GetProjectTestCaseReviewNotes

Get the review notes on a test case in a project.

Headers

GET /api/ss/project/:projectId/testcase/:testcaseId/review-notes HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

projectId - string | required

ID for the project.

testcaseId - string | required

ID of the project test case.

Query Parameters

skip - number

Number of records to skip. Default is 0 (do not skip any records).

limit - number

Number of records to limit to. Default limit is 50. Max limit is 50.

resolved - boolean

Return resolved notes only (true) or unresolved notes only (false). Omit to return both.

include_replies - boolean

Return each thread's replies under replies (true, the default) or leave replies off every note (false). Send false when you only need the top-level notes, which also skips the reply lookup.

order - string

Field and direction to sort the threads by. Direction must be ASC or DESC. Default is created DESC. Replies are always returned oldest first, whichever direction the threads are in.

Field	Sortable	Notes
id	Yes
created	Yes	The default
created_by	No
modified	No
note	No
resolved	Yes
resolved_at	Yes	Notes that have never been resolved have no value, so they sort first in ASC and last in DESC

Ordering by any other field returns an error.

q - string

Provides options to query a custom selection of review notes. Please visit the following link for more details on how to use this filter - https://support.attackforge.com/attackforge-enterprise/modules/self-service-restful-api/advanced-query-filter

The filter applies to the threads, not to the replies inside them, and is combined with topic and resolved when those are also supplied. Only the fields below can be filtered - any other field, or an expression that does not parse, returns an error.

Fields

Field	Type	Notes
id	ObjectId
created	date	ISO 8601 string
created_by	ObjectId	The id of the user who wrote the note
modified	date	ISO 8601 string. Also accepted as last_modified
note	string	The stored text of the note - HTML on notes written in rich text - so it suits $regex
resolved	boolean
resolved_at	date	ISO 8601 string. Absent on notes that have never been resolved

Examples

 Find the notes one user wrote { created_by: { $eq: ObjectId("5eab99471e18050942c7607a") } }

 Find notes written since a date { created: { $gte: "2026-01-01" } }

 Find notes that have never been resolved { resolved_at: { $eq: null } }

topic - array

Filter to review notes carrying one of these topics. Each value is type:source:key:

Part	Value
type	system for a built-in part of the test case, or custom for a custom field
source	project-testcase for a part of the test case as it sits in this project, or testcase for a part of the library test case it was added from
key	Which part or custom field the note is against - see below

Add the parameter once per topic, e.g. ?topic=system:testcase:details&topic=system:project-testcase:evidence. A note is returned if it carries any of them.

System topics on the project test case

The key is assignedAssets (Assigned Assets) or evidence. For example system:project-testcase:assignedAssets.

System topics on the library test case

Key	Notes
testCase	The test case title
testSuite
code
details
executionFlow	Execution Flow
tags

For example system:testcase:executionFlow.

Custom topics

The key is the key of the custom field the note is against, not its label. It is the same value as key in the custom fields on each test case from Get Project Test Cases, so a field with key business_impact is filtered as follows:

Custom field on	Key taken from	Filter
The project test case	custom_fields	custom:project-testcase:business_impact
The library test case	testsuite.testcase.custom_fields	custom:testcase:business_impact

Every returned note lists its topics with type, source and key, so topics[].key can also be copied from an existing note.

Validation

• Keys are case-sensitive and are not validated.

• An unknown key, or a custom field that does not exist, simply matches no notes.

• An unrecognised type or source, or an empty key, returns an error.

Example

Request

curl --request GET \
	--url 'https://demo.attackforge.com/api/ss/project/5f63de24fa1c9208d3e140b0/testcase/5e8017d2e1385f0c58e8f4f8/review-notes?q=%7B%20created%3A%20%7B%20%24gte%3A%20%222026-01-01%22%20%7D%20%7D&topic=system%3Aproject-testcase%3Aevidence&resolved=false&include_replies=false&order=created%20ASC&skip=10&limit=50' \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************'

Response

{
  "count": 1,
  "review_notes": [
    {
      "id": "...",
      "note": "...",
      "note_html": "...",
      "created": "...",
      "created_by": {
        "id": "...",
        "first_name": "...",
        "last_name": "..."
      },
      "topics": [
        {
          "type": "system",
          "source": "project-testcase",
          "key": "evidence",
          "name": "Evidence"
        }
      ],
      "resolved": false,
      "replies": [
        {
          "id": "...",
          "note": "...",
          "created": "...",
          "created_by": {
            "id": "...",
            "first_name": "...",
            "last_name": "..."
          },
          "replies": []
        }
      ]
    }
  ]
}

Access and failures

Requires access to the project's test cases, and the test case must belong to the project. Failures come back as an error in the 200 body:

Error	When
Missing Authorization	You do not have access to the project's test cases
Testcase Not Found	The test case is deleted or belongs to another project
An invalid filter message	topic or q did not validate - see each property below
Error Finding Review Notes	The lookup failed

Response

Results come back as threads: each review note carries its replies nested under replies, oldest first, whichever direction the threads are sorted in, and a reply to a reply is nested the same way. Send include_replies as false to leave replies off every note. count, skip and limit apply to the threads on this page, not to the replies inside them. Deleted notes are dropped along with their thread, and deleted replies are dropped from the thread they belong to.

Topics for custom fields you cannot view are removed from topics, and a note whose topics are all hidden from you is not returned at all.

note is plain text, and created and resolved_at are ISO 8601 UTC strings. These properties are only present when they apply:

Property	Present when
note_html	The note was written in rich text
resolved_at	The note has been resolved
has_hidden_topics	A topic was removed from topics because you cannot view its custom field. Always true
replies	include_replies is not false