Editors can add plain-text notes up to 4 KiB with an operation UUID. Limits per owner account: 10 per minute, 100 per UTC day and 1,000 per incident, including deleted notes. Reusing the UUID returns the same note. Notes are never automatically published or sent.
Editors can add plain-text notes up to 4 KiB with an operation UUID. Limits per owner account: 10 per minute, 100 per UTC day and 1,000 per incident, including deleted notes. Reusing the UUID returns the same note. Notes are never automatically published or sent.
Browser session: __Host-mb_session cookie.
Machine management credentials in Authorization: Bearer. Check the permissions (scopes) required by the operation.
When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language
string; {"enum":["en","de"]}
Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.
Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.
Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.
shell
curl --request POST --cookie '__Host-mb_session=SESSION; __Host-mb_csrf=CSRF' --header 'X-CSRF-Token: CSRF' --header 'Content-Type: application/json' --data '{"body":"Investigating the service.","operation_id":"33333333-3333-4333-8333-333333333333"}''https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes'
python
import requests
response=requests.request('POST','https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes',cookies={"__Host-mb_session":"SESSION","__Host-mb_csrf":"CSRF"},headers={"X-CSRF-Token":"CSRF"},json={'body': 'Investigating the service.', 'operation_id': '33333333-3333-4333-8333-333333333333'})
response.raise_for_status()
javascript
const response=await fetch("https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes",{method:"POST",credentials:"same-origin",headers:{"Content-Type":"application/json","X-CSRF-Token":csrf},body:JSON.stringify({"body":"Investigating the service.","operation_id":"33333333-3333-4333-8333-333333333333"})});
if(!response.ok)throw new Error(String(response.status));
go
package main
import("net/http";"strings";"time")
func main(){req,err:=http.NewRequest("POST","https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes",strings.NewReader(`{"body":"Investigating the service.","operation_id":"33333333-3333-4333-8333-333333333333"}`));if err!=nil{panic("request failed")};req.AddCookie(&http.Cookie{Name:"__Host-mb_session",Value:"SESSION"});req.AddCookie(&http.Cookie{Name:"__Host-mb_csrf",Value:"CSRF"});req.Header.Set("X-CSRF-Token","CSRF");req.Header.Set("Content-Type","application/json");c:=http.Client{Timeout:10*time.Second};res,err:=c.Do(req);if err!=nil{panic("request failed")};defer res.Body.Close()}
An editor can delete their own notes; the owner can delete any note in this workspace. Repeated deletion succeeds. The note text is removed; admission metadata remains until the incident or account is deleted.