> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tiro.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# What notes a system key reads

> System API keys and webhooks read only notes in folders shared with all workspace members. See the read scope per key type and how missing notes appear.

System API keys and webhooks read **only the notes inside folders shared with all workspace members**. A note a member keeps in a private folder, a note in a folder shared with only some people, and a note that sits in no folder at all are all outside that read scope.

Tiro treats a note as its author's, and has been designed so that admins and systems do not read personal notes. The app already applies this rule, and API calls and webhooks made with system credentials are being brought in line with it.

## Which notes does each key type read?

| Key type                    | Notes it reads                                                                                                               |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **User key**                | The same notes that user sees in the app, including notes in their own private folders.                                      |
| **Workspace system key**    | Only notes in folders shared with all members of that workspace.                                                             |
| **Organization system key** | In each workspace that belongs to the organization, only notes in folders shared with all members of that workspace.         |
| **Webhook**                 | Note events (`note.*`, `note_summary.*`, `note_document.*`) are delivered only for notes in folders shared with all members. |

To tell the key types apart and to create one, see [Authentication](/en/developers/fundamentals/authentication).

## Which notes are left out?

A system key cannot read the notes below.

* Notes in a member's **private folder**
* Notes in a **folder shared with only some members**
* Notes that are **in no folder at all**

The third case is easy to miss. A note that was never filed into a folder has no share target yet, so it does not count as a note in a fully shared folder.

<Warning>
  **Widening a scope does not widen the read boundary.** A scope decides which APIs a key may call; the read scope on this page decides which notes those APIs return. A system key that holds `note:read` still cannot read notes outside fully shared folders. A key created by an admin behaves the same way.
</Warning>

## How do notes outside the read scope appear?

It depends on the API you call.

| Call                                                                      | Result                                                                              |
| ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| List, search                                                              | Notes outside the read scope are **dropped from the response.** No error is raised. |
| Fetch a single note                                                       | Returns `404`.                                                                      |
| A note's transcript, summary, documents, share link, or folder membership | Returns `404`.                                                                      |

<Note>
  Notes outside the read scope return `404`, not `403`. That keeps the response from revealing whether the note exists at all, so **it looks the same as a deleted note.** If a note that worked yesterday starts returning `404`, first check whether it moved out of a fully shared folder.
</Note>

List and search raise no error; the result set simply gets smaller. If your integration judges its own behavior by note count, it cannot tell a narrowed read scope from a workspace that genuinely has no notes.

A system key cannot list the folders in a workspace at all. `GET /v1/external/workspaces/{workspaceGuid}/folders` requires a user key and returns `401` for a system key.

## Which APIs are outside this read scope?

The items below do not read note content, so this read scope does not apply to them.

* **Folder events** (`folder.note.*`) webhooks
* **Voice File Job** APIs and events

## If you need notes in private folders

**Create and use a user key.** A user key reads the notes that user sees in the app, so it reaches their own private folders too. See [Authentication](/en/developers/fundamentals/authentication) for how to create one.

You can also move the notes your integration needs into a fully shared folder. Every workspace member then sees those notes, so check that the content is safe to share before you move it.

## What happens to keys you already created?

System keys created and webhooks registered before this read scope took effect keep their previous behavior for now, and are being moved over in stages. A key you create today can therefore return fewer notes than an older key, which is expected. Once the transition is complete, every system key and webhook follows the read scope on this page.

Check which keys and webhooks are due for the change on the API Keys and Webhooks screens in [Tiro Platform](https://platform.tiro.ooo).