Get a questionnaire

GET /supplier-assessment-templates/{templateId}

Scope supplier_template:read Plan Growth+

Fetch one questionnaire version by templateId with its sections, questions, options and scoring fields (weight, riskValue, findingSeverity, controlIds), the structural limits and the revision to send with an edit. The built-in questionnaire can be read with its fixed id satpl_builtin_supplier_security_privacy_v1. Requires the supplier_template:read scope.

Example

curl "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>" \
  -H "Authorization: Bearer <your-api-token>"

import requests

response = requests.get(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());

Response 200

{
  "data": {
    "templateId": "satpl_1hgyun41rx48",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 0,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "draft",
    "active": false,
    "questionCount": 0,
    "revision": 3,
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-09T08:20:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": []
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": true,
      "canSubmit": true,
      "canWithdraw": false,
      "canReject": false,
      "canPublish": false,
      "canSetDefault": false,
      "canArchive": false,
      "canDelete": true,
      "publishBlockedReason": null
    }
  }
}

Path parameters

templateId string required
Questionnaire document id (satpl_...), or satpl_builtin_supplier_security_privacy_v1 for the built-in one.

Returns

The data field of the standard { data, error, meta } envelope:

templateId string required
templateKey string required
Shared by all versions of the questionnaire.
version integer required
0 for an open draft.
titleKey string required
descriptionKey string
title object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
description object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
modes array of string required
source string
"builtin" | "authored"
status string
draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
"draft" | "submitted" | "published" | "archived"
active boolean required
isDefault boolean
questionCount integer
revision integer
Send with an edit; changes on every structural edit.
contentHash string
clonedFromKey string
clonedFromVersion integer
parentVersion integer
publishedAt string (date-time)
publishedBy string
createdAt string (date-time) required
updatedAt string (date-time) required
createdBy string
updatedBy string
lastEditedBy string
lastEditedAt string (date-time)
submittedBy string
submittedAt string (date-time)
submitterNote string
rejectedBy string
rejectedAt string (date-time)
rejectionReason string
sections array of object required
- sectionId string required
- titleKey string required
- title object
  Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  Show 3 propertiesHide 3 properties { en, ru, he }
  - en string required
    minLength 1, maxLength 500
  - ru string
    maxLength 500
  - he string
    maxLength 500
- order integer required
- questions array of object required
  Show 19 propertiesHide 19 properties { questionId, textKey, helpKey, answerType, … }
  - questionId string required
  - textKey string required
    Built-in text key; authored questions carry text instead.
  - helpKey string
  - answerType string required
    "text" | "email" | "phone" | "textarea" | "single_select" | "multi_select"
  - required boolean required
  - modes array of string required
  - domain string required
    "" | "governance" | "privacy" | "access" | "operations" | "resilience" | "supply_chain" | "contractual"
  - syncTarget string
  - evidenceHintKey string
  - options array of object
    Show 8 propertiesHide 8 properties { optionId, labelKey, notApplicable, label, … }
    optionId string required
    labelKey string required
    Built-in text key; authored options carry label instead.
    notApplicable boolean
    label object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
    riskValue integer
    Scoring: 0 (no risk) to 4. minimum 0, maximum 4
    findingSeverity string
    "info" | "low" | "medium" | "high" | "critical"
    findingKey string
    finding object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - requiresVendorTypes array of string
  - allowNotApplicable boolean
  - requiresResponses array of object
    Show 2 propertiesHide 2 properties { questionId, anyOption }
    questionId string required
    anyOption array of string required
  - text object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - help object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - evidenceHint object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - authored boolean
  - weight integer
    Scoring weight. minimum 1, maximum 10
  - controlIds array of string
limits object required
The structural caps the server enforces.
- maxSections integer required
  maximum 20
- maxQuestionsPerSection integer required
  maximum 50
- maxQuestionsPerTemplate integer required
  maximum 300
- maxOptionsPerQuestion integer required
  maximum 12
permissions object
What the caller may do with this version right now.
- canEdit boolean required
- canSubmit boolean required
- canWithdraw boolean required
- canReject boolean required
- canPublish boolean or null required
- canSetDefault boolean required
- canArchive boolean required
- canDelete boolean required
- publishBlockedReason string or null required

Errors

Status	Code	Retry	Meaning
401	`INVALID_TOKEN`	no	Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402	`FEATURE_GATED`	no	The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403	`INSUFFICIENT_SCOPE`	no	The token lacks the required scope (INSUFFICIENT_SCOPE), or the request is refused (FORBIDDEN, INSUFFICIENT_ROLE for a draft the caller may not read).
404	`NOT_FOUND`	no	Unknown or foreign-tenant questionnaire, version or clone source. code NOT_FOUND.
429	`RATE_LIMITED`	yes	Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds.
500	`DB_ERROR`	no	Unexpected server error. code DB_ERROR; quote error.id to support.
503	`BILLING_UNAVAILABLE`	yes	Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.

Last reviewed: 2026-10-13

Was this page helpful?