curl --request GET \
--url https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id} \
--header 'Accept: <accept>' \
--header 'AccessToken: <api-key>'import requests
url = "https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}"
headers = {
"Accept": "<accept>",
"AccessToken": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Accept: '<accept>', AccessToken: '<api-key>'}};
fetch('https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Accept: <accept>",
"AccessToken: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Accept", "<accept>")
req.Header.Add("AccessToken", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}")
.header("Accept", "<accept>")
.header("AccessToken", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Accept"] = '<accept>'
request["AccessToken"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"note_id": "884213",
"display_id": "2261310",
"body": "Your down payment has been received — coverage is active.",
"occurred_at": "2026-07-06T20:41:07+00:00"
}{
"error": "Not found."
}Get a Public Reply Note
Retrieve the body of a single public reply note by its note ID — the pull counterpart to the content-free submission.public_reply webhook. The webhook tells you that a reply happened and gives you a note_id; this endpoint returns the text.
Only public replies are retrievable. Internal notes are never returned. A note ID that does not exist, identifies an internal note, belongs to a different submission than the displayId you passed, or belongs to another company all return the same 404 with the same body — the responses are deliberately indistinguishable, so a non-public note’s existence is never revealed.
Company scoping is an exact match on the calling partner’s own company, mirroring the webhook side: you can resolve exactly the note IDs you were pushed, and no others. A parent company cannot read a child company’s note even where broader visibility exists elsewhere in the platform.
curl --request GET \
--url https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id} \
--header 'Accept: <accept>' \
--header 'AccessToken: <api-key>'import requests
url = "https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}"
headers = {
"Accept": "<accept>",
"AccessToken": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Accept: '<accept>', AccessToken: '<api-key>'}};
fetch('https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Accept: <accept>",
"AccessToken: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Accept", "<accept>")
req.Header.Add("AccessToken", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}")
.header("Accept", "<accept>")
.header("AccessToken", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.coverwhale.dev/v1/submission/{displayId}/notes/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Accept"] = '<accept>'
request["AccessToken"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"note_id": "884213",
"display_id": "2261310",
"body": "Your down payment has been received — coverage is active.",
"occurred_at": "2026-07-06T20:41:07+00:00"
}{
"error": "Not found."
}Authorizations
JWT returned as AccessToken by the /authentication endpoint (the Cognito ID token carrying the email claim). It expires after 3600 seconds.
Path Parameters
Submission display ID. Must be the submission the note belongs to.
Note ID, as delivered in the note_id field of a submission.public_reply webhook.
Response
Public reply note
The note's ID, echoed back as a string.
"884213"
The submission the note belongs to.
"2261310"
The reply text. There is no separate subject field.
"Your down payment has been received — coverage is active."
When the note was created. ISO 8601 with offset.
"2026-07-06T20:41:07+00:00"