API resources

Comments

Comments are the conversation the admin shows next to a record: notes the team leaves for each other, and messages exchanged with organisers or families. They can be attached to an offer, an application, a participant, an account, an organiser or an edition.

The comment model

Name
uuid
Type
string
Description
The comment's identifier.
Name
subjectType
Type
string
Description
The kind of record the comment belongs to: offer, attendance, participant, account, host or edition.
Name
subject
Type
string
Description
The UUID of that record.
Name
body
Type
string
Description
The text.
Name
channel
Type
string
Description
app for comments written in the admin or through the API, email for replies that came in by e-mail.
Name
visibility
Type
string
Description
internal for notes only the team sees, shared for messages sent to the organiser or the family.
Name
author
Type
reference
Description
The account of the person who wrote it.
Name
authorName
Type
string
Description
Who wrote it when it wasn't a person with an account: the sender of an e-mail reply, or a service account.
Name
parent
Type
string
Description
The UUID of the comment this one replies to.
Name
replies
Type
string[]
Description
The UUIDs of the replies to this comment.
Name
createdAt
Type
timestamp
Description
When the comment was written.
Name
editedAt
Type
timestamp
Description
When the comment was last edited.

Where comments live

Comments are read and written through the record they belong to. Each kind of record needs its own role:

Record	Path	Needs
Offer	`/offers/{uuid}/comments`	`ROLE_HOST`
Application	`/attendances/{uuid}/comments`	`ROLE_HOST`
Participant	`/participants/{uuid}/comments`	`ROLE_PARTICIPANTS_ADMIN` and `ROLE_ADMIN`
Account	`/accounts/{uuid}/comments`	`ROLE_ADMIN`
Organiser	`/hosts/{uuid}/comments`	`ROLE_ADMIN`
Edition	`/editions/{uuid}/comments`	`ROLE_ADMIN`

You see the comments the admin would show you on that record. Admins see all of them. Organiser users see only the comments they wrote or that were addressed to their organiser, with the replies to those. A service account with neither ROLE_ADMIN nor ROLE_PARTICIPANTS_ADMIN sees none.

GET/{records}/{uuid}/comments

List a record's comments

Returns all comments on a record. The list is not paginated.

Replace {records} with offers, attendances, participants, accounts, hosts or editions, and {uuid} with the record's UUID. A record you may not see is a 404.

Request

GET·/accounts/{uuid}/comments

curl https://ferienpass-musterstadt.de/api/accounts/0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05/comments \
  -H "Authorization: Bearer $FEPLI_TOKEN"

Response

[
  {
    "uuid": "0192f3a4-5b6c-7d7e-8f9a-0b1c2d3e4f33",
    "subjectType": "account",
    "subject": "0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05",
    "body": "Familie hat angerufen: Zahlung erfolgt bar am Montag.",
    "channel": "app",
    "visibility": "internal",
    "author": {
      "uuid": "0190a1b2-c3d4-7e5f-8a6b-7c8d9e0f1a22",
      "name": "Sabine Krüger"
    },
    "replies": ["0192f3b5-6c7d-7e8f-9a0b-1c2d3e4f5a34"],
    "createdAt": "2026-09-08T14:12:09+02:00"
  },
  {
    "uuid": "0192f3b5-6c7d-7e8f-9a0b-1c2d3e4f5a34",
    "subjectType": "account",
    "subject": "0191c7b2-4d5e-7f60-8a1b-2c3d4e5f6a05",
    "body": "Zahlung ist eingegangen, Beleg RE-142.",
    "channel": "app",
    "visibility": "internal",
    "authorName": "Support-Agent",
    "parent": "0192f3a4-5b6c-7d7e-8f9a-0b1c2d3e4f33",
    "replies": [],
    "createdAt": "2026-09-10T10:23:40+02:00"
  }
]

GET/comments/{uuid}

Retrieve a comment

Returns one comment. Needs ROLE_ADMIN.

Request

GET·/comments/{uuid}

curl https://ferienpass-musterstadt.de/api/comments/0192f3a4-5b6c-7d7e-8f9a-0b1c2d3e4f33 \
  -H "Authorization: Bearer $FEPLI_TOKEN"

POST/{records}/{uuid}/comments

Add a comment

Adds a comment to a record. Comments written through the API are internal notes: only the team sees them. Messages to organisers or families are written in the admin.

The comment is signed with the name of the person or service account behind the token.

Required attributes

Name
body
Type
string
Description
The text, up to 10,000 characters.

Optional attributes

Name
parent
Type
string
Description
The UUID of a comment on the same record to reply to.
Name
notify
Type
boolean
Description
Accepted, but has no effect yet: nobody is notified about comments written through the API. Mention the case to the team another way if it is urgent.

Request

POST·/attendances/{uuid}/comments

curl -X POST https://ferienpass-musterstadt.de/api/attendances/0192d0e8-3a4b-7c5d-9e6f-7a8b9c0d1e07/comments \
  -H "Authorization: Bearer $FEPLI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"body": "Lena braucht am Mittwoch ein Leihrad."}'

The response (201 Created) holds the new comment.