Create a comment on any subject

POST/api/comments/{subject_kind}/{subject_id}

createComment

Polymorphic comment create. Authorizes against the parent (repo for PR / thread / repo-issue, team for team-issue).

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/comments/SUBJECT_KIND/SUBJECT_ID' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"body":"string"}'

fetch

fetch("https://neosource.dev/api/comments/SUBJECT_KIND/SUBJECT_ID", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"body":"string"}),
});

Path parameters

subject_kindrequired: One of: `issue`, `pull_request`, `pr_review_thread`. (`commit` is reserved but not yet routable.)
string
subject_idrequired: Subject UUID — interpreted according to `subject_kind`.
string

Request bodyrequired

application/json

CreateCommentRequest

object

bodyrequired: string
Markdown body. Required.
parent_id: string | null
Optional reply-to comment id (hex UUID). Threads stay flat for v1.

Responses

201Comment created

application/json

CommentResponse

object

author_display_name: string | null
author_github_login: string | null
Last-seen GitHub login for authors with a linked GitHub identity (always set for ghosts).
author_handle: string | null
Author handle resolved at read time (route-layer enrichment via the ghost-safe authors projection); `None` if the account row could not be resolved.
author_idrequired: string
author_kind: one of
null
AccountKind
string
Rust mirror of the Pg `account_kind` enum (`accounts.kind`). `Ghost` rows are imported-author placeholders (GitHub metadata import, plans/github-metadata-import.md §6): `handle = gh-<github-id>`, `personal_workspace_id` NULL, no password, no sessions. They must never flow through `get_account*` (`AccountRow::into_record` CorruptData-errors on the NULL workspace) — author rendering goes through `PgGithubImportStore::authors_projection`, and claim-by-proof later promotes or merges them.
"human""bot""service""runner""ghost"
bodyrequired: string
comment_idrequired: string
created_atrequired: integerint64
deleted_at: integer | nullint64
editedrequired: boolean
parent_id: string | null
updated_atrequired: integerint64

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict, github_sync_active
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget