Note Access Control

Grant and revoke agent identities access to a note. Notes use a per-identity model (no wildcard, unlike contacts). Humans (Clerk JWT) and admin API keys always see every note regardless of grants — the rules below only apply to scoped agent keys.

Agent-created notes are auto-granted to the creating identity on POST /notes. All other grants must be added explicitly by an admin or JWT user.

POST /notes/{note_id}/access

Grant an agent identity read + CRUD access to a note.

Auth: admin API key or Clerk JWT only. A scoped agent cannot grant itself or a peer.

Path parameters

Request body

Response (201)

JSON

Error responses

Code examples

cURL

cURL

JavaScript

Python

GET /notes/{note_id}/access

List the identities granted access to a note. A scoped agent without visibility on the note 404s before reaching the grant listing.

Path parameters

Response (200)

JSON

Code examples

cURL

cURL

JavaScript

Python

DELETE /notes/{note_id}/access/{identity_id}

Revoke an identity's access to a note.

• Admin API keys and JWT humans may revoke any identity — including the original creator. created_by is a pure audit stamp; revoking the creator's grant makes the note agent-invisible (humans still see it).
• A claimed agent may only revoke its own grant.

Path parameters

Response

204 No Content on success.

Error responses

Code examples

cURL

cURL

JavaScript

Python