Add a note
tenantKeybearerAuthX-Tenant-Key<token>The public store key (pk_live_…). Required on every call.
AuthorizationBearer <token>A customer token from POST /v1/auth/login, or a merchant API key, on routes that need one.
type*stringid*integerX-Client-IP?stringOptional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.
X-Tenant-Secret?stringOptional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.
Idempotency-Key?stringOptional; recommended (a UUID made once per user action, reused only to retry that action). Only a success is stored (24 hours): the same key with the same body, URI and credentials (Authorization, X-Cart-Token, X-Chat-Token) replays it (Idempotent-Replayed: true); anything else under that key is 422 IDEMPOTENCY_KEY_REUSED. An error is never stored: after a 4xx or 5xx, retrying with the same key runs the request again.
Success.
application/json- response
data*curl -X POST 'https://api.elaraone.app/api/v1/merchant/crm/string/0/notes' \ -H 'X-Tenant-Key: pk_live_…' \ -H 'X-Tenant-Secret: your-server-secret'{ "data": { "id": 0, "object": "string", "object_id": 0, "body": "string", "author": { "type": "staff", "id": 0 }, "pinned": true, "created_at": "string", "edited_at": "string" }}