Note Data Examples

Ready-to-use examples of properly formatted HTML for the note_data field, covering every formatting feature the Notes API supports. Each snippet below has been verified to round-trip through the API's normalizer with no content loss — you can copy any of them directly into a create, update, or append request.

Two things to keep in mind while reading (full details in Constructing note_data safely):

• The stored HTML will not be byte-identical to what you send. The normalizer adds editor classes and scaffolding (e.g. class="editor-code-block", table <colgroup>/<tbody>, task-list checkbox markup) and canonicalizes equivalent tags (<b> → <strong>). Your content and structure are preserved.

• Whitespace between tags is insignificant. The indentation in these examples is for readability; it collapses on storage. Line breaks inside <pre><code> blocks are preserved exactly.

Basic document structure

Headings, paragraphs, and horizontal rules:

<h1>Device Intake Report</h1>
<p>Device received from <strong>Det. Rivera</strong> on <em>August 3, 2026</em>.</p>
<h2>Condition</h2>
<p>Screen cracked, powers on normally. No SIM card present.</p>
<hr>
<p>Photographed and bagged as <code>EV-2026-0042-001</code>.</p>

Heading levels <h1> through <h6> are supported. Bare text outside any tag is accepted too — it gets wrapped in a paragraph automatically.

Inline formatting

<p><strong>Bold</strong>, <em>italic</em>, <u>underlined</u>, <s>struck through</s>, and <code>inline code</code>.</p>
<p>Combined: <strong><em>bold italic</em></strong> and <u><strong>underlined bold</strong></u>.</p>

<b>, <i>, <del>, and <strike> are accepted as input and stored canonically as <strong>, <em>, and <s>.

Text color and highlighting

<p>Status: <span style="color: #16a34a">verified</span> / <span style="color: #dc2626">failed</span></p>
<p>Key finding: <mark data-color="#fef08a">timestamp places the device at the scene</mark>.</p>
<p><mark data-color="#bfdbfe">Follow up with carrier records.</mark></p>

Text color must be a color style on a <span> — a color style on a paragraph or heading is stripped. Highlights take any color via data-color on <mark>.

Text alignment

<h2 style="text-align: center">Examination Summary</h2>
<p style="text-align: center">Case 2026-0042</p>
<p style="text-align: right">Prepared by A. Rivera</p>
<p style="text-align: justify">This paragraph is justified. Longer narrative text can be
aligned for presentation when the note is exported to PDF or DOCX.</p>

text-align (left, center, right, justify) works on paragraphs and headings only.

Links

<p>Tool documentation: <a href="https://www.sleuthkit.org/autopsy/docs.php">Autopsy User Guide</a></p>
<p>Contact the lab: <a href="mailto:[e-mail]">[e-mail]</a> or <a href="tel:[phone]">[phone]</a></p>

http, https, mailto, tel, ftp, and relative URLs all work. Unsafe schemes (javascript:, data:) are removed, leaving the anchor text as plain text. target, rel, and class on links are always overwritten with the editor's values, so there is no point setting them.

Bullet and numbered lists

<h3>Processing Steps</h3>
<ol>
  <li>Photograph device</li>
  <li>Enable airplane mode</li>
  <li>Create forensic image
    <ul>
      <li>Verify write blocker</li>
      <li>Record hashes</li>
    </ul>
  </li>
  <li>Store original in evidence locker</li>
</ol>
<h3>Observed Artifacts</h3>
<ul>
  <li>Browser history (Chrome)</li>
  <li>Deleted SMS fragments</li>
  <li>Location cache</li>
</ul>

Lists nest by placing a <ul>/<ol> inside an <li>, as shown.

Task lists (checkboxes)

<h3>Examination Checklist</h3>
<ul data-type="taskList">
  <li data-type="taskItem" data-checked="true">Chain of custody form signed</li>
  <li data-type="taskItem" data-checked="true">Device photographed</li>
  <li data-type="taskItem" data-checked="false">Logical extraction completed</li>
  <li data-type="taskItem" data-checked="false">Report drafted
    <ul data-type="taskList">
      <li data-type="taskItem" data-checked="false">Peer review</li>
    </ul>
  </li>
</ul>

The data-type attributes are required — a plain <ul> becomes a bullet list instead. On storage each item is expanded with the editor's checkbox markup (<label><input type="checkbox">...); when you update a task list programmatically, only the data-checked values matter.

