# mutateSourceReviewThread

Immutable provider-confirmed commits or explicitly uploaded source. Every metadata/tree/retained-file/export read rechecks current workspace, credential and original source access. Selected capture is

Canonical: https://commentary.dev/docs/reference/api/mutate-source-review-thread

`POST /api/v1/source-snapshots/{snapshotId}/threads`

Immutable provider-confirmed commits or explicitly uploaded source. Every metadata/tree/retained-file/export read rechecks current workspace, credential and original source access. Selected capture is selected-only, broad capture is bounded and explicit incomplete states never substitute another commit. Expected-version cancellation/retry/purge and idempotent publication commit durable Activity; binary payloads are digest checked and exports page within quotas. Source explorer UI and consolidated MCP parity follow in CP-019/033.

## Access

Use a credential with `commentary.comments.write`, `commentary.source_snapshots.read`.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Parameters

| Name | Location | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `snapshotId` | path | string | Yes |  |
| `Idempotency-Key` | header | string | Yes |  |

## Request body

Required. Supported content types: `application/json`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `"create"` · `"reply"` · `"edit"` · `"delete"` · `"status"` · `"reattach"` | Yes |  |
| `threadId` | string | No | Minimum length: 1. Maximum length: 512. |
| `commentId` | string | No | Minimum length: 1. Maximum length: 512. |
| `path` | string | No | Minimum length: 1. Maximum length: 1024. |
| `lineStart` | integer | No |  |
| `lineEnd` | integer | No |  |
| `blobHash` | string | No | Maximum length: 128. |
| `sha256` | string | No |  |
| `bodyMarkdown` | string | No | Maximum length: 8192. |
| `status` | `"open"` · `"resolved"` | No |  |
| `expectedVersion` | integer | No |  |
| `requestDecision` | boolean | No |  |
| `poll` | object | No |  |

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request POST \
  'https://commentary.dev/api/v1/source-snapshots/<snapshotId>/threads' \
  --header 'Authorization: Bearer <your-token>' \
  --header 'Content-Type: application/json' \
  --data-binary @request.json
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `200` | Authorized domain result with the exact applicable ETag. | [ProjectAgentmutateSourceReviewThreadOutput](/docs/reference/schemas/project-agentmutate-source-review-thread-output) |
| `400` | Bounded v1 machine-readable failure. | object |
| `401` | Bounded v1 machine-readable failure. | object |
| `403` | Bounded v1 machine-readable failure. | object |
| `404` | Bounded v1 machine-readable failure. | object |
| `409` | Bounded v1 machine-readable failure. | object |
| `412` | Bounded v1 machine-readable failure. | object |
| `413` | Bounded v1 machine-readable failure. | object |
| `422` | Bounded v1 machine-readable failure. | object |
| `428` | Bounded v1 machine-readable failure. | object |
| `429` | Bounded v1 machine-readable failure. | object |
| `500` | Bounded v1 machine-readable failure. | object |
| `503` | Bounded v1 machine-readable failure. | object |

### Successful response fields

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `data` | object | Yes |  |
| `idempotencyReplayed` | boolean | No |  |

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `mutateSourceReviewThread`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).