Add a section to a draft

POST /supplier-assessment-templates/{templateId}/sections

Scope supplier_template:write Plan Growth+

Append an empty section to a draft. title (en required) and the draft’s revision are required; sectionId and the order are assigned by the server. A draft can hold 20 sections (409 SECTION_LIMIT_REACHED). Structural write: 30 per token and hour. Requires the supplier_template:write scope (or a signed-in Owner, Manager or Contributor session).

Example

curl -X POST "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/sections" \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"Access control"},"revision":3}'

import requests

response = requests.post(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/sections",
    headers={"Authorization": "Bearer <your-api-token>", "Content-Type": "application/json"},
    json={
        "title": {
            "en": "Access control",
        },
        "revision": 3,
    },
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/sections", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>", "Content-Type": "application/json" },
  body: JSON.stringify({
    "title": {
      "en": "Access control"
    },
    "revision": 3
  }),
});
console.log(await response.json());

Response 201

{
  "data": {
    "templateId": "satpl_1hgyun41rx48",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 0,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "draft",
    "active": false,
    "questionCount": 0,
    "revision": 4,
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-09T08:20:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": []
      },
      {
        "sectionId": "sect_1hgyun41rx4b",
        "titleKey": "",
        "title": {
          "en": "Access control"
        },
        "order": 2,
        "questions": []
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": true,
      "canSubmit": true,
      "canWithdraw": false,
      "canReject": false,
      "canPublish": false,
      "canSetDefault": false,
      "canArchive": false,
      "canDelete": true,
      "publishBlockedReason": null
    }
  }
}

Path parameters

templateId string required
Questionnaire document id (satpl_...), or satpl_builtin_supplier_security_privacy_v1 for the built-in one.

Header parameters

If-Match string
The draft revision as W/"<revision>", from the ETag header. Wins over a revision in the body. A write on an older revision fails with 409 STALE_REVISION. pattern ^W/"[0-9]+"$

Request body

title object required
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
revision integer required
The draft revision; or send it as If-Match. minimum 0
No other fields.

Returns

The data field of the standard { data, error, meta } envelope:

templateId string required
templateKey string required
Shared by all versions of the questionnaire.
version integer required
0 for an open draft.
titleKey string required
descriptionKey string
title object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
description object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
modes array of string required
source string
"builtin" | "authored"
status string
draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
"draft" | "submitted" | "published" | "archived"
active boolean required
isDefault boolean
questionCount integer
revision integer
Send with an edit; changes on every structural edit.
contentHash string
clonedFromKey string
clonedFromVersion integer
parentVersion integer
publishedAt string (date-time)
publishedBy string
createdAt string (date-time) required
updatedAt string (date-time) required
createdBy string
updatedBy string
lastEditedBy string
lastEditedAt string (date-time)
submittedBy string
submittedAt string (date-time)
submitterNote string
rejectedBy string
rejectedAt string (date-time)
rejectionReason string
sections array of object required
- sectionId string required
- titleKey string required
- title object
  Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  Show 3 propertiesHide 3 properties { en, ru, he }
  - en string required
    minLength 1, maxLength 500
  - ru string
    maxLength 500
  - he string
    maxLength 500
- order integer required
- questions array of object required
  Show 19 propertiesHide 19 properties { questionId, textKey, helpKey, answerType, … }
  - questionId string required
  - textKey string required
    Built-in text key; authored questions carry text instead.
  - helpKey string
  - answerType string required
    "text" | "email" | "phone" | "textarea" | "single_select" | "multi_select"
  - required boolean required
  - modes array of string required
  - domain string required
    "" | "governance" | "privacy" | "access" | "operations" | "resilience" | "supply_chain" | "contractual"
  - syncTarget string
  - evidenceHintKey string
  - options array of object
    Show 8 propertiesHide 8 properties { optionId, labelKey, notApplicable, label, … }
    optionId string required
    labelKey string required
    Built-in text key; authored options carry label instead.
    notApplicable boolean
    label object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
    riskValue integer
    Scoring: 0 (no risk) to 4. minimum 0, maximum 4
    findingSeverity string
    "info" | "low" | "medium" | "high" | "critical"
    findingKey string
    finding object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - requiresVendorTypes array of string
  - allowNotApplicable boolean
  - requiresResponses array of object
    Show 2 propertiesHide 2 properties { questionId, anyOption }
    questionId string required
    anyOption array of string required
  - text object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - help object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - evidenceHint object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - authored boolean
  - weight integer
    Scoring weight. minimum 1, maximum 10
  - controlIds array of string
limits object required
The structural caps the server enforces.
- maxSections integer required
  maximum 20
- maxQuestionsPerSection integer required
  maximum 50
- maxQuestionsPerTemplate integer required
  maximum 300
- maxOptionsPerQuestion integer required
  maximum 12
permissions object
What the caller may do with this version right now.
- canEdit boolean required
- canSubmit boolean required
- canWithdraw boolean required
- canReject boolean required
- canPublish boolean or null required
- canSetDefault boolean required
- canArchive boolean required
- canDelete boolean required
- publishBlockedReason string or null required

Errors

Status	Code	Retry	Meaning
400	`VALIDATION_FAILED`	no	The JSON body does not match the request schema, or the revision is missing where required. code VALIDATION_FAILED.
401	`INVALID_TOKEN`	no	Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402	`FEATURE_GATED`	no	The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403	`INSUFFICIENT_SCOPE`	no	The token lacks supplier_template:write (INSUFFICIENT_SCOPE), has no accountable person (FORBIDDEN: this principal cannot edit questionnaires), or the target is the built-in questionnaire (BUILTIN_IMMUTABLE).
404	`NOT_FOUND`	no	Unknown or foreign-tenant questionnaire, version or clone source. code NOT_FOUND.
409	`SECTION_REFERENCED`	no	Everything in EditConflict, plus SECTION_LIMIT_REACHED (20 sections), SECTION_REFERENCED (a question elsewhere depends on a question in this section; args.dependents lists them) and QUESTION_IS_GATING_TRIGGER (the section holds the vendor-type question).
413	`PAYLOAD_TOO_LARGE`	no	The JSON body exceeds the size limit. code PAYLOAD_TOO_LARGE.
429	`RATE_LIMITED`	yes	Too many failed authentication attempts from this address, or the token used its hourly write budget (30 structural, 120 field edits). code RATE_LIMITED; wait Retry-After seconds, also in error.args.retryAfterSeconds.
500	`DB_ERROR`	no	Unexpected server error. code DB_ERROR; quote error.id to support.
503	`BILLING_UNAVAILABLE`	yes	Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.

Last reviewed: 2026-10-13

Was this page helpful?