# Write a note on this domain's timeline

`POST /v1/domain-auth/domains/{domain}/timeline/notes`

- Authentication: required (Bearer token)
- Required scope: `api.domain_auth.manage`

Records the customer's own words against their own timeline — why a
policy was published, what a source turned out to be, what to do if the
next fortnight goes badly.

**The narrowest write on this surface.** A note carries text and, at
most, a date. It cannot claim a record changed, cannot set a policy, and
is always stored with origin `user`: a customer's note appearing on the
timeline as though a detector had observed it would make every other row
on the page less trustworthy.

**Requires a user-delegated token.** A note records the person who wrote
it and the timeline shows their name. A client-credentials token
identifies nobody, so this refuses with 422 rather than attributing a
sentence to the organization and leaving the next reader with nobody to
ask. Same rule as recording a source decision.

Returns the whole timeline, folded, so the caller renders the new note in
the company of the events it sits between rather than appending it to a
list that has not been through the same grouping.

## Path parameters

- `domain` (string, required) — The domain, by NAME (`acme.com`). A UUID is also accepted. Matched case-insensitively, and scoped to the calling org — a domain belonging to another org is a 404, never a 403.

## Request body

Content type: `application/json`

```json
{
  "note": "string",
  "occurred_at": "2026-05-17T20:00:00Z"
}
```

## Example request

```bash
curl -X POST 'https://api.sendops.dev/v1/domain-auth/domains/string/timeline/notes' \
  -H "Authorization: Bearer $SENDOPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"note":"string","occurred_at":"2026-05-17T20:00:00Z"}'
```

## Responses

### 201 — The domain's timeline, including the new note

Content type: `application/json`

```json
{
  "events": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "kind": "policy_change",
      "anchor_origin": "dns",
      "occurred_at": "2026-05-17T20:00:00Z",
      "observed_at": "2026-05-17T20:00:00Z",
      "old_policy": "",
      "new_policy": "",
      "old_record": "string",
      "new_record": "string",
      "tightening": true,
      "weakening": true,
      "note": "string",
      "sightings": [
        {
          "annotation_id": "00000000-0000-0000-0000-000000000000",
          "origin": "dns",
          "occurred_at": "2026-05-17T20:00:00Z",
          "observed_at": "2026-05-17T20:00:00Z",
          "has_record_text": true
        }
      ]
    }
  ],
  "annotations": 0
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 404 — Resource not found

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 422 — Query parameter or path value failed validation

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```