wp-comments-notes-api

WordPress Comments and Notes API

WordPress editor Notes use the comments table with comment_type = note, but they are private editorial data, not public comments. Always make the type explicit in queries, capabilities, REST requests, counts, notifications, and deletion logic.

Separate public comments from Notes

Concern	Public comment	Editor Note
comment_type	usually comment/empty legacy value	note
Anonymous creation	site/filter dependent	never
Creation permission	normal comment policy	edit_post for the target post
Read permission	approved comment + readable post, or elevated access	note author or user who can edit_comment
Comment counts	included	excluded by Core
Discussion open/closed	enforced	not used as the Notes gate

Do not query type => all and expose the result publicly. Use type => comment for public output and type => note, status => all only inside an authorized editorial context.

Enable Notes for a custom post type

Core's REST controller accepts Notes only when the post type's editor support has Notes enabled:

register_post_type(
    'acme_record',
    array(
        'show_in_rest' => true,
        'supports'     => array(
            'title',
            'editor' => array( 'notes' => true ),
        ),
    )
);

This nested support shape is not the same as adding a separate notes feature. Test editor UI and REST creation for the actual custom post type.

REST integration

Notes use /wp/v2/comments with type: note. Core restricts REST creation to the Core types comment and note; custom comment types need their own route/controller rather than assuming this endpoint accepts them.

For Notes, Core requires:

• an authenticated user;
• a valid target post whose type supports Notes;
• edit_post for that post;
• a readable, non-trashed post.

Core's _wp_note_status comment meta is REST-exposed with only resolved or reopen, and editing it requires edit_comment. An empty Note body is accepted only for a valid resolution/reopen status transition. Do not bypass these rules with direct metadata writes from a weaker route.