# Add an option to a choice question of a draft

Append an answer option to a `single_select` or `multi_select` question of a draft.

`POST /supplier-assessment-templates/{templateId}/questions/{questionId}/options`

Scope `supplier_template:write` | Plan **Growth+**

Append an answer option to a `single_select` or `multi_select` question of a draft. `label` (`en` required), `riskValue` (0, no risk, to 4) and the draft's `revision` are required; `findingSeverity` (`info`, `low`, `medium`, `high`, `critical`, or empty), `finding` and `notApplicable` are optional. `optionId` is assigned by the server. Other answer types take no options (409 OPTIONS_NOT_ALLOWED), a question holds 12 options (409 OPTION_LIMIT_REACHED), and the document may not exceed 1 MiB (409 TEMPLATE_SIZE_LIMIT_REACHED). Structural write: 30 per token and hour. Requires the supplier_template:write scope (or a signed-in Owner, Manager or Contributor session).

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `templateId` | string | yes | Questionnaire document id (`satpl_...`), or `satpl_builtin_supplier_security_privacy_v1` for the built-in one. |
| `questionId` | string | yes | Question id, as returned in `sections[].questions[].questionId`. |

## Header parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `If-Match` | string | no | The draft revision as `W/"<revision>"`, from the ETag header. Wins over a `revision` in the body. A write on an older revision fails with 409 STALE_REVISION. pattern `^W/"[0-9]+"$` |

## Request body

- `label`: object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `riskValue`: integer Scoring: 0 (no risk) to 4. minimum 0, maximum 4
- `findingSeverity`: optional string
  - ``
  - `info`
  - `low`
  - `medium`
  - `high`
  - `critical`
- `finding`: optional object Text per locale, at most 2000 characters per locale; HTML is rejected. All locales are optional.
  - `en`: optional string maxLength 2000
  - `ru`: optional string maxLength 2000
  - `he`: optional string maxLength 2000
  - No other fields.
- `notApplicable`: optional boolean
- `revision`: integer The draft revision; or send it as If-Match. minimum 0
- No other fields.

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `templateId`: string
- `templateKey`: string Shared by all versions of the questionnaire.
- `version`: integer 0 for an open draft.
- `titleKey`: string
- `descriptionKey`: optional string
- `title`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `description`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `modes`: array of string
- `source`: optional string
  - `builtin`
  - `authored`
- `status`: optional string draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
  - `draft`
  - `submitted`
  - `published`
  - `archived`
- `active`: boolean
- `isDefault`: optional boolean
- `questionCount`: optional integer
- `revision`: optional integer Send with an edit; changes on every structural edit.
- `contentHash`: optional string
- `clonedFromKey`: optional string
- `clonedFromVersion`: optional integer
- `parentVersion`: optional integer
- `publishedAt`: optional string (date-time)
- `publishedBy`: optional string
- `createdAt`: string (date-time)
- `updatedAt`: string (date-time)
- `createdBy`: optional string
- `updatedBy`: optional string
- `lastEditedBy`: optional string
- `lastEditedAt`: optional string (date-time)
- `submittedBy`: optional string
- `submittedAt`: optional string (date-time)
- `submitterNote`: optional string
- `rejectedBy`: optional string
- `rejectedAt`: optional string (date-time)
- `rejectionReason`: optional string
- `sections`: array of object
  - `sectionId`: string
  - `titleKey`: string
  - `title`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    - `en`: string minLength 1, maxLength 500
    - `ru`: optional string maxLength 500
    - `he`: optional string maxLength 500
  - `order`: integer
  - `questions`: array of object
    - `questionId`: string
    - `textKey`: string Built-in text key; authored questions carry `text` instead.
    - `helpKey`: optional string
    - `answerType`: string
      - `text`
      - `email`
      - `phone`
      - `textarea`
      - `single_select`
      - `multi_select`
    - `required`: boolean
    - `modes`: array of string
    - `domain`: string
      - ``
      - `governance`
      - `privacy`
      - `access`
      - `operations`
      - `resilience`
      - `supply_chain`
      - `contractual`
    - `syncTarget`: optional string
    - `evidenceHintKey`: optional string
    - `options`: optional array of object
      - `optionId`: string
      - `labelKey`: string Built-in text key; authored options carry `label` instead.
      - `notApplicable`: optional boolean
      - `label`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
        - `en`: string minLength 1, maxLength 500
        - `ru`: optional string maxLength 500
        - `he`: optional string maxLength 500
      - `riskValue`: optional integer Scoring: 0 (no risk) to 4. minimum 0, maximum 4
      - `findingSeverity`: optional string
        - `info`
        - `low`
        - `medium`
        - `high`
        - `critical`
      - `findingKey`: optional string
      - `finding`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
        - `en`: string minLength 1, maxLength 500
        - `ru`: optional string maxLength 500
        - `he`: optional string maxLength 500
    - `requiresVendorTypes`: optional array of string
    - `allowNotApplicable`: optional boolean
    - `requiresResponses`: optional array of object
      - `questionId`: string
      - `anyOption`: array of string
    - `text`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
      - `en`: string minLength 1, maxLength 500
      - `ru`: optional string maxLength 500
      - `he`: optional string maxLength 500
    - `help`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
      - `en`: string minLength 1, maxLength 500
      - `ru`: optional string maxLength 500
      - `he`: optional string maxLength 500
    - `evidenceHint`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
      - `en`: string minLength 1, maxLength 500
      - `ru`: optional string maxLength 500
      - `he`: optional string maxLength 500
    - `authored`: optional boolean
    - `weight`: optional integer Scoring weight. minimum 1, maximum 10
    - `controlIds`: optional array of string
- `limits`: object The structural caps the server enforces.
  - `maxSections`: integer maximum 20
  - `maxQuestionsPerSection`: integer maximum 50
  - `maxQuestionsPerTemplate`: integer maximum 300
  - `maxOptionsPerQuestion`: integer maximum 12
- `permissions`: optional object What the caller may do with this version right now.
  - `canEdit`: boolean
  - `canSubmit`: boolean
  - `canWithdraw`: boolean
  - `canReject`: boolean
  - `canPublish`: boolean or null
  - `canSetDefault`: boolean
  - `canArchive`: boolean
  - `canDelete`: boolean
  - `publishBlockedReason`: string or null

