## Update comment

`PATCH /v1/timelines/:id`

Changes the text of an existing timeline comment and its set of attachments. `entityType` and `entityId` are fixed at creation (a comment cannot be moved to another record), `authorId` cannot be set at all — Bitrix24 derives the author from the credentials the call is made with — and `id` and `createdAt` are read-only. A request carrying any of them returns `400 READONLY_FIELD` instead of silently ignoring the field.

## Parameters

| Parameter | Type | Required | Description |
|----------|-----|:-----:|---------|
| `id` (path) | number | yes | Comment ID. To get a list of IDs — [`GET /v1/timelines`](/docs/entities/timelines/list) |

## Request fields (body)

| Field | Type | Required | Description |
|------|-----|:-----:|---------|
| `comment` | string | yes | New comment text. An empty string is not accepted |
| `FILES` | array | no | New set of attachments — an array of `[fileName, base64Content]` pairs, same format as in [Add comment](/docs/entities/timelines/create). Replaces all previous attachments of the comment. Without the field the attachments stay unchanged; an empty array `[]` removes them all |

Full field list — [`GET /v1/timelines/fields`](/docs/entities/timelines/fields).

## Examples

### curl — personal key

```bash
curl -X PATCH "https://vibecode.bitrix24.com/v1/timelines/66303" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "comment": "Follow-up: the client is ready to sign the contract next week"
  }'
```

### curl — OAuth application

```bash
curl -X PATCH "https://vibecode.bitrix24.com/v1/timelines/66303" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "comment": "Follow-up: the client is ready to sign the contract next week"
  }'
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/timelines/66303', {
  method: 'PATCH',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    comment: 'Follow-up: the client is ready to sign the contract next week',
  }),
})

const { success, data } = await res.json()
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/timelines/66303', {
  method: 'PATCH',
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    comment: 'Follow-up: the client is ready to sign the contract next week',
  }),
})

const { success, data } = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|---------|
| `success` | boolean | Always `true` on success |
| `data` | object | Updated comment object — all fields, see [Comment fields](/docs/entities/timelines/fields) |

## Response example

```json
{
  "success": true,
  "data": {
    "id": 66303,
    "entityId": 741,
    "entityType": "deal",
    "comment": "Follow-up: the client is ready to sign the contract next week",
    "authorId": 1,
    "createdAt": "2026-04-24T12:34:05.000Z"
  }
}
```

## Error response example

404 — comment not found:

```json
{
  "success": false,
  "error": {
    "code": "ENTITY_NOT_FOUND",
    "message": "Item not found"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|---------|
| 400 | `READONLY_FIELD` | The body carries a field that cannot be changed: `entityType`, `entityId`, `authorId`, `id` or `createdAt` |
| 400 | `EMPTY_UPDATE_BODY` | The request body is empty |
| 400 | `INVALID_FILES_SHAPE` | The `FILES` field is not an array of `[[fileName, base64Content]]` pairs |
| 400 | `INVALID_PARAMS` | The `id` in the path is not a non-negative integer |
| 404 | `ENTITY_NOT_FOUND` | A comment with the specified ID does not exist |
| 422 | `BITRIX_ERROR` | The body has no `comment`, or it is an empty string. The message is `Empty comment message` |
| 403 | `SCOPE_DENIED` | The API key lacks the `crm` scope |
| 401 | `TOKEN_MISSING` | The API key has no configured tokens |

Full list of common API errors — [Errors](/docs/errors).

## See also

- [Get comment](/docs/entities/timelines/get)
- [Add comment](/docs/entities/timelines/create)
- [Delete comment](/docs/entities/timelines/delete)
- [Batch](/docs/batch)
- [Limits and optimization](/docs/optimization)