Start here. This is the direct spoken answer to practice first.
Why this question matters
Comments are deceptively rich: they touch authorization, notifications, activity feeds, editing history, moderation, and performance.
I would model comments with id, parent resource, author, body, created time, edited time, deleted state, and optional parent comment for replies. The API would check that the user can view and comment on the target resource. Mentions would be parsed and validated server-side, then converted into notification jobs for mentioned users who have access to the resource. Lists would use cursor pagination so long discussions remain stable.