EQTY LabDocs

Get an assessment's draft

Report an assessment's current draft: its declarations, whether a configuration and an operating profile are pinned, and control by control in the program's order, the declarations covering it, the configuration fields it is judged against and whether the pinned configuration captured them, the operating profile sections it is judged against, any not-applicable claim and whether the draft addresses it, and what blocks submitting it. Readable by whoever may read the assessment

gethttps://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft
bash
curl --request GET \
  --url 'https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft' \
  --header 'Authorization: Bearer <token>'
javascript
const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});

const data = await response.json();
typescript
interface AssessmentDraft {
  blockers?: string[];
  configurationPinned?: boolean;
  controls?: Record<string, unknown>[];
  declarations?: Record<string, unknown>[];
  draftVersion?: number;
  pins?: Record<string, unknown>[];
  profilePinned?: boolean;
  readyToSubmit?: boolean;
}

const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  }
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: AssessmentDraft = await response.json();
python
import requests

response = requests.get(
    "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft",
    headers={
        "Authorization": "Bearer <token>",
    },
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft"))
            .header("Authorization", "Bearer <token>")
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer <token>"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest, tokio (features "full")

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let response = reqwest::Client::new()
        .get("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft")
        .header("Authorization", "Bearer <token>")
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.

Parameters

Path parameters

NameTypeDescription
orgId
required
string

Organization ID or UUID (urn:uuid optional)

assessmentId
required
string

Assessment UUID (urn:uuid optional)

Responses

200Draft

application/json
  • blockersstring[]

    Why it cannot be submitted yet, empty when it can

  • configurationPinnedboolean
  • controlscore.AssessmentDraftControl[]
    Show properties

    Array of core.AssessmentDraftControl

    • addressedboolean

      Whether the draft addresses it: by a covering declaration, a not-applicable claim, or, for a control that expects no evidence, what is pinned. False for each control the blockers name as having no declaration and no not-applicable claim

    • configurationcore.AssessmentDraftConfigurationField[]

      Each configuration field the control judges, in the program's order

      Show properties

      Array of core.AssessmentDraftConfigurationField

      • capturedboolean

        Absent until a configuration is pinned

      • fieldobject

        One ofappconfigFilesdefinitionmcpServersmodelpermissionsskillssystemPrompttools

        Show properties

        object (enum) · one of app, configFiles, definition, mcpServers, model, permissions, skills, systemPrompt, tools

    • controlCodestring
    • declarationsstring[]

      urn:uuid of each declaration covering it

    • notApplicableobject

      Set while the control is claimed not applicable

      Show properties
      • controlCodestring
      • justificationstring
      • submittedAtstring<date-time>
      • submittedBystring
      • submittedByDidstring
      • submittedByUserIdstring
    • profilecore.ProfileSection[]

      Each operating profile section the control judges, in the program's order; a pinned profile holds every section

  • declarationscore.AssessmentDeclaration[]

    The draft's declarations, oldest first

    Show properties

    Array of core.AssessmentDeclaration

    • attachmentscore.AssessmentAttachment[]
      Show properties

      Array of core.AssessmentAttachment

      • cidstring

        urn:cid of the bytes, registered with the Integrity Service

      • contentTypestring
      • fileNamestring
      • idinteger

        The file, for its assessment's declaration file routes

      • sizeBytesinteger
    • controlsstring[]

      The control codes it covers, in the program's order

    • documentCidstringread-only

      urn:cid of the declaration document the Integrity Service stored

    • statementstring
    • statementIdstringread-only

      urn:cid of the governance statement it registered as

    • submittedAtstring<date-time>read-only
    • submittedBystringread-only
    • submittedByDidstringread-only
    • submittedByUserIdstringread-only
    • uuidstringread-only

      urn:uuid form

  • draftVersioninteger
  • pinscore.AssessmentPin[]

    Each pin and unpin made since the newest submission, or since the start, oldest first

    Show properties

    Array of core.AssessmentPin

    • cidstring

      urn:cid of what was pinned; absent when the profile was unpinned

    • documentobject

      The configuration or profile document pinned; absent when the profile was unpinned

    • draftVersioninteger

      The draft version the pin made, which orders pins and places each in the submission that froze it

    • kindobject

      One ofconfigurationprofile

      Show properties

      object (enum) · one of configuration, profile

    • pinnedAtstring<date-time>
    • pinnedBystring

      Who pinned it, as the assessment names its starter

    • pinnedByUserIdstring

      Absent on a pin recorded before it was

    • profileVersioninteger

      The agent's version number of a pinned profile

    • requestobject

      The request a pinned configuration was seen with, evidence its CID doesn't cover

      Show properties
      • modelstring
      • providerstring
      • systemPromptCidstring
      • toolsstring[]
  • profilePinnedboolean
  • readyToSubmitboolean
Examplejson
{
  "blockers": [
    "string"
  ],
  "configurationPinned": true,
  "controls": [
    {
      "addressed": true,
      "configuration": [
        {
          "captured": true,
          "field": "app"
        }
      ],
      "controlCode": "string",
      "declarations": [
        "string"
      ],
      "notApplicable": {
        "controlCode": "string",
        "justification": "string",
        "submittedAt": "2025-01-01T00:00:00Z",
        "submittedBy": "string",
        "submittedByDid": "string",
        "submittedByUserId": "string"
      },
      "profile": [
        "purpose"
      ]
    }
  ],
  "declarations": [
    {
      "attachments": [
        {
          "cid": "string",
          "contentType": "string",
          "fileName": "string",
          "id": 0,
          "sizeBytes": 0
        }
      ],
      "controls": [
        "string"
      ],
      "statement": "string"
    }
  ],
  "draftVersion": 0,
  "pins": [
    {
      "cid": "string",
      "document": {},
      "draftVersion": 0,
      "kind": "configuration",
      "pinnedAt": "2025-01-01T00:00:00Z",
      "pinnedBy": "string",
      "pinnedByUserId": "string",
      "profileVersion": 0,
      "request": {
        "model": "string",
        "provider": "string",
        "systemPromptCid": "string",
        "tools": [
          "string"
        ]
      }
    }
  ],
  "profilePinned": true,
  "readyToSubmit": true
}

400Bad request - Invalid organization ID or assessment ID

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

401Unauthorized - Authentication required

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

403Forbidden - No organization access

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

404Assessment not found, or not readable by the caller

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

500Internal server error

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}