Get a questionnaire version

GET /supplier-assessment-templates/{templateId}/versions/{version}

Scope supplier_template:read Plan Growth+

Fetch one numbered version of a questionnaire. Unlike the other routes, the path segment {templateId} here is the questionnaire’s templateKey (the same in every version), not a templateId. meta.contentHashVerified tells whether the stored content still matches the hash recorded when the version was published; a mismatch is reported, never an error. A draft carries version 0. Requires the supplier_template:read scope.

Example

curl "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/versions/<version>" \
  -H "Authorization: Bearer <your-api-token>"

import requests

response = requests.get(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/versions/<version>",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/versions/<version>", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());

Response 200

{
  "data": {
    "templateId": "satpl_1hgyun41rx50",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 2,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "published",
    "active": true,
    "isDefault": false,
    "questionCount": 1,
    "contentHash": "9f2c4e7a1b3d5f6081a2c3d4e5f60718293a4b5c6d7e8f901122334455667788",
    "parentVersion": 1,
    "publishedAt": "2026-10-10T12:00:00Z",
    "publishedBy": "usr_1hgyq7m2k9xa",
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-10T12:00:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": [
          {
            "questionId": "saq_1hgyun41rx4d",
            "textKey": "",
            "text": {
              "en": "Is data encrypted at rest?"
            },
            "answerType": "single_select",
            "required": true,
            "modes": [],
            "domain": "operations",
            "weight": 10,
            "authored": true,
            "options": [
              {
                "optionId": "saqo_1hgyun41rx4e",
                "labelKey": "",
                "label": {
                  "en": "Yes, all stores"
                },
                "riskValue": 0
              },
              {
                "optionId": "saqo_1hgyun41rx4f",
                "labelKey": "",
                "label": {
                  "en": "No"
                },
                "riskValue": 4,
                "findingSeverity": "high"
              },
              {
                "optionId": "saqo_1hgyun41rx4g",
                "labelKey": "",
                "label": {
                  "en": "Partly"
                },
                "riskValue": 2,
                "findingSeverity": "medium"
              }
            ]
          }
        ]
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": false,
      "canSubmit": false,
      "canWithdraw": false,
      "canReject": false,
      "canPublish": null,
      "canSetDefault": true,
      "canArchive": true,
      "canDelete": false,
      "publishBlockedReason": null
    }
  },
  "meta": {
    "contentHashVerified": true
  }
}

Path parameters

templateId string required
The questionnaire's templateKey, which is shared by all its versions. Not a document templateId.
version integer required
Version number; 0 is an open draft. minimum 0

Returns

The data field of the standard { data, error, meta } envelope:

templateId string required
templateKey string required
Shared by all versions of the questionnaire.
version integer required
0 for an open draft.
titleKey string required
descriptionKey string
title object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
description object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
modes array of string required
source string
"builtin" | "authored"
status string
draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
"draft" | "submitted" | "published" | "archived"
active boolean required
isDefault boolean
questionCount integer
revision integer
Send with an edit; changes on every structural edit.
contentHash string
clonedFromKey string
clonedFromVersion integer
parentVersion integer
publishedAt string (date-time)
publishedBy string
createdAt string (date-time) required
updatedAt string (date-time) required
createdBy string
updatedBy string
lastEditedBy string
lastEditedAt string (date-time)
submittedBy string
submittedAt string (date-time)
submitterNote string
rejectedBy string
rejectedAt string (date-time)
rejectionReason string
sections array of object required
- sectionId string required
- titleKey string required
- title object
  Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  Show 3 propertiesHide 3 properties { en, ru, he }
  - en string required
    minLength 1, maxLength 500
  - ru string
    maxLength 500
  - he string
    maxLength 500
- order integer required
- questions array of object required
  Show 19 propertiesHide 19 properties { questionId, textKey, helpKey, answerType, … }
  - questionId string required
  - textKey string required
    Built-in text key; authored questions carry text instead.
  - helpKey string
  - answerType string required
    "text" | "email" | "phone" | "textarea" | "single_select" | "multi_select"
  - required boolean required
  - modes array of string required
  - domain string required
    "" | "governance" | "privacy" | "access" | "operations" | "resilience" | "supply_chain" | "contractual"
  - syncTarget string
  - evidenceHintKey string
  - options array of object
    Show 8 propertiesHide 8 properties { optionId, labelKey, notApplicable, label, … }
    optionId string required
    labelKey string required
    Built-in text key; authored options carry label instead.
    notApplicable boolean
    label object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
    riskValue integer
    Scoring: 0 (no risk) to 4. minimum 0, maximum 4
    findingSeverity string
    "info" | "low" | "medium" | "high" | "critical"
    findingKey string
    finding object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - requiresVendorTypes array of string
  - allowNotApplicable boolean
  - requiresResponses array of object
    Show 2 propertiesHide 2 properties { questionId, anyOption }
    questionId string required
    anyOption array of string required
  - text object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - help object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - evidenceHint object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - authored boolean
  - weight integer
    Scoring weight. minimum 1, maximum 10
  - controlIds array of string
limits object required
The structural caps the server enforces.
- maxSections integer required
  maximum 20
- maxQuestionsPerSection integer required
  maximum 50
- maxQuestionsPerTemplate integer required
  maximum 300
- maxOptionsPerQuestion integer required
  maximum 12
permissions object
What the caller may do with this version right now.
- canEdit boolean required
- canSubmit boolean required
- canWithdraw boolean required
- canReject boolean required
- canPublish boolean or null required
- canSetDefault boolean required
- canArchive boolean required
- canDelete boolean required
- publishBlockedReason string or null required

The meta field:

contentHashVerified boolean required
False when the stored content no longer matches the recorded hash, or there is none (a draft).

Errors

Status	Code	Retry	Meaning
400	`VALIDATION_FAILED`	no	A version in the path is not an integer. code VALIDATION_FAILED.
401	`INVALID_TOKEN`	no	Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402	`FEATURE_GATED`	no	The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403	`INSUFFICIENT_SCOPE`	no	The token lacks the required scope (INSUFFICIENT_SCOPE), or the request is refused (FORBIDDEN, INSUFFICIENT_ROLE for a draft the caller may not read).
404	`NOT_FOUND`	no	Unknown or foreign-tenant questionnaire, version or clone source. code NOT_FOUND.
429	`RATE_LIMITED`	yes	Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds.
500	`DB_ERROR`	no	Unexpected server error. code DB_ERROR; quote error.id to support.
503	`BILLING_UNAVAILABLE`	yes	Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.

Last reviewed: 2026-10-13

Was this page helpful?