# Validate a draft

Check the content of a questionnaire without changing anything and without a request body.

`POST /supplier-assessment-templates/{templateId}/validate`

Scope `supplier_template:read` | Plan **Growth+**

Check the content of a questionnaire without changing anything and without a request body. `violations` (codes `V1` to `V12`) block submitting the draft for approval; `warnings` (`W1_NO_ZERO_RISK_OPTION` to `W5_ALL_OPTIONS_ZERO_RISK`) do not. It says whether the draft is publishable, not what publishing would change: use preview-publish for that. A read: requires the supplier_template:read scope.

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `templateId` | string | yes | Questionnaire document id (`satpl_...`), or `satpl_builtin_supplier_security_privacy_v1` for the built-in one. |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `violations`: array of object
  - `code`: string V1 to V12.
  - `path`: string
  - `message`: string
- `warnings`: array of object
  - `code`: string W1_NO_ZERO_RISK_OPTION, W2_MISSING_TRANSLATION, W3_NO_CONTROL_IDS, W4_TOP_OF_SCALE_SKEW, W5_ALL_OPTIONS_ZERO_RISK, or (preview only) W6_WEIGHT_RAISED_3X.
  - `path`: string
  - `parameters`: object

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE), or the request is refused (FORBIDDEN, INSUFFICIENT_ROLE for a draft the caller may not read). |
| 404 | `NOT_FOUND` | no | Unknown or foreign-tenant questionnaire, version or clone source. code NOT_FOUND. |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR; quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl -X POST "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/validate" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.post(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/validate",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/validate", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": {
    "violations": [],
    "warnings": [
      {
        "code": "W2_MISSING_TRANSLATION",
        "path": "sections[0].title",
        "parameters": {
          "locale": "ru"
        }
      }
    ]
  }
}
```