> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # List Transaction Notes > List the notes on a monitored transaction, newest first: your API notes, reviewer notes, rule notes and status changes, with limit and offset paging. List Transaction Notes API Prompt Copy prompt to clipboard \

\`List the notes on one Didit monitored transaction through the Management API.

Endpoint:
GET https://verification.didit.me/v3/transactions/{transaction_id}/notes/

Authentication:
Use the x-api-key header with my Didit API key. A scoped key needs transactions: read. Keys limited to specific workflows or to approved sessions cannot call this endpoint.

Goal:
\- Read the review timeline of a transaction (my own API notes, Console reviewer notes, and the notes Didit adds automatically) so I can show it in my back-office or sync it to my case tool.

Path parameter:
\- transaction_id: the Didit transaction uuid returned by POST /v3/transactions/ or GET /v3/transactions/. Not my own txn_id.

Behavior:
\- Notes come back newest first (created_at descending).
\- Paginated with limit (default 50) and offset. count is exact up to 100 and capped at 100 above that, so keep following next until it is null instead of computing pages from count.
\- metadata tells the note types apart: mentioned_emails on notes written through the API or the Console; type "status_change" with previous_status, new_status, reason_code and reason_label when a reviewer changed the status in the Console; source "rule_action" (with rule_uuid) or "remediation_session" on notes Didit adds automatically, which carry actor_name "Rule Engine".

Example call:
curl -X GET "https://verification.didit.me/v3/transactions/{transaction_id}/notes/?limit=50" \
-H "x-api-key: YOUR_API_KEY"

What to read from the response:
\- results[].uuid, note, created_at: the note itself.
\- results[].actor_email and actor_name: the Console user who wrote it. Both are null for notes created with an API key.
\- results[].metadata: mentions and the note type (see Behavior).
\- next: URL of the next page, null on the last page.

Failure modes:
\- 400: limit or offset above 1000000.
\- 401: the API key has expired.
\- 403: missing or invalid API key ({"detail": "You do not have permission to perform this action."}), a scoped key without transactions: read, a key with workflow or status limits, or a request from outside the key's IP allowlist.
\- 404: no transaction with this uuid in my application ({"detail": "No Transaction matches the given query."}).
\- 429: more than 600 GET requests per minute with this key; wait Retry-After seconds and retry.

Side effects: none. This is a pure read.

