Submit a draft for approval

POST /supplier-assessment-templates/{templateId}/submit

Scope supplier_template:write Plan Growth+

Send a draft to the people who can publish it. The draft’s revision is required (in the body or as If-Match; otherwise 400 VALIDATION_FAILED), so an approver is asked about exactly the version the caller saw. note (at most 500 characters) is shown to the approver. The whole draft is validated first: if it has problems nothing changes, the status stays draft and the answer is 422 TEMPLATE_INVALID with the list in error.args.violations (the same list as validateSupplierTemplate): for example a choice question with fewer than two options, or a question without English text. A submitted version is frozen until the submitter withdraws it (withdrawSupplierTemplate) or an approver sends it back. Publishing it as the next version is a person’s decision and is refused to tokens. The built-in questionnaire cannot be submitted (403 BUILTIN_IMMUTABLE). Structural write: 30 per token and hour. Requires the supplier_template:write scope (or a signed-in Owner, Manager or Contributor session).

curl -X POST "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/submit" \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"revision":3,"note":"Added the encryption question."}'

import requests

response = requests.post(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/submit",
    headers={"Authorization": "Bearer <your-api-token>", "Content-Type": "application/json"},
    json={
        "revision": 3,
        "note": "Added the encryption question.",
    },
)
print(response.json())

const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/submit", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>", "Content-Type": "application/json" },
  body: JSON.stringify({
    "revision": 3,
    "note": "Added the encryption question."
  }),
});
console.log(await response.json());

{
  "data": {
    "templateId": "satpl_1hgyun41rx48",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 0,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "submitted",
    "active": false,
    "questionCount": 0,
    "revision": 3,
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-09T08:20:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": []
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": false,
      "canSubmit": false,
      "canWithdraw": true,
      "canReject": false,
      "canPublish": false,
      "canSetDefault": false,
      "canArchive": false,
      "canDelete": false,
      "publishBlockedReason": null
    }
  }
}