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | `VALIDATION_FAILED` | no | The JSON body does not match the request schema, or the revision is missing where required. code VALIDATION_FAILED. |
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks supplier_template:write (INSUFFICIENT_SCOPE), has no accountable person (FORBIDDEN: this principal cannot edit questionnaires), or the target is the built-in questionnaire (BUILTIN_IMMUTABLE). |
| 404 | `QUESTION_NOT_FOUND` | no | Unknown questionnaire (NOT_FOUND), question (QUESTION_NOT_FOUND) or option (OPTION_NOT_FOUND). |
| 409 | `OPTION_LIMIT_REACHED` | no | Everything in EditConflict, plus OPTIONS_NOT_ALLOWED (the question is not a choice question) and OPTION_LIMIT_REACHED (12 options). |
| 413 | `PAYLOAD_TOO_LARGE` | no | The JSON body exceeds the size limit. code PAYLOAD_TOO_LARGE. |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address, or the token used its hourly write budget (30 structural, 120 field edits). code RATE_LIMITED; wait Retry-After seconds, also in error.args.retryAfterSeconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR; quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl -X POST "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/questions/<questionId>/options" \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"label":{"en":"Partly"},"riskValue":2,"findingSeverity":"medium","revision":4}'
```

### Python

```python
import requests

response = requests.post(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/questions/<questionId>/options",
    headers={"Authorization": "Bearer <your-api-token>", "Content-Type": "application/json"},
    json={
        "label": {
            "en": "Partly",
        },
        "riskValue": 2,
        "findingSeverity": "medium",
        "revision": 4,
    },
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/questions/<questionId>/options", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>", "Content-Type": "application/json" },
  body: JSON.stringify({
    "label": {
      "en": "Partly"
    },
    "riskValue": 2,
    "findingSeverity": "medium",
    "revision": 4
  }),
});
console.log(await response.json());
```

## Response (201)

```json
{
  "data": {
    "templateId": "satpl_1hgyun41rx48",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 0,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "draft",
    "active": false,
    "questionCount": 1,
    "revision": 5,
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-09T08:20:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": [
          {
            "questionId": "saq_1hgyun41rx4d",
            "textKey": "",
            "text": {
              "en": "Is data encrypted at rest?"
            },
            "answerType": "single_select",
            "required": true,
            "modes": [],
            "domain": "operations",
            "weight": 8,
            "authored": true,
            "options": [
              {
                "optionId": "saqo_1hgyun41rx4e",
                "labelKey": "",
                "label": {
                  "en": "Yes, all stores"
                },
                "riskValue": 0
              },
              {
                "optionId": "saqo_1hgyun41rx4f",
                "labelKey": "",
                "label": {
                  "en": "No"
                },
                "riskValue": 4,
                "findingSeverity": "high"
              },
              {
                "optionId": "saqo_1hgyun41rx4g",
                "labelKey": "",
                "label": {
                  "en": "Partly"
                },
                "riskValue": 2,
                "findingSeverity": "medium"
              }
            ]
          }
        ]
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": true,
      "canSubmit": true,
      "canWithdraw": false,
      "canReject": false,
      "canPublish": false,
      "canSetDefault": false,
      "canArchive": false,
      "canDelete": true,
      "publishBlockedReason": null
    }
  }
}
```