column is unconstrained TEXT to let the cap rise without a migration.
    - `id` integer, required: Surrogate row ID.
    - `slug` string, required: Reading-list entry slug (e.g., 'most-important-thing-howard-marks').
    - `body` string, required: Note text (≤500 chars at the API layer).
    - `is_public` boolean, required: True if /reading-list/<slug>/notes/<username> is publicly indexable.
    - `created_at` string, nullable: ISO-8601 timestamp; absent on first POST until commit.
    - `updated_at` string, nullable: ISO-8601 timestamp.
    - `username` string, nullable: The note author's display username (public reads only).
  - `error` string, nullable: Why the read failed.

## Other responses

- `401`: Unauthorized
- `422`: Validation Error

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)