# Add a comment to an order

```http
POST https://secure.yoprint.com/v2/api/store/{team_slug}/v2/sales_order/{hash_id}/comment
```

- API version: v2
- Operation ID: `v2_public_order_comment_store`
- Section: Sales › [Sales order comments](https://developer.yoprint.com/reference/sales-order-comments.md)
- Web page: https://developer.yoprint.com/reference/sales-order-comments/v2-order-comment-store/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Comments are internal notes for your team on a published sales order or quote. The customer never sees them.

Adds a comment as the API key's user. The answer is the comment. `{hash_id}` is the order's `id` (for example `V4keXwwxMQyXw7`); the `ord_` unique key is not accepted here.

## Permission

Any member of the team.

## Business rules

- `comment` is required and must be a non-empty string.
- Only on published orders: drafts are refused ("No Permission - in mode: draft").

## Side effects

- Notifies the team members who follow the order's comments, in the app and by email. The customer is not told.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The sales order's or quote's `id` (a hash id). The `ord_` unique key and the order number do not work here. Example `V4keXwwxMQyXw7`.

## Request body

Content type `application/json`, required.

Fields:

- `comment` (string, required): The comment text. At least 1 character.

### Example request

```bash
curl -X POST 'https://secure.yoprint.com/v2/api/store/your-team/v2/sales_order/V4keXwwxMQyXw7/comment' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "comment": "Customer approved the proof by phone."
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required): A comment.
  - `comment` (string, required)
  - `id` (string, required)
  - `created_at` (string (date-time) | null, optional): Created. ISO 8601 with offset, or null.
  - `is_edited` (boolean, optional)
  - `order_id` (string | null, optional)
  - `trashed` (boolean, optional)
  - `type` (string, optional): `user_comment` for comments people write.
  - `updated_at` (string (date-time) | null, optional): Last changed. ISO 8601 with offset, or null.
  - `user_id` (string | null, optional): The author.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "comment": "Customer approved the proof by phone.",
    "id": "fFupqL9CYkMYgE",
    "is_edited": false,
    "order_id": "V4keXwwxMQyXw7",
    "trashed": false,
    "type": "user_comment",
    "user_id": "PydH0WtBhSeiNU"
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: `comment` is missing or empty (`validation_failed`, with `error.fields.comment`). Fix: Send the comment text.
  - When: The order is not published (`validation_error`, "No Permission - in mode: draft"). Fix: Publish the order first.

## Related

- [List the comments of an order](https://developer.yoprint.com/reference/sales-order-comments/v2-order-comment-index.md): `GET /v2/api/store/{team_slug}/v2/sales_order/{hash_id}/comment/index`
- [Send a message to the customer](https://developer.yoprint.com/reference/sales-order-messages/v2-order-message-store.md): `POST /v2/api/store/{team_slug}/v2/sales_order/{hash_id}/message`