---
title: "One note held against a contact"
method: GET
path: "/api/v1/contacts/{contact_id}/notes/{note_id}"
tags: ["contacts"]
---

# One note held against a contact

`GET /api/v1/contacts/{contact_id}/notes/{note_id}`

## Request

- Base URL: `https://api.app.tightly.io`
- URL: `https://api.app.tightly.io/api/v1/contacts/{contact_id}/notes/{note_id}`
- Auth: HTTP bearer

One note: `id`, `title`, `body`, and the ISO-8601 instants it was written and last changed.

The note is found by `note_id` alone. `contact_id` is in the path because the note belongs to a contact, but it is not part of the lookup, so a note id paired with the wrong contact still answers that note. Do not read a 200 here as proof that the note belongs to the contact you named.

A note id nothing has is refused 404. get_contact_notes is the door when the whole list is wanted, and the only one that answers which notes a contact really holds.

Scope: `suppliers:read`.

## Path parameters

- `contact_id` string, required
- `note_id` string, required

## Headers

- `Tightly-Version` string

## Response `200`

The note as it stands.

- GetContactNoteResponse
  - `data` union
    - ContactNotePayload
      - `body` string, required
      - `created_at` string, required
      - `id` string, required
      - `title` string, required
      - `updated_at` string, required
    - object, nullable
  - `message` ContactsApiMessage
    - `desc` string
    - `service` string
    - `severity` 'SUCCESS' | 'INFO' | 'ERROR' | 'WARNING'

## Other responses

- `401`: No usable key: malformed, unknown, revoked, expired or stopped. One refusal covers all five, telling a caller which is which maps the surface for them. A request with no Authorization header at all is refused 400 before any key is looked for.
- `403`: The key may not reach this operation. `scope_missing` when the key does not hold Suppliers; `ip_not_allowed` when the caller's address is outside the key's allowlist. There is no `organization_mismatch` on this resource: no supplier or contact route names an organisation in its path, so there is nothing for a key to disagree with.
- `404`: No note has that id.
- `429`: The key has spent its allowance for this minute. 600 reads and 120 writes a minute, counted per key, refused calls included. `Retry-After` says how long to wait.
- `503`: The database is briefly out of reach, which is what a failover or a full connection pool looks like from outside. Wait the seconds `Retry-After` names and send the request again. A read is safe to repeat. A write is not, because the connection was lost in the middle of it, so read the object back before sending it a second time. Branch on the status rather than on `code`, which is `POSTGRES_UNAVAILABLE` from one of the two seams that raise this and `SERVICE_UNAVAILABLE` from the other.

---

[API](https://skmtc.dev/tightly/apis/tightly-api.md) · [All operations](https://skmtc.dev/tightly/apis/tightly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tightly/apis/tightly-api/revisions/199f7eb35afb?raw)