> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Notes

> Returns a list of notes associated with an investigation.



## OpenAPI

````yaml /documentation/api-reference/v3.yaml get /investigations/{investigationId}/notes
openapi: 3.0.0
info:
  title: USM Anywhere Investigations API
  version: '3'
  description: >-
    This document contains the API specification for the Investigations
    microservice. You can use this API to build, delete, modify, or list the
    Investigation objects, which may contain attachments, evidence, or notes.
  contact:
    url: http://www.levelblue.com
servers:
  - url: http://investigations.{region}.alienvault.cloud/investigations/v3
security:
  - JWT: []
tags:
  - name: Attachments
  - name: Evidence
  - name: History
  - name: Investigations
  - name: Notes
paths:
  /investigations/{investigationId}/notes:
    parameters:
      - $ref: '#/components/parameters/investigationId'
    get:
      tags:
        - Notes
      summary: List Notes
      description: Returns a list of notes associated with an investigation.
      operationId: get-investigations-investigationId-notes
      responses:
        '200':
          description: OK
          headers:
            X-ATT-MessageId:
              $ref: '#/components/headers/X-ATT-MessageId'
            X-ATT-TransactionId:
              $ref: '#/components/headers/X-ATT-TransactionId'
            X-ATT-ServiceVersion:
              $ref: '#/components/headers/X-ATT-ServiceVersion'
          content:
            application/json:
              schema:
                title: getNotes
                type: object
                properties:
                  _links:
                    $ref: '#/components/schemas/linksSelf'
                  notes:
                    type: array
                    items:
                      $ref: '#/components/schemas/gNote'
              examples:
                notes_g:
                  $ref: '#/components/examples/notes_g'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '406':
          $ref: '#/components/responses/406'
        '429':
          $ref: '#/components/responses/429'
        '500':
          $ref: '#/components/responses/500'
        '503':
          $ref: '#/components/responses/503'
components:
  parameters:
    investigationId:
      name: investigationId
      description: The unique identifier of an investigation.
      in: path
      schema:
        type: string
        format: uuid
      required: true
  headers:
    X-ATT-MessageId:
      description: |-
        A client-provided value that uniquely identifies a client
        generated message sent to the service. This header will be
        present in the response if the client provided one in the
        request.
      schema:
        type: string
      required: false
    X-ATT-TransactionId:
      description: |-
        A service provided value that uniquely identifies a message
        returned by the service.
      schema:
        type: string
        format: uuid
      required: true
    X-ATT-ServiceVersion:
      description: |-
        Identifies the version number of the service that processed
        the request.
      schema:
        type: string
      required: true
    Date:
      schema:
        type: string
        format: date-time
      required: true
  schemas:
    linksSelf:
      type: object
      properties:
        self:
          allOf:
            - $ref: '#/components/schemas/selfLink'
    gNote:
      title: getNote
      type: object
      properties:
        _links:
          $ref: '#/components/schemas/linksSelf'
        id:
          $ref: '#/components/schemas/id'
        private:
          $ref: '#/components/schemas/private'
        message:
          $ref: '#/components/schemas/message'
        created:
          $ref: '#/components/schemas/created'
        lastModified:
          $ref: '#/components/schemas/lastModified'
      description: 'Returns a note. '
    selfLink:
      type: object
      description: References the returned resource
      allOf:
        - $ref: '#/components/schemas/href'
    id:
      type: string
      title: id
      format: uuid
      description: Unique identifier of the resource.
    private:
      type: boolean
      description: >-
        Specifies the visibility of the item. This semantic is only valid when
        there exists a relationship between a USM Central deployment and a USM
        Anywhere deployment. When set to true, only the users within the same
        deployment, USM Central or USM Anywhere, can see the item; the users
        from the other deployment cannot. 
    message:
      title: message
      type: string
      description: 'Text in a note. '
    created:
      allOf:
        - $ref: '#/components/schemas/_modOnBy'
      description: 'Specifies when the resource was created and by whom. '
    lastModified:
      title: lastModified
      allOf:
        - $ref: '#/components/schemas/_modOnBy'
      description: 'Specifies when the latest modification was made and by whom. '
    errorBody:
      title: errorBody
      type: object
      properties:
        errorId:
          type: string
          description: |-
            Unique errorId in the context of an API.

            Recommendation: two hyphen-delimited subfields:
            * Domain: identifies the API, application, service or general
              category to which the error belongs.
            * Code: provides a unique numeric code within the domain.

            Examples: General-0001, DataDict-0001
        message:
          type: string
          description: Message text
        variables:
          type: array
          description: >-
            List of zero or more strings that represent the contents of the
            variables used by the message text.
          items:
            type: string
        errorUrl:
          type: string
          format: uri