Code blocks

<p>Verification output:</p>
<pre><code class="language-plaintext">ewfverify E01/device.E01
MD5 hash calculated over data:  9e107d9d372bb6826bd81d3542a419d6
MD5 hash stored in file:        9e107d9d372bb6826bd81d3542a419d6
ewfverify: SUCCESS</code></pre>

<p>Parsing script used:</p>
<pre data-wrap="true"><code class="language-python">import sqlite3

conn = sqlite3.connect("sms.db")
for row in conn.execute("SELECT date, address, body FROM message"):
    print(row)</code></pre>

• The language-* class on <code> selects syntax highlighting (defaults to plaintext).

• data-wrap="true" on the <pre> enables soft line wrapping in the editor.

• Whitespace and newlines inside the block are preserved exactly — this is the right place for tool output, logs, and hashes.

• HTML-escape the code content (<, >, &) if it can contain angle brackets.

Blockquotes

<p>Statement from the custodian:</p>
<blockquote>
  <p>The laptop was in the office safe from Friday evening until Monday morning.
  Nobody else has the combination.</p>
</blockquote>
<p>This conflicts with badge records showing weekend access.</p>

Tables

<h3>Evidence Summary</h3>
<table>
  <tr>
    <th>Item</th>
    <th>Description</th>
    <th>SHA-256 (first 8)</th>
  </tr>
  <tr>
    <td>EV-001</td>
    <td>iPhone 15 Pro, 256 GB</td>
    <td><code>9f86d081</code></td>
  </tr>
  <tr>
    <td>EV-002</td>
    <td>SanDisk USB drive, 64 GB</td>
    <td><code>60303ae2</code></td>
  </tr>
  <tr>
    <td colspan="3">All hashes verified against acquisition logs on 2026-08-03.</td>
  </tr>
</table>

colspan and rowspan are supported. Cell content is wrapped in paragraphs on storage, and the table gains <colgroup>/<tbody> scaffolding — both harmless. Any block element (lists, code blocks) can go inside a cell.

Images

<p>Scene photo (uploaded via the images endpoint):</p>
<img class="monolith-image" data-uuid="mhvXdrZT4jP5T8vBxuvm75" alt="mhvXdrZT4jP5T8vBxuvm75.png" src="">

<p>External image with explicit sizing:</p>
<img src="https://example.com/diagrams/network-topology.png" alt="Network topology" title="Lab network" width="480">

• The first form is the markup string returned by POST /v1/notes/{uuid}/images — embed it verbatim; the empty src is filled with a fresh signed URL on every read, matched by data-uuid.

• Size with the width/height attributes; style-based sizing is stripped.

• Base64 data: URIs are accepted but stored inline in the note body — prefer the upload endpoint for anything non-trivial.

Putting it all together

A complete examination note combining most features:

<h1 style="text-align: center">Forensic Examination Notes</h1>
<p style="text-align: center"><strong>Case 2026-0042</strong> — EV-001</p>
<hr>
<h2>Summary</h2>
<p>Logical extraction of <strong>EV-001</strong> completed.
<span style="color: #16a34a"><strong>All hashes verified.</strong></span></p>
<h2>Timeline</h2>
<table>
  <tr><th>Time (UTC)</th><th>Action</th></tr>
  <tr><td>13:05</td><td>Imaging started</td></tr>
  <tr><td>14:32</td><td>Imaging completed, hashes verified</td></tr>
</table>
<h2>Next Steps</h2>
<ul data-type="taskList">
  <li data-type="taskItem" data-checked="false">Parse extraction with <a href="https://example.com/tools">internal toolkit</a></li>
  <li data-type="taskItem" data-checked="false">Draft findings section</li>
</ul>
<blockquote><p>Reminder: <mark data-color="#fef08a">carrier records due Friday</mark>.</p></blockquote>

Posting it with Python

from pathlib import Path

note_data = Path("exam-note.html").read_text()

response = session.post(f"{BASE_URL}/notes", json={
    "case_uuid": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
    "note_tag": "EV-001 Examination Notes",
    "note_data": note_data,
})
response.raise_for_status()
note = response.json()["data"]

# The response echoes the note as it was actually stored - inspect it to see
# the normalized form of your HTML
print(note["note_data"])

Building HTML safely from data

When generating note_data from variables, escape anything that isn't markup:

import html

def hash_report(filename, md5, sha256):
    return (
        f"<h3>Hash Report — {html.escape(filename)}</h3>"
        f"<table>"
        f"<tr><th>Algorithm</th><th>Value</th></tr>"
        f"<tr><td>MD5</td><td><code>{html.escape(md5)}</code></td></tr>"
        f"<tr><td>SHA-256</td><td><code>{html.escape(sha256)}</code></td></tr>"
        f"</table>"
    )

session.patch(f"{BASE_URL}/notes/{note_uuid}/append", json={
    "note_data": hash_report("device.E01", "9e107d9d...", "9f86d081..."),
}).raise_for_status()