# Build Supplier Questionnaires From Scratch
URL: https://docs.autociso.io/release-notes/2026-10-questionnaire-authoring-from-scratch/
Description: Create a blank supplier questionnaire, add and remove sections, questions and answer options, and see what changes for existing API clients.

## Build supplier questionnaires from scratch

**Plans:** The Growth and above
**Where:** **Suppliers → Questionnaires**

**Who benefits:** CTOs and IT managers who need a questionnaire shaped for their own suppliers, not a copy of the built-in one.

Click **New questionnaire** to start a blank draft, then add and rename sections, add and delete questions, and add and delete answer options in the editor. Limits are 20 sections, 50 questions per section, 300 questions in total, 2 to 12 options per choice question, and 50 questionnaires per organization. Anything that would break a conditional rule or the service-type question is refused with an explanation. See [Author and approve supplier questionnaires](https://docs.autociso.io/product/suppliers/questionnaires/).

**How to use it**

1. Click **Suppliers**, then **Questionnaires**, then **New questionnaire**, and enter a **Name**.
2. Use **Add section** and **Add question** to build it, then **Add option** for choice questions.
3. Click **Submit for approval**. A Manager or Owner reviews and publishes it as before.

### Separation of duties is stricter

- Edits made with an API token or an AI client (MCP) now count as an edit by the person who created the token. A token can no longer be used to get around the second approver.
- Cloning a questionnaire (a built-in one is unchanged) makes the cloner the last editor, so they can't publish the clone unless they are the Owner.
- Drafts with no recorded editor can only be published by the Owner.
- Publishing now needs the written risk-reduction acknowledgement when the draft removed an answer that was a critical finding in the published version, or a question that contained one.
- **Submit for approval** validates the whole draft and returns the list of problems instead of accepting it.

### API changes

New endpoints (scope `supplier_template:write`; see [Access model](https://docs.autociso.io/developers/access-model/)): `POST /api/v1/supplier-assessment-templates` (blank draft), sections `POST`, `PATCH` and `DELETE`, and options `POST` and `DELETE`. A token can only create a questionnaire if it has a recorded creator. Template detail responses now include a `limits` object.

Changes to existing endpoints:

- `POST /supplier-assessment-templates/clone` is rate-limited with the structural-write limit (30 per hour per token), returns `400 VALIDATION_FAILED` when sent an `If-Match` header, and rejects blank names and names containing HTML. Clones store `questionCount`.
- Adding a question with a stale `revision` returns `409 STALE_REVISION`. `revision` stays optional.
- `POST .../questions` requires 2 to 12 options for choice types and rejects options on other types.
- Deleting a question that doesn't exist returns `404 QUESTION_NOT_FOUND` (it used to return 204).
- Editing meta, a question or an option uses a higher limit than structural writes: 1200 per hour for people, 120 per hour for tokens. Structural writes are 300 per hour for people and 30 per hour for tokens. `429 RATE_LIMITED` now includes `args.retryAfterSeconds`.
- An edit that changes nothing returns 200 with the current questionnaire and does not bump the revision or write an audit entry.
- Requests with an `If-Match` header and a body over 1 MiB return `400 VALIDATION_FAILED`.

New 409 codes: `SECTION_LIMIT_REACHED`, `QUESTION_LIMIT_REACHED`, `OPTION_LIMIT_REACHED`, `OPTION_MINIMUM_REACHED`, `OPTIONS_NOT_ALLOWED`, `TEMPLATE_SIZE_LIMIT_REACHED`, `SECTION_REFERENCED`, `OPTION_REFERENCED`. New 404 codes: `SECTION_NOT_FOUND`, `OPTION_NOT_FOUND`.