## Read user comments

`GET /v1/posts/comments`

Returns an employee's comments on all Feed posts, from newest to oldest.

The method has no post filter: the post of each comment is given in the `postId` field.

## Parameters

| Parameter | Type | Required | Default | Description |
|----------|-----|:-----:|-----------|----------|
| `userId` (query) | number | no | the key's user | ID of the employee whose comments you need. List: [GET /v1/users](/docs/entities/users/list). Applies only if the key's user is a Bitrix24 account administrator. If the key belongs to an employee without administrator rights, the parameter has no effect: that employee's own comments are returned, with no error |
| `lastId` (query) | number | no | — | Comment ID in the feed — the `data.comments[].id` field. Returns the nearest comments older than it. `0` — start from the newest comment |
| `firstId` (query) | number | no | — | Comment ID in the feed — the `data.comments[].id` field. Returns the nearest comments newer than it. `0` — start from the oldest comment. If both `firstId` and `lastId` are passed, only `firstId` applies |
| `limit` (query) | number | no | `100` | How many comments to return, a positive integer. A value greater than 1000 is replaced with 1000 |

Other query parameters are rejected with `400 INVALID_PARAMS`.

Pagination: to move toward older comments, request the next page with `lastId` equal to the smallest `id` on the current page; to move toward newer ones, use `firstId` equal to the largest. Within a page, comments are always sorted from newest to oldest, even with `firstId`: the largest `id` comes first. An empty `data.comments` array means there are no more comments in that direction.

## Examples

### curl — personal key

```bash
curl "https://vibecode.bitrix24.com/v1/posts/comments?limit=2" \
  -H "X-Api-Key: YOUR_API_KEY"
```

### curl — OAuth application

```bash
curl "https://vibecode.bitrix24.com/v1/posts/comments?limit=2" \
  -H "X-Api-Key: YOUR_APP_KEY" \
  -H "Authorization: Bearer USER_SESSION_TOKEN"
```

### JavaScript — personal key

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/posts/comments?limit=2', {
  headers: { 'X-Api-Key': 'YOUR_API_KEY' },
})
const result = await res.json()
```

### JavaScript — OAuth application

```javascript
const res = await fetch('https://vibecode.bitrix24.com/v1/posts/comments?limit=2', {
  headers: {
    'X-Api-Key': 'YOUR_APP_KEY',
    'Authorization': 'Bearer USER_SESSION_TOKEN',
  },
})
const result = await res.json()
```

## Response fields

| Field | Type | Description |
|------|-----|----------|
| `success` | boolean | `true` on a successful response |
| `data.comments` | array | The employee's comments, from newest to oldest. An empty array means there are no comments |
| `data.comments[].id` | number | Comment ID in the feed. Accepted by the `firstId` and `lastId` cursors and by [DELETE /v1/feed-comments/:id](/docs/feed-comments/delete) |
| `data.comments[].commentId` | number | Post comment ID. Used together with `postId` in [DELETE /v1/posts/:id/comments/:commentId](/docs/feed/comments/delete) |
| `data.comments[].postId` | number | ID of the post the comment was left on. List of posts: [GET /v1/posts](/docs/feed/posts/list) |
| `data.comments[].date` | string | Date and time of the comment in ISO 8601 format with a time zone offset |
| `data.comments[].text` | string | Comment text. When an administrator requests another employee's comments via `userId`, an empty string is returned. The exception is system comments that Bitrix24 creates on its own, for example about a task created from a comment |
| `data.comments[].attach` | array | IDs of the files attached to the comment, as numbers. These are the keys of `data.files` and link a file to its comment. If there are no files, an empty array `[]` is returned |
| `data.files` | object or array | Files attached to the comments. Each key is a Drive file ID. If there are no files, an empty array `[]` is returned |
| `data.files.<id>.id` | number | Drive file ID |
| `data.files.<id>.name` | string | File name |
| `data.files.<id>.type` | string | File kind: `image` — an image, `video` — a video, `file` — any other file |
| `data.files.<id>.size` | number | File size in bytes |
| `data.files.<id>.date` | string | Date and time the file was uploaded, in ISO 8601 format |
| `data.files.<id>.authorId` | number | ID of the employee who uploaded the file. List: [GET /v1/users](/docs/entities/users/list) |
| `data.files.<id>.authorName` | string | Name of the employee who uploaded the file |
| `data.files.<id>.image` | object or `false` | Dimensions in pixels — the `width` and `height` fields. For a video — the dimensions of the preview frame, or `0` if there is no preview. For files of the `file` kind — `false` |
| `data.files.<id>.urlPreview` | string or `null` | Preview URL on the Bitrix24 account. `null` — there is no preview |
| `data.files.<id>.urlShow` | string | URL for viewing the file on the Bitrix24 account. For files other than images, it matches `urlDownload` |
| `data.files.<id>.urlDownload` | string | URL for downloading the file from the Bitrix24 account |

File URLs point to the Bitrix24 account, not to the Vibecode API. A response string that contains Bitrix24 authorization data — for example, an `auth` or `token` parameter in a URL — is replaced entirely with `[REDACTED]`: this happens both to a file URL and to comment text that contains such a link. This value is not a URL and cannot be opened.

## Response example

```json
{
  "success": true,
  "data": {
    "comments": [
      {
        "id": 6217,
        "commentId": 75,
        "postId": 327,
        "date": "2026-10-23T02:18:37+00:00",
        "text": "Moved the call with the contractor to Friday.",
        "attach": []
      },
      {
        "id": 6215,
        "commentId": 73,
        "postId": 327,
        "date": "2026-10-23T02:18:37+00:00",
        "text": "Added the quarterly results to the agenda.",
        "attach": []
      }
    ],
    "files": []
  }
}
```

## Error response example

400 — `limit` is not a positive integer:

```json
{
  "success": false,
  "error": {
    "code": "INVALID_PARAMS",
    "message": "limit must be a positive integer (cursor also accepts zero)"
  }
}
```

## Errors

| HTTP | Code | Description |
|------|-----|----------|
| 400 | `INVALID_PARAMS` | `userId`, `firstId`, `lastId` or `limit` is not a positive integer. `firstId` and `lastId` also accept `0` |
| 400 | `INVALID_PARAMS` | The request contains a parameter the method does not accept |
| 403 | `BITRIX_ACCESS_DENIED` | Bitrix24 denied access |
| 422 | `BITRIX_ERROR` | Bitrix24 rejected the request. The error text is in `error.message` |
| 502 | `BITRIX_ERROR` | The Bitrix24 response does not have the expected shape: `Invalid comment response` |
| 401 | `MISSING_API_KEY` | The `X-Api-Key` header is missing |
| 401 | `INVALID_API_KEY` | The key is not found or has been revoked |
| 401 | `TOKEN_MISSING` | The key has no portal tokens. An OAuth application key requires the `Authorization: Bearer` header |
| 403 | `SCOPE_DENIED` | The key does not have the `log` scope |
| 429 | `RATE_LIMITED` | The Bitrix24 request rate limit was exceeded. Retry after the delay in the `Retry-After` header |
| 502 | `BITRIX_UNAVAILABLE` | Bitrix24 is unavailable |
| 503 | `BITRIX_TIMEOUT` | Bitrix24 accepted the request but did not respond in time |

Full list of common API errors — [Errors](/docs/errors).

## See also

- [User comments](/docs/posts/comments)
- [Delete a feed comment](/docs/feed-comments/delete)
- [Delete a comment](/docs/feed/comments/delete)
- [List posts](/docs/feed/posts/list)
- [Feed](/docs/feed)
- [Errors](/docs/errors)