diff --git a/notes.php b/notes.php
new file mode 100644
index 0000000..3f19b60
--- /dev/null
+++ b/notes.php
@@ -0,0 +1,84 @@
+<?php
+/**
+ * Blair HQ Notes API — stores notes in a JSON file server-side
+ * Protected by nginx Basic Auth at the site level
+ */
+header('Content-Type: application/json');
+header('Cache-Control: no-store');
+
+$file = __DIR__ . '/../notes.json';
+
+function load(): array {
+    global $file;
+    if (!file_exists($file)) return [];
+    $data = json_decode(file_get_contents($file), true);
+    return is_array($data) ? $data : [];
+}
+
+function save(array $notes): void {
+    global $file;
+    file_put_contents($file, json_encode($notes, JSON_PRETTY_PRINT), LOCK_EX);
+}
+
+$method = $_SERVER['REQUEST_METHOD'];
+$body   = json_decode(file_get_contents('php://input'), true) ?? [];
+$action = $body['action'] ?? $_GET['action'] ?? 'list';
+
+switch ($action) {
+
+    case 'list':
+        echo json_encode(['ok' => true, 'notes' => load()]);
+        break;
+
+    case 'add':
+        $text   = trim($body['text']   ?? '');
+        $detail = trim($body['detail'] ?? '');
+        if (!$text) { http_response_code(400); echo json_encode(['ok'=>false,'error'=>'text required']); break; }
+        $notes = load();
+        $note  = ['id' => uniqid('n',true), 'text' => $text, 'detail' => $detail,
+                  'done' => false, 'ts' => time() * 1000];
+        array_unshift($notes, $note);
+        save($notes);
+        echo json_encode(['ok' => true, 'note' => $note]);
+        break;
+
+    case 'toggle':
+        $id    = $body['id'] ?? '';
+        $notes = load();
+        foreach ($notes as &$n) {
+            if ($n['id'] === $id) { $n['done'] = !$n['done']; break; }
+        }
+        save($notes);
+        echo json_encode(['ok' => true]);
+        break;
+
+    case 'delete':
+        $id    = $body['id'] ?? '';
+        $notes = array_values(array_filter(load(), fn($n) => $n['id'] !== $id));
+        save($notes);
+        echo json_encode(['ok' => true]);
+        break;
+
+    case 'clear-done':
+        $notes = array_values(array_filter(load(), fn($n) => !$n['done']));
+        save($notes);
+        echo json_encode(['ok' => true]);
+        break;
+
+    case 'edit':
+        $id     = $body['id']     ?? '';
+        $text   = trim($body['text']   ?? '');
+        $detail = trim($body['detail'] ?? '');
+        if (!$text) { http_response_code(400); echo json_encode(['ok'=>false,'error'=>'text required']); break; }
+        $notes  = load();
+        foreach ($notes as &$n) {
+            if ($n['id'] === $id) { $n['text'] = $text; $n['detail'] = $detail; break; }
+        }
+        save($notes);
+        echo json_encode(['ok' => true]);
+        break;
+
+    default:
+        http_response_code(404);
+        echo json_encode(['ok' => false, 'error' => 'unknown action']);
+}