EQTY LabDocs

Declare with files how an agent meets assessment controls

Add a declaration with one or more files, and optionally a statement, to an assessment's draft, as a project declaration is made with its files, covering the controls it names. Each file's bytes are registered with the Integrity Service for their CID and stored with the assessment; read them through the declaration's files/{attachmentId}/url and /download routes, which apply the assessment's access rules, not the generic attachment endpoints. The declaration is registered as a governance statement in the assessment's graph, signed by the caller. Declarations are never changed: remove one and add another. A submission keeps the declarations it froze. Only the member who started the assessment may declare; an integration's API key bound to no project acts as its owner with full access or the submit_agent_assessments scope

posthttps://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file
bash
curl --request POST \
  --url 'https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file' \
  --header 'Authorization: Bearer <token>' \
  --form 'declaration=<declaration>' \
  --form 'files=@<file>'
javascript
const form = new FormData();
form.append("declaration", "<declaration>");
form.append("files", file); // a File or Blob

const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>"
  },
  body: form
});

const data = await response.json();
typescript
declare const file: Blob;

interface AssessmentDeclaration {
  attachments?: Record<string, unknown>[];
  controls?: string[];
  documentCid?: string;
  statement?: string;
  statementId?: string;
  submittedAt?: string;
  submittedBy?: string;
  submittedByDid?: string;
  submittedByUserId?: string;
  uuid?: string;
}

const form = new FormData();
form.append("declaration", "<declaration>");
form.append("files", file); // a File or Blob

const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>"
  },
  body: form
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: AssessmentDeclaration = await response.json();
python
import requests

response = requests.post(
    "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file",
    headers={
        "Authorization": "Bearer <token>",
    },
    data={
        "declaration": "<declaration>",
    },
    files={"files": open("<file>", "rb")},
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"bytes"
	"fmt"
	"io"
	"mime/multipart"
	"net/http"
	"os"
	"path/filepath"
)

func main() {
	var body bytes.Buffer
	form := multipart.NewWriter(&body)
	if err := form.WriteField("declaration", "<declaration>"); err != nil {
		panic(err)
	}
	file, err := os.Open("<file>")
	if err != nil {
		panic(err)
	}
	defer file.Close()
	part, err := form.CreateFormFile("files", filepath.Base(file.Name()))
	if err != nil {
		panic(err)
	}
	if _, err := io.Copy(part, file); err != nil {
		panic(err)
	}
	if err := form.Close(); err != nil {
		panic(err)
	}

	req, err := http.NewRequest(http.MethodPost, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file", &body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")
	req.Header.Set("Content-Type", form.FormDataContentType())

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.io.ByteArrayOutputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;

public class Example {
    public static void main(String[] args) throws Exception {
        String boundary = "GuardianBoundary" + System.nanoTime();
        ByteArrayOutputStream form = new ByteArrayOutputStream();
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"declaration\"\r\n\r\n<declaration>\r\n").getBytes(StandardCharsets.UTF_8));
        Path file = Path.of("<file>");
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"files\"; filename=\"" + file.getFileName() + "\"\r\n\r\n").getBytes(StandardCharsets.UTF_8));
        form.writeBytes(Files.readAllBytes(file));
        form.writeBytes("\r\n".getBytes(StandardCharsets.UTF_8));
        form.writeBytes(("--" + boundary + "--\r\n").getBytes(StandardCharsets.UTF_8));

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file"))
            .header("Authorization", "Bearer <token>")
            .header("Content-Type", "multipart/form-data; boundary=" + boundary)
            .method("POST", HttpRequest.BodyPublishers.ofByteArray(form.toByteArray()))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
using var form = new MultipartFormDataContent();
form.Add(new StringContent("<declaration>"), "declaration");
form.Add(new StreamContent(File.OpenRead("<file>")), "files", Path.GetFileName("<file>"));
request.Content = form;

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
    ],
    CURLOPT_POSTFIELDS => [
        'declaration' => '<declaration>',
        'files' => new CURLFile('<file>'),
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request.set_form([
  ["declaration", "<declaration>"],
  ["files", File.open("<file>")],
], "multipart/form-data")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest (features "multipart"), tokio (features "full")

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let form = reqwest::multipart::Form::new()
        .text("declaration", "<declaration>")
        .part("files", reqwest::multipart::Part::bytes(std::fs::read("<file>")?).file_name("<file>"));

    let response = reqwest::Client::new()
        .post("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/declarations/with-file")
        .header("Authorization", "Bearer <token>")
        .multipart(form)
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.

Parameters

Path parameters

NameTypeDescription
orgId
required
string

Organization ID or UUID (urn:uuid optional)

assessmentId
required
string

Assessment UUID (urn:uuid optional)

Form parameters

NameTypeDescription
declaration
required
string

JSON AddDeclarationRequest: the controls the declaration covers and an optional statement

files
required
file

One or more files

Responses

201Declaration

application/json
  • attachmentscore.AssessmentAttachment[]
    Show properties

    Array of core.AssessmentAttachment

    • cidstring

      urn:cid of the bytes, registered with the Integrity Service

    • contentTypestring
    • fileNamestring
    • idinteger

      The file, for its assessment's declaration file routes

    • sizeBytesinteger
  • controlsstring[]

    The control codes it covers, in the program's order

  • documentCidstringread-only

    urn:cid of the declaration document the Integrity Service stored

  • statementstring
  • statementIdstringread-only

    urn:cid of the governance statement it registered as

  • submittedAtstring<date-time>read-only
  • submittedBystringread-only
  • submittedByDidstringread-only
  • submittedByUserIdstringread-only
  • uuidstringread-only

    urn:uuid form

Examplejson
{
  "attachments": [
    {
      "cid": "string",
      "contentType": "string",
      "fileName": "string",
      "id": 0,
      "sizeBytes": 0
    }
  ],
  "controls": [
    "string"
  ],
  "documentCid": "string",
  "statement": "string",
  "statementId": "string",
  "submittedAt": "2025-01-01T00:00:00Z",
  "submittedBy": "string",
  "submittedByDid": "string",
  "submittedByUserId": "string",
  "uuid": "string"
}

400Bad request - Invalid request, no files, or no control of the program covered

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

401Unauthorized - Authentication required

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

403Forbidden - Not the assessment's starter, an API key with neither full access nor submit_agent_assessments, or a project-bound key

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

404Assessment not found

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

500Internal server error

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}