Open a draft of a published questionnaire

POST /supplier-assessment-templates/{templateId}/draft

Scope supplier_template:write Plan Growth+

Reopen a published version for editing: a new draft in the same questionnaire family with a copy of its content (version 0, parentVersion the published version). No request body. Only a published version can be reopened (409 NOT_A_DRAFT otherwise), and a family has at most one open draft (409 DRAFT_EXISTS). The built-in questionnaire cannot be edited (403 BUILTIN_IMMUTABLE): clone it instead. Structural write: 30 per token and hour. Requires the supplier_template:write scope (or a signed-in Owner, Manager or Contributor session).

Example

curl -X POST "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/draft" \
  -H "Authorization: Bearer <your-api-token>"

import requests

response = requests.post(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/draft",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/draft", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());

Response 201

{
  "data": {
    "templateId": "satpl_1hgyun41rx48",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 0,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "draft",
    "active": false,
    "questionCount": 0,
    "revision": 1,
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-09T08:20:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": []
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": true,
      "canSubmit": true,
      "canWithdraw": false,
      "canReject": false,
      "canPublish": false,
      "canSetDefault": false,
      "canArchive": false,
      "canDelete": true,
      "publishBlockedReason": null
    }
  }
}

Path parameters

templateId string required
Questionnaire document id (satpl_...), or satpl_builtin_supplier_security_privacy_v1 for the built-in one.

Returns

The data field of the standard { data, error, meta } envelope:

templateId string required
templateKey string required
Shared by all versions of the questionnaire.
version integer required
0 for an open draft.
titleKey string required
descriptionKey string
title object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
description object
Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
- en string required
  minLength 1, maxLength 500
- ru string
  maxLength 500
- he string
  maxLength 500
modes array of string required
source string
"builtin" | "authored"
status string
draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
"draft" | "submitted" | "published" | "archived"
active boolean required
isDefault boolean
questionCount integer
revision integer
Send with an edit; changes on every structural edit.
contentHash string
clonedFromKey string
clonedFromVersion integer
parentVersion integer
publishedAt string (date-time)
publishedBy string
createdAt string (date-time) required
updatedAt string (date-time) required
createdBy string
updatedBy string
lastEditedBy string
lastEditedAt string (date-time)
submittedBy string
submittedAt string (date-time)
submitterNote string
rejectedBy string
rejectedAt string (date-time)
rejectionReason string
sections array of object required
- sectionId string required
- titleKey string required
- title object
  Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  Show 3 propertiesHide 3 properties { en, ru, he }
  - en string required
    minLength 1, maxLength 500
  - ru string
    maxLength 500
  - he string
    maxLength 500
- order integer required
- questions array of object required
  Show 19 propertiesHide 19 properties { questionId, textKey, helpKey, answerType, … }
  - questionId string required
  - textKey string required
    Built-in text key; authored questions carry text instead.
  - helpKey string
  - answerType string required
    "text" | "email" | "phone" | "textarea" | "single_select" | "multi_select"
  - required boolean required
  - modes array of string required
  - domain string required
    "" | "governance" | "privacy" | "access" | "operations" | "resilience" | "supply_chain" | "contractual"
  - syncTarget string
  - evidenceHintKey string
  - options array of object
    Show 8 propertiesHide 8 properties { optionId, labelKey, notApplicable, label, … }
    optionId string required
    labelKey string required
    Built-in text key; authored options carry label instead.
    notApplicable boolean
    label object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
    riskValue integer
    Scoring: 0 (no risk) to 4. minimum 0, maximum 4
    findingSeverity string
    "info" | "low" | "medium" | "high" | "critical"
    findingKey string
    finding object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - requiresVendorTypes array of string
  - allowNotApplicable boolean
  - requiresResponses array of object
    Show 2 propertiesHide 2 properties { questionId, anyOption }
    questionId string required
    anyOption array of string required
  - text object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - help object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - evidenceHint object
    Text per locale. en is required; ru and he fall back to en when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    Show 3 propertiesHide 3 properties { en, ru, he }
    en string required
    minLength 1, maxLength 500
    ru string
    maxLength 500
    he string
    maxLength 500
  - authored boolean
  - weight integer
    Scoring weight. minimum 1, maximum 10
  - controlIds array of string
limits object required
The structural caps the server enforces.
- maxSections integer required
  maximum 20
- maxQuestionsPerSection integer required
  maximum 50
- maxQuestionsPerTemplate integer required
  maximum 300
- maxOptionsPerQuestion integer required
  maximum 12
permissions object
What the caller may do with this version right now.
- canEdit boolean required
- canSubmit boolean required
- canWithdraw boolean required
- canReject boolean required
- canPublish boolean or null required
- canSetDefault boolean required
- canArchive boolean required
- canDelete boolean required
- publishBlockedReason string or null required

Errors

Status	Code	Retry	Meaning
401	`INVALID_TOKEN`	no	Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402	`FEATURE_GATED`	no	The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403	`INSUFFICIENT_SCOPE`	no	The token lacks supplier_template:write (INSUFFICIENT_SCOPE), has no accountable person (FORBIDDEN: this principal cannot edit questionnaires), or the target is the built-in questionnaire (BUILTIN_IMMUTABLE).
404	`NOT_FOUND`	no	Unknown or foreign-tenant questionnaire, version or clone source. code NOT_FOUND.
409	`DRAFT_EXISTS`	no	Only a published version can be reopened (NOT_A_DRAFT), or the family already has an open draft (DRAFT_EXISTS).
429	`RATE_LIMITED`	yes	Too many failed authentication attempts from this address, or the token used its hourly write budget (30 structural, 120 field edits). code RATE_LIMITED; wait Retry-After seconds, also in error.args.retryAfterSeconds.
500	`DB_ERROR`	no	Unexpected server error. code DB_ERROR; quote error.id to support.
503	`BILLING_UNAVAILABLE`	yes	Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.

Last reviewed: 2026-10-13

Was this page helpful?