---
title: "Api Annotations Get"
method: GET
path: "/api/ticker-annotations"
tags: ["Portfolio"]
---

# Api Annotations Get

`GET /api/ticker-annotations`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/ticker-annotations`
- Auth: none declared

A user's OWN ticker annotations.

SECURITY (SEC-IDOR, 2026-06-21): this endpoint USED to (a) take no auth and
(b) read the legacy SQLite `get_annotations(ticker)`, which has NO user_id
column — so it commingled every user's private notes under a ticker and
returned them to any caller (info disclosure of another user's research).
The fix scopes the read to the SESSION user via the v111 per-user FK
(`pg_get_user_annotations`), the read-side sibling of the §2.3/§2.4
write/delete helpers. The unscoped SQLite read is retired here — it cannot
be made user-safe (no user_id), and PG is the authoritative store for this
per-user surface. user_id comes from the session, NEVER request input.

## Query parameters

- `ticker` string, nullable: Ticker symbol
- `limit` integer: Max annotations to return (1-1000)

## Response `200`

Successful Response

- TickerAnnotationsResponse: `GET /api/ticker-annotations` response. F4 schema-tightening (2026-04-30): `ticker` and `annotations` REQUIRED. Both 200 success and 500 fallback include `{ticker, annotations}` (500 also includes an error string). The 400 (no ticker) branch returns ErrorResponse via api_error. Frontend annotations panel reads `data.ticker` for the header + iterates `data.annotations.forEach(...)` to render the list.
  - `ticker` string, required
  - `annotations` TickerAnnotation[], required
    - `id` integer, nullable
    - `ticker` string, nullable
    - `note` string, nullable
    - `created_at` string, nullable
    - `updated_at` string, nullable
  - `error` string, nullable

## Other responses

- `400`: Bad Request
- `422`: Validation Error

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)