# Withdraw a submitted draft

Return a version that is awaiting approval to `draft` so it can be edited again.

`POST /supplier-assessment-templates/{templateId}/withdraw`

Scope `supplier_template:write` | Plan **Growth+**

Return a version that is awaiting approval to `draft` so it can be edited again. No request body. Only the person who submitted it can withdraw it, and a token acts as the person who created it: a withdraw by anyone else answers 404 NOT_FOUND, the same as for a version that does not exist. A version that is not awaiting approval answers 409 NOT_SUBMITTED (a draft), NOT_A_DRAFT (published) or TEMPLATE_ARCHIVED. Structural write: 30 per token and hour. Requires the supplier_template:write scope (or a signed-in Owner, Manager or Contributor session).

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `templateId` | string | yes | Questionnaire document id (`satpl_...`), or `satpl_builtin_supplier_security_privacy_v1` for the built-in one. |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `templateId`: string
- `templateKey`: string Shared by all versions of the questionnaire.
- `version`: integer 0 for an open draft.
- `titleKey`: string
- `descriptionKey`: optional string
- `title`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `description`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
  - `en`: string minLength 1, maxLength 500
  - `ru`: optional string maxLength 500
  - `he`: optional string maxLength 500
- `modes`: array of string
- `source`: optional string
  - `builtin`
  - `authored`
- `status`: optional string draft and submitted are open (editable or awaiting approval); published is the live version; archived is retired.
  - `draft`
  - `submitted`
  - `published`
  - `archived`
- `active`: boolean
- `isDefault`: optional boolean
- `questionCount`: optional integer
- `revision`: optional integer Send with an edit; changes on every structural edit.
- `contentHash`: optional string
- `clonedFromKey`: optional string
- `clonedFromVersion`: optional integer
- `parentVersion`: optional integer
- `publishedAt`: optional string (date-time)
- `publishedBy`: optional string
- `createdAt`: string (date-time)
- `updatedAt`: string (date-time)
- `createdBy`: optional string
- `updatedBy`: optional string
- `lastEditedBy`: optional string
- `lastEditedAt`: optional string (date-time)
- `submittedBy`: optional string
- `submittedAt`: optional string (date-time)
- `submitterNote`: optional string
- `rejectedBy`: optional string
- `rejectedAt`: optional string (date-time)
- `rejectionReason`: optional string
- `sections`: array of object
  - `sectionId`: string
  - `titleKey`: string
  - `title`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
    - `en`: string minLength 1, maxLength 500
    - `ru`: optional string maxLength 500
    - `he`: optional string maxLength 500
  - `order`: integer
  - `questions`: array of object
    - `questionId`: string
    - `textKey`: string Built-in text key; authored questions carry `text` instead.
    - `helpKey`: optional string
    - `answerType`: string
      - `text`
      - `email`
      - `phone`
      - `textarea`
      - `single_select`
      - `multi_select`
    - `required`: boolean
    - `modes`: array of string
    - `domain`: string
      - ``
      - `governance`
      - `privacy`
      - `access`
      - `operations`
      - `resilience`
      - `supply_chain`
      - `contractual`
    - `syncTarget`: optional string
    - `evidenceHintKey`: optional string
    - `options`: optional array of object
      - `optionId`: string
      - `labelKey`: string Built-in text key; authored options carry `label` instead.
      - `notApplicable`: optional boolean
      - `label`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
        - `en`: string minLength 1, maxLength 500
        - `ru`: optional string maxLength 500
        - `he`: optional string maxLength 500
      - `riskValue`: optional integer Scoring: 0 (no risk) to 4. minimum 0, maximum 4
      - `findingSeverity`: optional string
        - `info`
        - `low`
        - `medium`
        - `high`
        - `critical`
      - `findingKey`: optional string
      - `finding`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
        - `en`: string minLength 1, maxLength 500
        - `ru`: optional string maxLength 500
        - `he`: optional string maxLength 500
    - `requiresVendorTypes`: optional array of string
    - `allowNotApplicable`: optional boolean
    - `requiresResponses`: optional array of object
      - `questionId`: string
      - `anyOption`: array of string
    - `text`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
      - `en`: string minLength 1, maxLength 500
      - `ru`: optional string maxLength 500
      - `he`: optional string maxLength 500
    - `help`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
      - `en`: string minLength 1, maxLength 500
      - `ru`: optional string maxLength 500
      - `he`: optional string maxLength 500
    - `evidenceHint`: optional object Text per locale. `en` is required; `ru` and `he` fall back to `en` when blank. At most 500 characters per locale (2000 for a description); HTML is rejected.
      - `en`: string minLength 1, maxLength 500
      - `ru`: optional string maxLength 500
      - `he`: optional string maxLength 500
    - `authored`: optional boolean
    - `weight`: optional integer Scoring weight. minimum 1, maximum 10
    - `controlIds`: optional array of string
- `limits`: object The structural caps the server enforces.
  - `maxSections`: integer maximum 20
  - `maxQuestionsPerSection`: integer maximum 50
  - `maxQuestionsPerTemplate`: integer maximum 300
  - `maxOptionsPerQuestion`: integer maximum 12
- `permissions`: optional object What the caller may do with this version right now.
  - `canEdit`: boolean
  - `canSubmit`: boolean
  - `canWithdraw`: boolean
  - `canReject`: boolean
  - `canPublish`: boolean or null
  - `canSetDefault`: boolean
  - `canArchive`: boolean
  - `canDelete`: boolean
  - `publishBlockedReason`: string or null

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks supplier_template:write (INSUFFICIENT_SCOPE), has no accountable person (FORBIDDEN: this principal cannot edit questionnaires), or the target is the built-in questionnaire (BUILTIN_IMMUTABLE). |
| 404 | `NOT_FOUND` | no | Unknown or foreign-tenant questionnaire, version or clone source. code NOT_FOUND. |
| 409 | `NOT_SUBMITTED` | no | The version is not awaiting approval. code NOT_SUBMITTED (a draft), NOT_A_DRAFT (published) or TEMPLATE_ARCHIVED; args.current holds the document. |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address, or the token used its hourly write budget (30 structural, 120 field edits). code RATE_LIMITED; wait Retry-After seconds, also in error.args.retryAfterSeconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR; quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl -X POST "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/withdraw" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.post(
    "https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/withdraw",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/supplier-assessment-templates/<templateId>/withdraw", {
  method: "POST",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": {
    "templateId": "satpl_1hgyun41rx48",
    "templateKey": "tpl_1hgyun41rx49",
    "version": 0,
    "titleKey": "",
    "title": {
      "en": "Example vendor security review"
    },
    "modes": [],
    "source": "authored",
    "status": "draft",
    "active": false,
    "questionCount": 0,
    "revision": 3,
    "createdAt": "2026-10-09T08:15:00Z",
    "updatedAt": "2026-10-09T08:20:00Z",
    "sections": [
      {
        "sectionId": "sect_1hgyun41rx4a",
        "titleKey": "",
        "title": {
          "en": "Governance"
        },
        "order": 1,
        "questions": []
      }
    ],
    "limits": {
      "maxSections": 20,
      "maxQuestionsPerSection": 50,
      "maxQuestionsPerTemplate": 300,
      "maxOptionsPerQuestion": 12
    },
    "permissions": {
      "canEdit": true,
      "canSubmit": true,
      "canWithdraw": false,
      "canReject": false,
      "canPublish": false,
      "canSetDefault": false,
      "canArchive": false,
      "canDelete": true,
      "publishBlockedReason": null
    }
  }
}
```