diff --git a/app/api/capa/[id]/route.ts b/app/api/capa/[id]/route.ts
index 21e6029..40ec8a8 100644
--- a/app/api/capa/[id]/route.ts
+++ b/app/api/capa/[id]/route.ts
@@ -18,6 +18,7 @@ export async function GET(
     .select(`
       id, incident_id, root_cause_ref, description, owner_user_id, department,
       due_date, priority, status, completed_at, verified_by, verified_at, created_at,
+      owner_notes,
       incidents (reference_no, incident_type),
       owner:users!owner_user_id (name, email)
     `)
@@ -65,7 +66,7 @@ export async function PATCH(
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
-  const allowed = ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref']
+  const allowed = ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref', 'owner_notes']
   const update: Record<string, unknown> = {}
   for (const key of allowed) {
     if (key in body) update[key] = body[key]