> For the complete documentation index, see [llms.txt](https://docs.monolithforensics.com/monolith/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.monolithforensics.com/monolith/monolith-api/notes-api/note-data-examples.md).

# Note Data Examples

Ready-to-use examples of properly formatted HTML for the `note_data` field, covering every formatting feature the Notes API supports. Each snippet below has been verified to round-trip through the API's normalizer with no content loss — you can copy any of them directly into a [create](/monolith/monolith-api/notes-api/create-note.md), [update](/monolith/monolith-api/notes-api/update-note.md), or [append](/monolith/monolith-api/notes-api/append-note.md) request.

Two things to keep in mind while reading (full details in [Constructing `note_data` safely](/monolith/monolith-api/notes-api.md#constructing-note_data-safely)):

* The stored HTML will not be byte-identical to what you send. The normalizer adds editor classes and scaffolding (e.g. `class="editor-code-block"`, table `<colgroup>`/`<tbody>`, task-list checkbox markup) and canonicalizes equivalent tags (`<b>` → `<strong>`). Your content and structure are preserved.
* Whitespace between tags is insignificant. The indentation in these examples is for readability; it collapses on storage. Line breaks *inside* `<pre><code>` blocks are preserved exactly.

## Basic document structure

Headings, paragraphs, and horizontal rules:

```html
<h1>Device Intake Report</h1>
<p>Device received from <strong>Det. Rivera</strong> on <em>August 3, 2026</em>.</p>
<h2>Condition</h2>
<p>Screen cracked, powers on normally. No SIM card present.</p>
<hr>
<p>Photographed and bagged as <code>EV-2026-0042-001</code>.</p>
```

Heading levels `<h1>` through `<h6>` are supported. Bare text outside any tag is accepted too — it gets wrapped in a paragraph automatically.

## Inline formatting

```html
<p><strong>Bold</strong>, <em>italic</em>, <u>underlined</u>, <s>struck through</s>, and <code>inline code</code>.</p>
<p>Combined: <strong><em>bold italic</em></strong> and <u><strong>underlined bold</strong></u>.</p>
```

`<b>`, `<i>`, `<del>`, and `<strike>` are accepted as input and stored canonically as `<strong>`, `<em>`, and `<s>`.

## Text color and highlighting

```html
<p>Status: <span style="color: #16a34a">verified</span> / <span style="color: #dc2626">failed</span></p>
<p>Key finding: <mark data-color="#fef08a">timestamp places the device at the scene</mark>.</p>
<p><mark data-color="#bfdbfe">Follow up with carrier records.</mark></p>
```

Text color must be a `color` style **on a `<span>`** — a `color` style on a paragraph or heading is stripped. Highlights take any color via `data-color` on `<mark>`.

## Text alignment

```html
<h2 style="text-align: center">Examination Summary</h2>
<p style="text-align: center">Case 2026-0042</p>
<p style="text-align: right">Prepared by A. Rivera</p>
<p style="text-align: justify">This paragraph is justified. Longer narrative text can be
aligned for presentation when the note is exported to PDF or DOCX.</p>
```

`text-align` (`left`, `center`, `right`, `justify`) works on paragraphs and headings only.

## Links

```html
<p>Tool documentation: <a href="https://www.sleuthkit.org/autopsy/docs.php">Autopsy User Guide</a></p>
<p>Contact the lab: <a href="mailto:lab@example.com">lab@example.com</a> or <a href="tel:+15555550100">+1 555 555 0100</a></p>
```

`http`, `https`, `mailto`, `tel`, `ftp`, and relative URLs all work. Unsafe schemes (`javascript:`, `data:`) are removed, leaving the anchor text as plain text. `target`, `rel`, and `class` on links are always overwritten with the editor's values, so there is no point setting them.

## Bullet and numbered lists

```html
<h3>Processing Steps</h3>
<ol>
  <li>Photograph device</li>
  <li>Enable airplane mode</li>
  <li>Create forensic image
    <ul>
      <li>Verify write blocker</li>
      <li>Record hashes</li>
    </ul>
  </li>
  <li>Store original in evidence locker</li>
</ol>
<h3>Observed Artifacts</h3>
<ul>
  <li>Browser history (Chrome)</li>
  <li>Deleted SMS fragments</li>
  <li>Location cache</li>
</ul>
```

Lists nest by placing a `<ul>`/`<ol>` *inside* an `<li>`, as shown.

## Task lists (checkboxes)

```html
<h3>Examination Checklist</h3>
<ul data-type="taskList">
  <li data-type="taskItem" data-checked="true">Chain of custody form signed</li>
  <li data-type="taskItem" data-checked="true">Device photographed</li>
  <li data-type="taskItem" data-checked="false">Logical extraction completed</li>
  <li data-type="taskItem" data-checked="false">Report drafted
    <ul data-type="taskList">
      <li data-type="taskItem" data-checked="false">Peer review</li>
    </ul>
  </li>
</ul>
```

The `data-type` attributes are required — a plain `<ul>` becomes a bullet list instead. On storage each item is expanded with the editor's checkbox markup (`<label><input type="checkbox">...`); when you update a task list programmatically, only the `data-checked` values matter.

