Comment on a deal

POST/deals/{deal_id}/comments

Writes a comment as the token's acting user and returns it with a Location. comment is required, up to 500 characters, and sanitised as HTML. Set parent_comment_id to reply; a reply of a reply returns 422 invalid and a reply takes its parent's visibility. A user_id in the body returns 422 missing. Emits deal_comment.created and sends in-app notifications to the deal's managers and owner, no email. DELETE /deals/{deal_id}/comments/{id} undoes it.

Path parameters

deal_idstring (uuid)Required#
The deal's id, a uuid. An unknown deal, or one the token can't see, returns 404.

Query parameters

dry_runboolean#
Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

Idempotency-Keystring#
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · DealCommentCreate

commentstringRequired#
The comment text. It is sanitised as HTML, and returns 422 filled when nothing is left.
comment_is_publicboolean#
Whether the deal's entrepreneur sees the comment. Defaults to false; an entrepreneur's comment is always public. Ignored on a reply, which takes its parent's visibility.
parent_comment_idstring | null#
The top-level comment of this deal to reply to. Null or absent for a top-level comment.

{
  "comment": "Looking forward to the next update.",
  "comment_is_public": true
}

Responses

201

The comment was written.

DealComment

{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "deal_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "user_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "parent_comment_id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "comment": "string",
    "comment_is_public": true,
    "like_count": 1,
    "reply_count": 1,
    "liked": true,
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

404

Resource not found (error.code = not_found).

Error

422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/deals/{deal_id}/comments\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "comment": "Looking forward to the next update.",
  "comment_is_public": true
}'