Get an assessment's draft
Report an assessment's current draft: its declarations, whether a configuration and an operating profile are pinned, and control by control in the program's order, the declarations covering it, the configuration fields it is judged against and whether the pinned configuration captured them, the operating profile sections it is judged against, any not-applicable claim and whether the draft addresses it, and what blocks submitting it. Readable by whoever may read the assessment
https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draftcurl --request GET \
--url 'https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft' \
--header 'Authorization: Bearer <token>'const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft", {
method: "GET",
headers: {
"Authorization": "Bearer <token>"
}
});
const data = await response.json();interface AssessmentDraft {
blockers?: string[];
configurationPinned?: boolean;
controls?: Record<string, unknown>[];
declarations?: Record<string, unknown>[];
draftVersion?: number;
pins?: Record<string, unknown>[];
profilePinned?: boolean;
readyToSubmit?: boolean;
}
const response = await fetch("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft", {
method: "GET",
headers: {
"Authorization": "Bearer <token>"
}
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
const data: AssessmentDraft = await response.json();import requests
response = requests.get(
"https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft",
headers={
"Authorization": "Bearer <token>",
},
)
response.raise_for_status()
print(response.json())package main
import (
"fmt"
"io"
"net/http"
)
func main() {
req, err := http.NewRequest(http.MethodGet, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft", nil)
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <token>")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
data, err := io.ReadAll(res.Body)
if err != nil {
panic(err)
}
fmt.Println(res.Status, string(data))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft"))
.header("Authorization", "Bearer <token>")
.method("GET", HttpRequest.BodyPublishers.noBody())
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using System.Net.Http.Headers;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");<?php
$ch = curl_init('https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'GET',
CURLOPT_HTTPHEADER => [
'Authorization: Bearer <token>',
],
CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;require "net/http"
uri = URI("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer <token>"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
http.request(request)
end
puts "#{response.code} #{response.body}"// Cargo.toml dependencies: reqwest, tokio (features "full")
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let response = reqwest::Client::new()
.get("https://localhost:10001/api/v1/organizations/{orgId}/assessments/{assessmentId}/draft")
.header("Authorization", "Bearer <token>")
.send()
.await?;
println!("{} {}", response.status(), response.text().await?);
Ok(())
}Authorizations
BearerAuth· API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.
Parameters
Path parameters
| Name | Type | Description |
|---|---|---|
orgIdrequired | string | Organization ID or UUID (urn:uuid optional) |
assessmentIdrequired | string | Assessment UUID (urn:uuid optional) |
Responses
200Draft
blockersstring[]Why it cannot be submitted yet, empty when it can
configurationPinnedbooleancontrolscore.AssessmentDraftControl[]Show properties
Array of
core.AssessmentDraftControladdressedbooleanWhether the draft addresses it: by a covering declaration, a not-applicable claim, or, for a control that expects no evidence, what is pinned. False for each control the blockers name as having no declaration and no not-applicable claim
configurationcore.AssessmentDraftConfigurationField[]Each configuration field the control judges, in the program's order
Show properties
Array of
core.AssessmentDraftConfigurationFieldcapturedbooleanAbsent until a configuration is pinned
fieldobjectOne of
appconfigFilesdefinitionmcpServersmodelpermissionsskillssystemPrompttoolsShow properties
object (enum)· one of app, configFiles, definition, mcpServers, model, permissions, skills, systemPrompt, tools
controlCodestringdeclarationsstring[]urn:uuid of each declaration covering it
notApplicableobjectSet while the control is claimed not applicable
Show properties
controlCodestringjustificationstringsubmittedAtstring<date-time>submittedBystringsubmittedByDidstringsubmittedByUserIdstring
profilecore.ProfileSection[]Each operating profile section the control judges, in the program's order; a pinned profile holds every section
declarationscore.AssessmentDeclaration[]The draft's declarations, oldest first
Show properties
Array of
core.AssessmentDeclarationattachmentscore.AssessmentAttachment[]Show properties
Array of
core.AssessmentAttachmentcidstringurn:cid of the bytes, registered with the Integrity Service
contentTypestringfileNamestringidintegerThe file, for its assessment's declaration file routes
sizeBytesinteger
controlsstring[]The control codes it covers, in the program's order
documentCidstringread-onlyurn:cid of the declaration document the Integrity Service stored
statementstringstatementIdstringread-onlyurn:cid of the governance statement it registered as
submittedAtstring<date-time>read-onlysubmittedBystringread-onlysubmittedByDidstringread-onlysubmittedByUserIdstringread-onlyuuidstringread-onlyurn:uuid form
draftVersionintegerpinscore.AssessmentPin[]Each pin and unpin made since the newest submission, or since the start, oldest first
Show properties
Array of
core.AssessmentPincidstringurn:cid of what was pinned; absent when the profile was unpinned
documentobjectThe configuration or profile document pinned; absent when the profile was unpinned
draftVersionintegerThe draft version the pin made, which orders pins and places each in the submission that froze it
kindobjectOne of
configurationprofileShow properties
object (enum)· one of configuration, profilepinnedAtstring<date-time>pinnedBystringWho pinned it, as the assessment names its starter
pinnedByUserIdstringAbsent on a pin recorded before it was
profileVersionintegerThe agent's version number of a pinned profile
requestobjectThe request a pinned configuration was seen with, evidence its CID doesn't cover
Show properties
modelstringproviderstringsystemPromptCidstringtoolsstring[]
profilePinnedbooleanreadyToSubmitboolean
{
"blockers": [
"string"
],
"configurationPinned": true,
"controls": [
{
"addressed": true,
"configuration": [
{
"captured": true,
"field": "app"
}
],
"controlCode": "string",
"declarations": [
"string"
],
"notApplicable": {
"controlCode": "string",
"justification": "string",
"submittedAt": "2025-01-01T00:00:00Z",
"submittedBy": "string",
"submittedByDid": "string",
"submittedByUserId": "string"
},
"profile": [
"purpose"
]
}
],
"declarations": [
{
"attachments": [
{
"cid": "string",
"contentType": "string",
"fileName": "string",
"id": 0,
"sizeBytes": 0
}
],
"controls": [
"string"
],
"statement": "string"
}
],
"draftVersion": 0,
"pins": [
{
"cid": "string",
"document": {},
"draftVersion": 0,
"kind": "configuration",
"pinnedAt": "2025-01-01T00:00:00Z",
"pinnedBy": "string",
"pinnedByUserId": "string",
"profileVersion": 0,
"request": {
"model": "string",
"provider": "string",
"systemPromptCid": "string",
"tools": [
"string"
]
}
}
],
"profilePinned": true,
"readyToSubmit": true
}400Bad request - Invalid organization ID or assessment ID
errorstring
{
"error": "Invalid request body"
}401Unauthorized - Authentication required
errorstring
{
"error": "Invalid request body"
}403Forbidden - No organization access
errorstring
{
"error": "Invalid request body"
}404Assessment not found, or not readable by the caller
errorstring
{
"error": "Invalid request body"
}500Internal server error
errorstring
{
"error": "Invalid request body"
}