Post a note about a person — a dated remark on their timeline, never edited afterwards

POST /people/{personId}/notes

The body is sealed under the person's own key before the fact is written, because staff commentary about someone is personal data about them: erasing the person destroys the key and the note's words with it, leaving the entry readable as "a note was posted" and nothing more. An erased person takes no new notes (409 PersonErased). Appends crm.note-posted. reference (the caller's own key for the act — the composer mints one per submission) is required and is the idempotency key: a retry with the same reference returns the note already posted and appends nothing.

Access

Requires customers:write.

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

Retries

reference (the caller's own key for the act — the composer mints one per submission) is required and is the idempotency key: a retry with the same reference returns the note already posted and appends nothing.

A retry with the same key answers 201, with what the first call recorded.

Why every write carries a key: Idempotency and retries.

Facts appended

crm.note-posted

What a fact is: Facts and the journal.

AI agent tool

Agents call this as crm_post_person_note (CRM: Post person note), in the crm toolset.

Connecting an agent: AI agents.

Example

curl

curl -X POST 'https://crm.getmanifold.io/people/psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90/notes' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
  "reference": "note:7f3a2c",
  "body": "Prefers deliveries before 10am. Dock is round the back."
}'

JavaScript (fetch)

const response = await fetch("https://crm.getmanifold.io/people/psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90/notes", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    "reference": "note:7f3a2c",
    "body": "Prefers deliveries before 10am. Dock is round the back."
  }),
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Request body · application/json

{
  "reference": "note:7f3a2c",
  "body": "Prefers deliveries before 10am. Dock is round the back."
}

Response · 201 · application/json

{
  "id": "note_01a1588b-3e50-7f61-8a72-9b8c7d6e5f40",
  "subjectId": "psn_01a1588a-0c41-7d2e-9a10-3b5c6d7e8f90",
  "body": "Prefers deliveries before 10am. Dock is round the back.",
  "by": {
    "_tag": "user",
    "id": "usr_01a15889-fa80-7b11-8c22-3d4e5f6a7b8c"
  },
  "postedAt": "2026-10-20T09:20:00.000Z"
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: crm-manager.openapi.json. Base URL https://crm.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`404`

Refusal	What it means	What to do
`PersonNotFound` personId	No such record in this organization.	Check the id in the path or the body.

`409`

Refusal	What it means	What to do
`PersonErased` personId	The person was erased at their request and holds no details.	Nothing can change an erased person.
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Send the same request again, with the same key.

How refusals work everywhere: Errors.