GetTestSuiteTestCasesReviewNotes

Search the review notes across all test cases in a project.

Headers

POST /api/ss/testsuites/:id/testcases/review-notes HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID for the Test Suite.

Body

skip - number

Number of records to skip. Default is 0 (do not skip any records).

limit - number

Number of records to limit to. Default limit is 50. Max limit is 50.

include_replies - boolean

Return each thread's replies under replies (true, the default) or leave replies off every note (false). Send false when you only need the top-level notes, which also skips the reply lookup.

resolved - boolean

Return resolved notes only (true) or unresolved notes only (false). Omit to return both.

testcase_ids - list of strings

IDs of the test cases to search within. Every id must be a test case in this test suite. Omit, or send an empty list, to search all test cases in the test suite.

order - string

Field and direction to sort the threads by. Direction must be ASC or DESC. Default is created DESC. Replies are always returned oldest first, whichever direction the threads are in.

Field	Sortable	Notes
id	Yes
created	Yes	The default
created_by	No
modified	No
note	No
resolved	Yes
resolved_at	Yes	Notes that have never been resolved have no value, so they sort first in ASC and last in DESC

Ordering by any other field returns an error.

q - string

Provides options to query a custom selection of review notes. Please visit the following link for more details on how to use this filter - https://support.attackforge.com/attackforge-enterprise/modules/self-service-restful-api/advanced-query-filter

The filter applies to the threads, not to the replies inside them, and is combined with topic and resolved when those are also supplied. Only the fields below can be filtered - any other field, or an expression that does not parse, returns an error.

Fields

Field	Type	Notes
id	ObjectId
created	date	ISO 8601 string
created_by	ObjectId	The id of the user who wrote the note
modified	date	ISO 8601 string. Also accepted as last_modified
note	string	The stored text of the note - HTML on notes written in rich text - so it suits $regex
resolved	boolean
resolved_at	date	ISO 8601 string. Absent on notes that have never been resolved

Examples

 Find the notes one user wrote { created_by: { $eq: ObjectId("5eab99471e18050942c7607a") } }

 Find notes written since a date { created: { $gte: "2026-01-01" } }

 Find notes that have never been resolved { resolved_at: { $eq: null } }

topic - list of strings

Filter to review notes carrying one of these topics. Each value is type:source:key:

Part	Value
type	system for a built-in part of the test case, or custom for a custom field
source	Always testcase
key	Which part or custom field the note is against - see below

Add one entry per topic, e.g. ["system:testcase:details", "system:testcase:code"]. A note is returned if it carries any of them.

System topics

Key	Notes
testCase	The test case title
code
details
executionFlow	Execution Flow
tags
files

For example system:testcase:executionFlow.

Custom topics

The key is the key of the test case custom field the note is against, not its label. It is the same value as key in custom_fields on the test case from Get Test Suite, so a field with key business_impact is filtered with custom:testcase:business_impact.

Every returned note lists its topics with type, source and key, so topics[].key can also be copied from an existing note.

Validation

• Keys are case-sensitive and are not validated.

• An unknown key, or a custom field that does not exist, simply matches no notes.

• An unrecognised type or source, or an empty key, returns an error.

Example

Request

curl --request POST \
	--url https://demo.attackforge.dev/api/ss/testsuites/5f63de24fa1c9208d3e140b0/testcases/review-notes \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************' \
	--data '{
		"testcase_ids":["5e8017d2e1385f0c58e8f4f8"],
		"resolved":false,
		"order":"created ASC"
	}'

Response

{
  "count": 1,
  "review_notes": [
    {
      "id": "...",
      "testcase_id": "5e8017d2e1385f0c58e8f4f8",
      "testcase_title": "...",
      "testcase_code": "...",
      "note": "...",
      "note_html": "...",
      "created": "...",
      "created_by": {
        "id": "...",
        "first_name": "...",
        "last_name": "..."
      },
      "topics": [
        {
          "type": "system",
          "source": "testcase",
          "key": "details",
          "name": "Details"
        }
      ],
      "resolved": false,
      "replies": [
        {
          "id": "...",
          "note": "...",
          "created": "...",
          "created_by": {
            "id": "...",
            "first_name": "...",
            "last_name": "..."
          },
          "replies": []
        }
      ]
    }
  ]
}

Access and failures

The test suite must exist. Failures come back as an error in the 200 body:

Error	When
Testsuite Not Found	The test suite does not exist
testcase_ids contain invalid ids	An id is not a non-deleted test case in this test suite
An invalid filter message	topic or q did not validate - see each property below
Error Finding Review Notes	The lookup failed

Response

Results come back as threads: each review note carries its replies nested under replies, oldest first, whichever direction the threads are sorted in, and a reply to a reply is nested the same way. Send include_replies as false to leave replies off every note. count, skip and limit apply to the threads on this page, not to the replies inside them. Deleted notes are dropped along with their thread, and deleted replies are dropped from the thread they belong to.

Every thread carries testcase_id, the id of the test case in the test suite. Topics for custom fields you cannot view are removed from topics, and a note whose topics are all hidden from you is not returned at all.

note is plain text, and created and resolved_at are ISO 8601 UTC strings. These properties are only present when they apply:

Property	Present when
testcase_title, testcase_code	The test case has them
note_html	The note was written in rich text
resolved_at	The note has been resolved
has_hidden_topics	A topic was removed from topics because you cannot view its custom field. Always true
replies	include_replies is not false