For the full integration shape, see /integration/integration-prompt.`

\
Paste into Notes are the analyst timeline of a transaction: the same list reviewers see under **Notes** on the [transaction detail](/transaction-monitoring/console.md#transaction-detail) in the Console. Add your own with [Create transaction note](/management-api/transactions/create-note.md), and read the transaction itself, including its `activities`, with [Get transaction](/management-api/transactions/get.md).Notes with `actor_name` set to `Rule Engine` come from Didit: a rule's `add_note` [action](/transaction-monitoring/rules.md#actions), or a problem creating the user-action verification session for a transaction in `AWAITING_USER` (the session could not be created, or Didit fell back to another workflow). ## OpenAPI ````yaml GET /v3/transactions/{transaction_id}/notes/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/transactions/{transaction_id}/notes/: get: tags: - Transactions summary: List transaction notes description: >- List the notes on one monitored transaction, newest first (`created_at` descending): notes you add through the API, notes and status changes reviewers make in the Console, and notes Didit adds automatically (a rule's `add_note` action, or a problem creating the user-action verification session), which carry `actor_name` `Rule Engine`. `metadata` tells the note types apart. Paginated with `limit` and `offset`. `count` is exact up to 100 and capped at 100 above that, so follow `next` until it is `null` instead of computing pages from `count`. This is a read with no side effects. A scoped API key needs `transactions: read`; a key limited to some workflows or to approved sessions cannot call this endpoint. Reviewers see the same list under **Notes** on the [transaction detail](https://docs.didit.me/transaction-monitoring/console#transaction-detail). operationId: list_transaction_notes parameters: - name: transaction_id in: path required: true description: >- Didit transaction UUID: the `uuid` returned by `POST /v3/transactions/` and `GET /v3/transactions/`. Your own `txn_id` is not accepted. schema: type: string format: uuid example: abcdef12-3456-7890-abcd-ef1234567890 - name: limit in: query required: false schema: type: integer default: 50 minimum: 1 maximum: 1000000 description: >- Number of notes per page. Defaults to 50. A value that is not a positive integer falls back to 50; a value above 1000000 returns `400`. - name: offset in: query required: false schema: type: integer maximum: 1000000 minimum: 0 default: 0 description: >- Zero-based position of the first note to return. Prefer following `next`. A value that is not a whole number falls back to 0; a value above 1000000 returns `400`. responses: '200': description: A page of notes, newest first. content: application/json: schema: type: object required: - count - next - previous - results properties: count: type: integer description: >- Number of notes on the transaction: exact up to 100, capped at 100 above that. Follow `next` instead of computing pages from it. next: type: string format: uri nullable: true description: Absolute URL of the next page, or `null` on the last page. previous: type: string format: uri nullable: true description: >- Absolute URL of the previous page, or `null` on the first page. results: type: array items: $ref: '#/components/schemas/TransactionNote' examples: API, Console and rule notes: value: count: 3 next: null previous: null results: - uuid: c1111111-2222-4333-8444-555555555555 note: Customer confirmed the withdrawal by phone. actor_email: null actor_name: null metadata: mentioned_emails: - analyst@example.com created_at: '2026-10-16T10:05:12.481203Z' - uuid: c2222222-3333-4444-8555-666666666666 note: >- Status changed from IN_REVIEW to APPROVED. Reason: Source of funds verified actor_email: reviewer@example.com actor_name: Alex Reviewer metadata: type: status_change previous_status: IN_REVIEW new_status: APPROVED reason_code: SOF_VERIFIED reason_label: Source of funds verified created_at: '2026-10-15T17:22:40.103911Z' - uuid: c3333333-4444-4555-8666-777777777777 note: >- Large withdrawal to a new wallet: check the source of funds. actor_email: null actor_name: Rule Engine metadata: rule_uuid: d1111111-2222-4333-8444-555555555555 source: rule_action created_at: '2026-10-15T08:42:12.004518Z' No notes yet: value: count: 0 next: null previous: null results: [] '400': description: >- `limit` or `offset` is above 1000000. The body is a JSON array of messages, not an object. content: application/json: schema: type: array items: type: string examples: Limit too large: value: - limit must not exceed 1000000. Offset too large: value: - offset must not exceed 1000000. '401': description: >- The API key has expired. Only a key created with an expiry date can expire; after that date every request with it answers `401`. content: application/json: schema: type: object properties: detail: type: string examples: Expired key: value: detail: This API key has expired. '403': description: >- The request is not allowed. A missing or invalid API key gets the generic message (never `401`). content: application/json: schema: type: object properties: detail: type: string examples: Missing or invalid key: value: detail: You do not have permission to perform this action. Scoped key without transactions read: value: detail: This API key has no read access to transactions. Key limited to workflows or approved sessions: value: detail: >- This API key only reaches sessions inside its workflow or status limits, so it can't use this endpoint. Outside the key's IP list: value: detail: This API key can't be used from this IP address. '404': description: >- No transaction with this UUID exists in the application (never created, deleted, or owned by another application). A `transaction_id` that is not a UUID does not reach the API: it returns a `404` HTML page instead of this JSON body. content: application/json: schema: type: object properties: detail: type: string examples: Not found: value: detail: No Transaction matches the given query. '429': description: >- More than 600 GET requests per minute with this API key. Wait the number of seconds in `Retry-After`, then retry. content: application/json: schema: type: object properties: detail: type: string examples: Throttled: value: detail: >- GET request rate limit exceeded. You can make up to 600 requests per minute. headers: Retry-After: description: Seconds until the current one-minute window resets. schema: type: integer example: 23 X-RateLimit-Limit: description: Requests allowed per minute in this budget. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current window. schema: type: integer X-RateLimit-Reset: description: Unix time when the window resets. schema: type: integer security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X GET 'https://verification.didit.me/v3/transactions/abcdef12-3456-7890-abcd-ef1234567890/notes/?limit=50' \ -H 'x-api-key: YOUR_API_KEY' - lang: python label: Python source: >- import os import requests transaction_id = 'abcdef12-3456-7890-abcd-ef1234567890' url = f'https://verification.didit.me/v3/transactions/{transaction_id}/notes/' params = {'limit': 50} while url: resp = requests.get( url, headers={'x-api-key': os.environ['DIDIT_API_KEY']}, params=params, timeout=10, ) resp.raise_for_status() page = resp.json() for note in page['results']: print(note['created_at'], note['actor_name'], note['note']) url, params = page['next'], None - lang: javascript label: JavaScript source: >- const transactionId = 'abcdef12-3456-7890-abcd-ef1234567890'; let url = `https://verification.didit.me/v3/transactions/${transactionId}/notes/?limit=50`; while (url) { const resp = await fetch(url, { headers: { 'x-api-key': process.env.DIDIT_API_KEY }, }); if (!resp.ok) throw new Error(`List notes failed: ${resp.status}`); const page = await resp.json(); for (const note of page.results) console.log(note.created_at, note.actor_name, note.note); url = page.next; } components: schemas: TransactionNote: type: object description: One note on a monitored transaction's review timeline. required: - uuid - note - actor_email - actor_name - metadata - created_at properties: uuid: type: string format: uuid description: Note identifier. note: type: string description: Plain-text note body. actor_email: type: string format: email nullable: true description: >- Email of the Console user who wrote the note or changed the status. `null` for notes created with an API key and for notes Didit adds automatically. actor_name: type: string nullable: true description: >- Display name of the Console user (their email when they have no name). `Rule Engine` on notes Didit adds automatically. `null` for notes created with an API key. metadata: type: object description: >- Tells the note types apart. Notes written through the API or the Console carry `mentioned_emails`. A status change made in the Console carries `type: status_change` with `previous_status`, `new_status`, `reason_code` and `reason_label`. Notes Didit adds carry `source`: `rule_action` (with `rule_uuid`) for a rule's `add_note` action, or `remediation_session` for a problem creating the user-action verification session. properties: mentioned_emails: type: array items: type: string format: email description: >- Mentioned organization members, lower-cased and de-duplicated. Empty when nobody was mentioned. type: type: string enum: - status_change description: Present on notes recording a status change made in the Console. previous_status: type: string enum: - APPROVED - IN_REVIEW - DECLINED - AWAITING_USER description: Status before the change. new_status: type: string enum: - APPROVED - IN_REVIEW - DECLINED - AWAITING_USER description: Status after the change. reason_code: type: string nullable: true description: Reason code given with the change. reason_label: type: string nullable: true description: Reason label given with the change. source: type: string enum: - rule_action - remediation_session description: Present on notes Didit adds automatically. rule_uuid: type: string format: uuid description: >- Rule whose `add_note` action wrote the note (with `source: rule_action`). created_at: type: string format: date-time description: When the note was stored. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.