          description: >-
            Hyperlink to more information about the error, including causes and
            solutions.
      required:
        - errorId
        - message
      x-examples:
        full error body:
          errorId: addressbook-0003
          message: 'Invalid input value for property %1. Valid values are: %2.'
          variables:
            - addressType
            - Home, Work, Other
          errorUrl: http://dev.att.com/apis/errors?code=addressbook-0003
        minimal error body:
          errorId: addressbook-0001
          message: Daily TPS limit exceeded.
    href:
      type: object
      description: An absolute URI [RFC3986]
      format: uri
      properties:
        href:
          type: string
          format: uri
          description: An absolute URI [RFC3986]
    _modOnBy:
      title: _mod_on_by
      type: object
      description: 'Specifies when the change was made and by whom.  '
      properties:
        by:
          type: string
          format: email
          description: 'Email of the user who made the change. '
        'on':
          type: string
          format: date-time
          description: >-
            Date and time when the change was made. Accepted format is ISO-8601
            YYYY-MM-DDThh:mm:ss.sTZD. 
      required:
        - by
        - 'on'
  examples:
    notes_g:
      summary: Response Example
      value:
        _links:
          self:
            href: >-
              https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes?page=1&perPage=3
          next:
            href: >-
              https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes?page=2&perPage=3
          last:
            href: >-
              https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes?page=6&perPage=3
        notes:
          - _links:
              self:
                href: >-
                  https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes/bc1c5197-c195-49a6-b3df-9662b8684dce
            id: bc1c5197-c195-49a6-b3df-9662b8684dce
            message: The user must have clicked the wrong button.
            private: mssp://some-mssp.alienvault.cloud
            created:
              by: ace@some.mssp.com
              'on': 2018-11-07T17:02:42,981Z
            lastModified:
              by: updater@some.mssp.com
              'on': 2018-11-07T17:03:02,491Z
          - _links:
              self:
                href: >-
                  https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes/88ed6265-ceea-44b9-86c0-fb9e6be8614e
            id: 88ed6265-ceea-44b9-86c0-fb9e6be8614e
            message: What did this guy do?
            private: mssp://usmc.alienvault.cloud
            created:
              by: ace@some.mssp.com
              'on': 2018-11-07T15:49:43,023Z
            lastModified:
              by: ace@some.mssp.com
              'on': 2018-11-07T15:49:43,023Z
          - _links:
              self:
                href: >-
                  https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes/c6c60d38-d304-4d68-9601-a22d08854401
            id: c6c60d38-d304-4d68-9601-a22d08854401
            message: This is an interesting event that we should research more.
            private: null
            created:
              by: user@asecurityteam.com
              'on': 2018-11-07T15:39:22,531Z
            lastModified:
              by: user@asecurityteam.com
              'on': 2018-11-07T15:39:22,531Z
  responses:
    '400':
      description: |-
        Bad Request - Many possible reasons associated with the request
        (form, content, etc.). Do not resubmit this request unchanged.
      headers:
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/errorBody'
    '401':
      description: |-
        Unauthorized - Authentication failed or was not provided in the
        Authorization header.
      headers:
        WWW-Authenticate:
          schema:
            type: string
            enum:
              - Bearer
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
    '403':
      description: |-
        Forbidden - The client has insufficient permissions to access
        the resource
      headers:
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
    '404':
      description: |-
        Not Found - The server has not found anything matching the
        Request-URI. No indication is given of whether the condition
        is temporary or permanent.
      headers:
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
    '406':
      description: >-
        Not Acceptable - The value specified for the Accept header in the
        request is not supported. Acceptable value is "application/json".
      headers:
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
    '429':
      description: Too Many Requests
      headers:
        Date:
          $ref: '#/components/headers/Date'
        Retry-After:
          schema:
            type: integer
          description: |-
            Tells the user how long to wait in seconds before making
            another request in seconds.
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
    '500':
      description: |-
        Internal Sever Error - The server encountered an internal error
        or timed out. Please try again later.
      headers:
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
    '503':
      description: |-
        Service Unavailable - The server is currently unable to receive
        requests. Please try again later.
      headers:
        Date:
          $ref: '#/components/headers/Date'
        X-ATT-TransactionId:
          $ref: '#/components/headers/X-ATT-TransactionId'
        X-ATT-ServiceVersion:
          $ref: '#/components/headers/X-ATT-ServiceVersion'
        X-ATT-MessageId:
          $ref: '#/components/headers/X-ATT-MessageId'
  securitySchemes:
    JWT:
      type: http
      scheme: bearer

````