DELETE Delete an internal incident note

/api/v1/alarms/incidents/{id}/notes/{note}

An editor can delete their own notes; the owner can delete any note in this workspace. Repeated deletion succeeds. The note text is removed; admission metadata remains until the incident or account is deleted.

On this page

Access and permissions

Browser session: __Host-mb_session cookie.

Machine management credentials in Authorization: Bearer. Check the permissions (scopes) required by the operation.

When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.

Parameters and headers

Field	Location	Type and limits	Required	Meaning
id	Path	string; {"format":"uuid"}	Yes	Resource UUID from the path. It must exist and be accessible to the acting identity.
note	Path	string; {"format":"uuid"}	Yes	Resource UUID from the path. It must exist and be accessible to the acting identity.

Request body

No request body.

Responses

Stable error codes
invalid_incident
invalid_input

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 422,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
unavailable

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Retry-After	string; {"pattern":"^[0-9]+$"}	Seconds before retry. Preserve supported idempotency identifiers and respect the operation’s mutation semantics.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 503,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
not_found

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 404,
  "title": "Demo error",
  "type": "about:blank"
}

Stable error codes
forbidden
insufficient_scope
invalid_origin
csrf

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
Referrer-Policy	JSON; {"enum":["strict-origin-when-cross-origin","no-referrer"]}	The default referrer policy is strict-origin-when-cross-origin. Provider-login responses use no-referrer to protect login parameters.
Vary	string	Responses vary by Accept-Language; browser-rendered responses can also vary by the preference cookie.
X-Content-Type-Options	JSON; {"const":"nosniff"}	The browser must use the declared content type.
X-Frame-Options	JSON; {"const":"DENY"}	The response must not be embedded in a frame.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

{
  "code": "demo",
  "detail": "Demo error detail; inspect the documented code.",
  "instance": "demo",
  "message": "Demo error detail; inspect the documented code.",
  "message_key": "errors.requestFailed",
  "message_params": {},
  "request_id": "00000000000000000000000000000000",
  "status": 403,
  "title": "Demo error",
  "type": "about:blank"
}

application/json

Field	Type and limits	Required	Meaning
$	object	Yes	—

Retries and asynchronous work

This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

curl --request DELETE --cookie '__Host-mb_session=SESSION; __Host-mb_csrf=CSRF' --header 'X-CSRF-Token: CSRF' --header 'Content-Type: application/json' 'https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes/22222222-2222-4222-8222-222222222222'

import requests
response=requests.request('DELETE','https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes/22222222-2222-4222-8222-222222222222',cookies={"__Host-mb_session":"SESSION","__Host-mb_csrf":"CSRF"},headers={"X-CSRF-Token":"CSRF"})
response.raise_for_status()

const response=await fetch("https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes/22222222-2222-4222-8222-222222222222",{method:"DELETE",credentials:"same-origin",headers:{"Content-Type":"application/json","X-CSRF-Token":csrf}});
if(!response.ok)throw new Error(String(response.status));

package main
import("net/http";"strings";"time")
func main(){req,err:=http.NewRequest("DELETE","https://metribeacon.com/api/v1/alarms/incidents/11111111-1111-4111-8111-111111111111/notes/22222222-2222-4222-8222-222222222222",strings.NewReader(``));if err!=nil{panic("request failed")};req.AddCookie(&http.Cookie{Name:"__Host-mb_session",Value:"SESSION"});req.AddCookie(&http.Cookie{Name:"__Host-mb_csrf",Value:"CSRF"});req.Header.Set("X-CSRF-Token","CSRF");req.Header.Set("Content-Type","application/json");c:=http.Client{Timeout:10*time.Second};res,err:=c.Do(req);if err!=nil{panic("request failed")};defer res.Body.Close()}

HTTP API, OAuth and MCP
Find the user API endpoints, their permissions, fields, examples and response formats.
POST Add an internal incident note
Editors can add plain-text notes up to 4 KiB with an operation UUID. Limits per owner account: 10 per minute, 100 per UTC day and 1,000 per incident, including deleted notes. Reusing the UUID returns the same note. Notes are never automatically published or sent.
POST Acknowledge your incident
Acknowledge your incident.
GET Read channel-specific delivery attempts for an incident
Read channel-specific delivery attempts for an incident.

Access and permissions

Parameters and headers

Request body

Responses

Retries and asynchronous work

Request examples

Related guides