agent_id must match the agent the note is attributed to, otherwise the request is rejected with a 403. A note that has been deleted can no longer be edited.
agent_id identifies who the edit is attributed to — it is not a credential. An API key is scoped to the organization, not to one agent, so treat this rule as a safeguard against editing the wrong agent’s note rather than as a permission boundary between your own agents.comment_uuid belonging to a different session returns a 404 rather than editing the wrong conversation.
Attachments
attachments is a full replacement of the note’s file list, not a patch:
So editing only the wording is safe — omit the field and the files stay put. To drop a single file, send the list of the ones you want to keep.