# List supplier questionnaires

List the questionnaires of the organization, newest change first: the built-in questionnaire (always the first row of an unfiltered first page) and every authored version, drafts included.

`GET /supplier-assessment-templates`

Scope `supplier_template:read` | Plan **Growth+**

List the questionnaires of the organization, newest change first: the built-in questionnaire (always the first row of an unfiltered first page) and every authored version, drafts included. A row carries no sections; read one questionnaire to get its content. Requires the supplier_template:read scope.

## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `limit` | integer | no | Page size. Default 25, maximum 500. minimum 1, maximum 500, default 25 |
| `offset` | integer | no | Zero-based offset. minimum 0, default 0 |
| `sort[status]` | string | no | One of `asc`, `desc`. |
| `sort[updatedAt]` | string | no | Default order is updatedAt descending. One of `asc`, `desc`. |
| `filter[status][eq]` | string | no | One of `draft`, `submitted`, `published`, `archived`. |
| `filter[status][ne]` | string | no | One of `draft`, `submitted`, `published`, `archived`. |
| `filter[status][in]` | array of string | no |  |
| `filter[source][eq]` | string | no | One of `builtin`, `authored`. |
| `filter[templateKey][eq]` | string | no | All versions of one questionnaire. |
| `filter[isDefault][eq]` | boolean | no |  |
| `filter[updatedAt][gt]` | string (date-time) | no |  |
| `filter[updatedAt][gte]` | string (date-time) | no |  |
| `filter[updatedAt][lt]` | string (date-time) | no |  |
| `filter[updatedAt][lte]` | string (date-time) | no |  |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `templateId`: string
- `templateKey`: string
- `version`: integer
- `titleKey`: string
- `descriptionKey`: optional string
- `title`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `description`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `source`: optional string
  - `builtin`
  - `authored`
- `status`: optional string draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
  - `draft`
  - `submitted`
  - `published`
  - `archived`
- `active`: boolean
- `isDefault`: optional boolean
- `questionCount`: optional integer
- `updatedAt`: string (date-time)
- `updatedBy`: optional string
- `permissions`: object What the caller may do with this version right now.
  - `canEdit`: boolean
  - `canSubmit`: boolean
  - `canWithdraw`: boolean
  - `canReject`: boolean
  - `canPublish`: boolean or null
  - `canSetDefault`: boolean
  - `canArchive`: boolean
  - `canDelete`: boolean
  - `publishBlockedReason`: string or null

The `meta` field:

- `total`: integer
- `limit`: optional integer
- `offset`: optional integer

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | `VALIDATION_FAILED` | no | Unknown or malformed query parameter. code VALIDATION_FAILED. |
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE), or the request is refused (FORBIDDEN, INSUFFICIENT_ROLE for a draft the caller may not read). |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR; quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/supplier-assessment-templates" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/supplier-assessment-templates",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "templateId": "satpl_builtin_supplier_security_privacy_v1",
      "templateKey": "supplier_security_privacy",
      "version": 1,
      "titleKey": "supplier.template.builtin.title",
      "title": {
        "en": "Supplier security and privacy"
      },
      "source": "builtin",
      "status": "published",
      "active": true,
      "isDefault": true,
      "questionCount": 62,
      "updatedAt": "2026-09-01T09:00:00Z",
      "permissions": {
        "canEdit": false,
        "canSubmit": false,
        "canWithdraw": false,
        "canReject": false,
        "canPublish": null,
        "canSetDefault": false,
        "canArchive": false,
        "canDelete": false,
        "publishBlockedReason": null
      }
    }
  ],
  "meta": {
    "total": 1,
    "limit": 25
  }
}
```