This specific API is working fine, yes. But the problem comes  when you try to get notes or update specific note. The response in most cases will be :   {     "code": "MC_01202",     "message": "No investigation found mapped to this display id: 6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde",     "request_id": "3d497390-1472-41d5-b702-19cf60750d60" }   I suspect the the reason is following . When we are looking at response from my example we can see following :  "source_type": "Incident",   But when we are looking on documentation example here : https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.2/splunk-enterprise-security-api-reference/investigation/public_v2_create_note_in_investigation   we see "source_type": "Task"   INHO this is a bug : 1 . "type": "Task" in request is not documented and has no affect 2. Apparently Splunk considered new note connected to an investigation  and not to the finding and  that't why I see an error for any other note-related API           ... View more

Hi @livehybrid and thank you for an answer.  The example you provided doesn't work :   request : curl --location 'https://<mysplunk>:8089/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data '{ "title": "Test finding4 for ES 8.2 - new note 8", "content": "Comment for Test finding4 for ES 8.2 - via new API", "type": "Task" }' response: { "code": "MC_01202", "message": "No investigation found mapped to this display id: 6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde", "request_id": "b7e6edd4-498e-45f6-a344-96086203768e" } The example that worked for me : request 2 curl --location 'https://<mysplunk>/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes?notable_time=-3m' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data '{ "title": "Test finding4 for ES 8.2 - new note 16", "content": "Comment for Test finding4 for ES 8.2 - via new API " }' response 2: { "id": "e258bd11-5e59-491a-b070-5d5d1af7cedd", "create_time": 1761639950.3005178, "update_time": 1761639950.3005178, "title": "Test finding4 for ES 8.2 - new note 16", "content": "Comment for Test finding4 for ES 8.2 - via new API ", "author": { "username": "developer" }, "ai_generated": false, "files": [], "last_edited_by": null, "response_plan_info": null, "source": null, "source_type": "Incident", "incident_id": null, "notable_id": "6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde" }   The note is created correctly and can be seen in UI.           ... View more