Create and list direct replies

Authorize the current Project Membership, resource visibility, and reply policy in the Project Backend before each call. The parent Comment, Project Credential, resource_type, and resource_id must all identify the same Project Client resource. MiniCenter deliberately returns 422 when that relationship is unavailable rather than revealing whether a foreign Comment exists.

Shell example

: "${MINICENTER_URL:?set the Sandbox URL}"
: "${MINICENTER_PROJECT_CREDENTIAL:?set a Project Credential}"
: "${MINICENTER_PARENT_COMMENT_ID:?set a top-level Comment ID}"

curl --fail-with-body -X POST "${MINICENTER_URL}/api/v1/community/comments/${MINICENTER_PARENT_COMMENT_ID}/replies" \
  -H "Authorization: Bearer ${MINICENTER_PROJECT_CREDENTIAL}" \
  -H 'Content-Type: application/json' \
  --data '{"platform_account_id":"30000000-0000-4000-8000-000000000003","resource_type":"article","resource_id":"article-42","body":"A direct reply.","idempotency_key":"article-42-reply-1"}'

A first creation returns 201; an identical Project Client-scoped idempotent replay returns 200. Reusing the key with a different author, resource, body, or parent returns 422. Only a top-level Comment can be the parent, so reply trees fail closed.

The first reply creation publishes the same community.comment.accepted Domain Event with kind=reply and the top-level parent_comment_id. Its payload omits Platform Account identity and reply body. It commits atomically with the reply, uses at-least-once signed webhook delivery, and is not republished by an identical create replay.

Shell example

curl --get --fail-with-body "${MINICENTER_URL}/api/v1/community/comments/${MINICENTER_PARENT_COMMENT_ID}/replies" \
  -H "Authorization: Bearer ${MINICENTER_PROJECT_CREDENTIAL}" \
  --data-urlencode 'resource_type=article' \
  --data-urlencode 'resource_id=article-42' \
  --data-urlencode 'limit=50'

Replies use comments:write and comments:read, the same 4,000-character untrusted-text rule, oldest-first ordering, and next_after cursor contract as top-level Comments. HTML-escape body when rendering. Keep the parent resource usable if MiniCenter is unavailable, and retry an uncertain creation only with its original idempotency key.