## Code blocks

```html
<p>Verification output:</p>
<pre><code class="language-plaintext">ewfverify E01/device.E01
MD5 hash calculated over data:  9e107d9d372bb6826bd81d3542a419d6
MD5 hash stored in file:        9e107d9d372bb6826bd81d3542a419d6
ewfverify: SUCCESS</code></pre>

<p>Parsing script used:</p>
<pre data-wrap="true"><code class="language-python">import sqlite3

conn = sqlite3.connect("sms.db")
for row in conn.execute("SELECT date, address, body FROM message"):
    print(row)</code></pre>
```

* The `language-*` class on `<code>` selects syntax highlighting (defaults to `plaintext`).
* `data-wrap="true"` on the `<pre>` enables soft line wrapping in the editor.
* Whitespace and newlines inside the block are preserved exactly — this is the right place for tool output, logs, and hashes.
* HTML-escape the code content (`&lt;`, `&gt;`, `&amp;`) if it can contain angle brackets.

## Blockquotes

```html
<p>Statement from the custodian:</p>
<blockquote>
  <p>The laptop was in the office safe from Friday evening until Monday morning.
  Nobody else has the combination.</p>
</blockquote>
<p>This conflicts with badge records showing weekend access.</p>
```

## Tables

```html
<h3>Evidence Summary</h3>
<table>
  <tr>
    <th>Item</th>
    <th>Description</th>
    <th>SHA-256 (first 8)</th>
  </tr>
  <tr>
    <td>EV-001</td>
    <td>iPhone 15 Pro, 256 GB</td>
    <td><code>9f86d081</code></td>
  </tr>
  <tr>
    <td>EV-002</td>
    <td>SanDisk USB drive, 64 GB</td>
    <td><code>60303ae2</code></td>
  </tr>
  <tr>
    <td colspan="3">All hashes verified against acquisition logs on 2026-08-03.</td>
  </tr>
</table>
```

`colspan` and `rowspan` are supported. Cell content is wrapped in paragraphs on storage, and the table gains `<colgroup>`/`<tbody>` scaffolding — both harmless. Any block element (lists, code blocks) can go inside a cell.

## Images

```html
<p>Scene photo (uploaded via the images endpoint):</p>
<img class="monolith-image" data-uuid="mhvXdrZT4jP5T8vBxuvm75" alt="mhvXdrZT4jP5T8vBxuvm75.png" src="">

<p>External image with explicit sizing:</p>
<img src="https://example.com/diagrams/network-topology.png" alt="Network topology" title="Lab network" width="480">
```

* The first form is the `markup` string returned by [`POST /v1/notes/{uuid}/images`](broken://pages/62b69fd71d3804a00420e4d0949108a4ca817a22) — embed it verbatim; the empty `src` is filled with a fresh signed URL on every read, matched by `data-uuid`.
* Size with the `width`/`height` **attributes**; style-based sizing is stripped.
* Base64 `data:` URIs are accepted but stored inline in the note body — prefer the upload endpoint for anything non-trivial.

## Putting it all together

A complete examination note combining most features:

```html
<h1 style="text-align: center">Forensic Examination Notes</h1>
<p style="text-align: center"><strong>Case 2026-0042</strong> — EV-001</p>
<hr>
<h2>Summary</h2>
<p>Logical extraction of <strong>EV-001</strong> completed.
<span style="color: #16a34a"><strong>All hashes verified.</strong></span></p>
<h2>Timeline</h2>
<table>
  <tr><th>Time (UTC)</th><th>Action</th></tr>
  <tr><td>13:05</td><td>Imaging started</td></tr>
  <tr><td>14:32</td><td>Imaging completed, hashes verified</td></tr>
</table>
<h2>Next Steps</h2>
<ul data-type="taskList">
  <li data-type="taskItem" data-checked="false">Parse extraction with <a href="https://example.com/tools">internal toolkit</a></li>
  <li data-type="taskItem" data-checked="false">Draft findings section</li>
</ul>
<blockquote><p>Reminder: <mark data-color="#fef08a">carrier records due Friday</mark>.</p></blockquote>
```

### Posting it with Python

```python
from pathlib import Path

note_data = Path("exam-note.html").read_text()

response = session.post(f"{BASE_URL}/notes", json={
    "case_uuid": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
    "note_tag": "EV-001 Examination Notes",
    "note_data": note_data,
})
response.raise_for_status()
note = response.json()["data"]

# The response echoes the note as it was actually stored - inspect it to see
# the normalized form of your HTML
print(note["note_data"])
```

### Building HTML safely from data

When generating `note_data` from variables, escape anything that isn't markup:

```python
import html

def hash_report(filename, md5, sha256):
    return (
        f"<h3>Hash Report — {html.escape(filename)}</h3>"
        f"<table>"
        f"<tr><th>Algorithm</th><th>Value</th></tr>"
        f"<tr><td>MD5</td><td><code>{html.escape(md5)}</code></td></tr>"
        f"<tr><td>SHA-256</td><td><code>{html.escape(sha256)}</code></td></tr>"
        f"</table>"
    )

session.patch(f"{BASE_URL}/notes/{note_uuid}/append", json={
    "note_data": hash_report("device.E01", "9e107d9d...", "9f86d081..."),
}).raise_for_status()
```