> ## Documentation Index > Fetch the complete documentation index at: https://docs.marro.si/llms.txt > Use this file to discover all available pages before exploring further. # Add a note > Adds a note to the lead’s timeline, shown as added via the API. Scope: `leads.write`. ## OpenAPI ````yaml /openapi.json post /api/v1/leads/{leadId}/notes openapi: 3.1.0 info: title: Marro API version: 1.0.0 description: >- Server-to-server access to one organization’s data in Marro. Each key belongs to an organization and can use only the scopes it was given for modules the organization subscribes to. Keys go only in the Authorization header, over HTTPS, from a server: never in browser code or a URL. A key that was ever sent over plain HTTP or in a URL must be treated as leaked: revoke it and create a new one. The API sends no CORS headers. Every response carries `X-Request-Id`, to quote to support. Once the key is checked, responses also carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the window resets) for whichever limit is closer to running out. An address that is not an endpoint answers 404 `NOT_FOUND` in the same error shape. servers: - url: https://app.marro.si security: [] tags: - name: Leads - name: Reference description: 'How this organization is set up: fields, stages, sources and people.' paths: /api/v1/leads/{leadId}/notes: post: tags: - Leads summary: Add a note description: |- Adds a note to the lead’s timeline, shown as added via the API. Scope: `leads.write`. operationId: add-note parameters: - name: leadId in: path required: true description: The lead’s ID. schema: type: integer minimum: 1 requestBody: required: true content: application/json: schema: type: object properties: text: type: string minLength: 1 maxLength: 5000 required: - text additionalProperties: false example: text: Asked for the fee structure by email. responses: '201': description: The note. content: application/json: schema: type: object properties: note: type: object properties: leadId: type: integer exclusiveMinimum: 0 maximum: 2147483647 text: type: string createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - leadId - text - createdAt additionalProperties: false required: - note additionalProperties: false example: note: leadId: 1842 text: Asked for the fee structure by email. createdAt: '2026-09-24T03:35:00Z' '401': description: 'UNAUTHORIZED: The key is missing, wrong, revoked or expired.' content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- FORBIDDEN: The key lacks the scope, or the organization’s plan does not include it. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: 'NOT_FOUND: No lead with this ID in the organization.' content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- RATE_LIMITED: More than 600 requests in an hour with this key, or 3000 with all of the organization’s keys together. `Retry-After` says how many seconds to wait. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: >- INTERNAL: Something failed on our side. Retry; if it persists, contact support quoting the `X-Request-Id` response header. content: application/json: schema: $ref: '#/components/schemas/Error' security: - ApiKey: - leads.write components: schemas: Error: type: object properties: error: type: object properties: code: type: string description: >- Stable, machine-readable: UNAUTHORIZED, FORBIDDEN, NOT_FOUND, VALIDATION_FAILED, DUPLICATE_LEAD, RATE_LIMITED… message: type: string description: A sentence for people. details: description: >- For VALIDATION_FAILED, `fields` maps each field key to its problem. type: object propertyNames: type: string additionalProperties: {} required: - code - message additionalProperties: false required: - error additionalProperties: false id: Error securitySchemes: ApiKey: type: http scheme: bearer description: >- An organization API key, created in Settings → Connections → API keys. Keys start with `mk_live_`. Marro stores only a hash of a key, so it is shown once, when it is created: copy it then. Revoking a key ends its access at once. To replace a key without downtime, create the new one, switch your server to it, then revoke the old one. Changes made with a key appear on the lead’s timeline as made by the person who created the key, via the API. Scopes: `leads.read` (Read leads), `leads.write` (Create and update leads), `leads.capture` (Capture leads). x-scopes: leads.read: label: Read leads description: >- Leads with every field, and the lists that describe them: fields, stages, sources and people. module: crm leads.write: label: Create and update leads description: >- Create leads, change their fields, stage and owner, and add notes. Needs leads.read. module: crm leads.capture: label: Capture leads description: >- Capture leads from a website or form: add a lead or update the existing one with the same phone or email. Cannot read, list or change anything else. module: crm x-key-types: - name: Website form scopes: - leads.capture lifetimeDays: 730 description: >- A website or landing-page form that sends enquiries in as leads. Can do nothing else. - name: Another application lifetimeDays: 90 description: >- Any other integration. Choose the scopes it needs when you create it. ````