Declare with files how an agent meets assessment controls
Add a declaration with one or more files, and optionally a statement, to an assessment's draft, as a project declaration is made with its files, covering the controls it names. Each file's bytes are registered with the Integrity Service for their CID and stored with the assessment; read them through the declaration's files/{attachmentId}/url and /download routes, which apply the assessment's access rules, not the generic attachment endpoints. The declaration is registered as a governance statement in the assessment's graph, signed by the caller. Declarations are never changed: remove one and add another. A submission keeps the declarations it froze. Only the member who started the assessment may declare; an integration's API key bound to no project acts as its owner with full access or the submit_agent_assessments scope
https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-filecurl --request POST \
--url 'https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file' \
--header 'Authorization: Bearer <token>' \
--form 'declaration=<declaration>' \
--form 'files=@<file>'const form = new FormData();
form.append("declaration", "<declaration>");
form.append("files", file); // a File or Blob
const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file", {
method: "POST",
headers: {
"Authorization": "Bearer <token>"
},
body: form
});
const data = await response.json();declare const file: Blob;
interface AssessmentDeclaration {
attachments?: Record<string, unknown>[];
controls?: string[];
documentCid?: string;
statement?: string;
statementId?: string;
submittedAt?: string;
submittedBy?: string;
submittedByDid?: string;
submittedByUserId?: string;
uuid?: string;
}
const form = new FormData();
form.append("declaration", "<declaration>");
form.append("files", file); // a File or Blob
const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file", {
method: "POST",
headers: {
"Authorization": "Bearer <token>"
},
body: form
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
const data: AssessmentDeclaration = await response.json();import requests
response = requests.post(
"https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file",
headers={
"Authorization": "Bearer <token>",
},
data={
"declaration": "<declaration>",
},
files={"files": open("<file>", "rb")},
)
response.raise_for_status()
print(response.json())package main
import (
"bytes"
"fmt"
"io"
"mime/multipart"
"net/http"
"os"
"path/filepath"
)
func main() {
var body bytes.Buffer
form := multipart.NewWriter(&body)
if err := form.WriteField("declaration", "<declaration>"); err != nil {
panic(err)
}
file, err := os.Open("<file>")
if err != nil {
panic(err)
}
defer file.Close()
part, err := form.CreateFormFile("files", filepath.Base(file.Name()))
if err != nil {
panic(err)
}
if _, err := io.Copy(part, file); err != nil {
panic(err)
}
if err := form.Close(); err != nil {
panic(err)
}
req, err := http.NewRequest(http.MethodPost, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file", &body)
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <token>")
req.Header.Set("Content-Type", form.FormDataContentType())
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
data, err := io.ReadAll(res.Body)
if err != nil {
panic(err)
}
fmt.Println(res.Status, string(data))
}import java.io.ByteArrayOutputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
public class Example {
public static void main(String[] args) throws Exception {
String boundary = "GuardianBoundary" + System.nanoTime();
ByteArrayOutputStream form = new ByteArrayOutputStream();
form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"declaration\"\r\n\r\n<declaration>\r\n").getBytes(StandardCharsets.UTF_8));
Path file = Path.of("<file>");
form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"files\"; filename=\"" + file.getFileName() + "\"\r\n\r\n").getBytes(StandardCharsets.UTF_8));
form.writeBytes(Files.readAllBytes(file));
form.writeBytes("\r\n".getBytes(StandardCharsets.UTF_8));
form.writeBytes(("--" + boundary + "--\r\n").getBytes(StandardCharsets.UTF_8));
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file"))
.header("Authorization", "Bearer <token>")
.header("Content-Type", "multipart/form-data; boundary=" + boundary)
.method("POST", HttpRequest.BodyPublishers.ofByteArray(form.toByteArray()))
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using System.Net.Http.Headers;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
using var form = new MultipartFormDataContent();
form.Add(new StringContent("<declaration>"), "declaration");
form.Add(new StreamContent(File.OpenRead("<file>")), "files", Path.GetFileName("<file>"));
request.Content = form;
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");<?php
$ch = curl_init('https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => [
'Authorization: Bearer <token>',
],
CURLOPT_POSTFIELDS => [
'declaration' => '<declaration>',
'files' => new CURLFile('<file>'),
],
CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;require "net/http"
uri = URI("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request.set_form([
["declaration", "<declaration>"],
["files", File.open("<file>")],
], "multipart/form-data")
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
http.request(request)
end
puts "#{response.code} #{response.body}"// Cargo.toml dependencies: reqwest (features "multipart"), tokio (features "full")
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let form = reqwest::multipart::Form::new()
.text("declaration", "<declaration>")
.part("files", reqwest::multipart::Part::bytes(std::fs::read("<file>")?).file_name("<file>"));
let response = reqwest::Client::new()
.post("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file")
.header("Authorization", "Bearer <token>")
.multipart(form)
.send()
.await?;
println!("{} {}", response.status(), response.text().await?);
Ok(())
}Authorizations
BearerAuth· API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.
Parameters
Path parameters
| Name | Type | Description |
|---|---|---|
orgIdrequired | string | Organization ID or UUID (urn:uuid optional) |
assessmentIdrequired | string | Assessment UUID (urn:uuid optional) |
Form parameters
| Name | Type | Description |
|---|---|---|
declarationrequired | string | JSON AddDeclarationRequest: the controls the declaration covers and an optional statement |
filesrequired | file | One or more files |
Responses
201Declaration
attachmentscore.AssessmentAttachment[]Show properties
Array of
core.AssessmentAttachmentcidstringurn:cid of the bytes, registered with the Integrity Service
contentTypestringfileNamestringidintegerThe file, for its assessment's declaration file routes
sizeBytesinteger
controlsstring[]The control codes it covers, in the program's order
documentCidstringread-onlyurn:cid of the declaration document the Integrity Service stored
statementstringstatementIdstringread-onlyurn:cid of the governance statement it registered as
submittedAtstring<date-time>read-onlysubmittedBystringread-onlysubmittedByDidstringread-onlysubmittedByUserIdstringread-onlyuuidstringread-onlyurn:uuid form
{
"attachments": [
{
"cid": "string",
"contentType": "string",
"fileName": "string",
"id": 0,
"sizeBytes": 0
}
],
"controls": [
"string"
],
"documentCid": "string",
"statement": "string",
"statementId": "string",
"submittedAt": "2025-01-01T00:00:00Z",
"submittedBy": "string",
"submittedByDid": "string",
"submittedByUserId": "string",
"uuid": "string"
}400Bad request - Invalid request, no files, or no control of the program covered
errorstring
{
"error": "Invalid request body"
}401Unauthorized - Authentication required
errorstring
{
"error": "Invalid request body"
}403Forbidden - Not the assessment's starter, an API key with neither full access nor submit_agent_assessments, or a project-bound key
errorstring
{
"error": "Invalid request body"
}404Assessment not found
errorstring
{
"error": "Invalid request body"
}500Internal server error
errorstring
{
"error": "Invalid request body"
}