EQTY LabDocs

Create declaration with attachment

Create a declaration on a control with file attachment(s) and return the declaration with stored attachments

posthttps://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file
bash
curl --request POST \
  --url 'https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file' \
  --header 'Authorization: Bearer <token>' \
  --form 'declaration=<declaration>' \
  --form 'files=@<file>' \
  --form 'description=<description>' \
  --form 'isPublic=<isPublic>' \
  --form 'retentionPeriod=<retentionPeriod>'
javascript
const form = new FormData();
form.append("declaration", "<declaration>");
form.append("files", file); // a File or Blob
form.append("description", "<description>");
form.append("isPublic", "<isPublic>");
form.append("retentionPeriod", "<retentionPeriod>");

const response = await fetch("https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>"
  },
  body: form
});

const data = await response.json();
typescript
declare const file: Blob;

interface DeclarationWithAttachmentsResponse {
  attachments?: Record<string, unknown>[];
  declaration?: Record<string, unknown>;
}

const form = new FormData();
form.append("declaration", "<declaration>");
form.append("files", file); // a File or Blob
form.append("description", "<description>");
form.append("isPublic", "<isPublic>");
form.append("retentionPeriod", "<retentionPeriod>");

const response = await fetch("https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>"
  },
  body: form
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: DeclarationWithAttachmentsResponse = await response.json();
python
import requests

response = requests.post(
    "https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file",
    headers={
        "Authorization": "Bearer <token>",
    },
    data={
        "declaration": "<declaration>",
        "description": "<description>",
        "isPublic": "<isPublic>",
        "retentionPeriod": "<retentionPeriod>",
    },
    files={"files": open("<file>", "rb")},
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"bytes"
	"fmt"
	"io"
	"mime/multipart"
	"net/http"
	"os"
	"path/filepath"
)

func main() {
	var body bytes.Buffer
	form := multipart.NewWriter(&body)
	if err := form.WriteField("declaration", "<declaration>"); err != nil {
		panic(err)
	}
	file, err := os.Open("<file>")
	if err != nil {
		panic(err)
	}
	defer file.Close()
	part, err := form.CreateFormFile("files", filepath.Base(file.Name()))
	if err != nil {
		panic(err)
	}
	if _, err := io.Copy(part, file); err != nil {
		panic(err)
	}
	if err := form.WriteField("description", "<description>"); err != nil {
		panic(err)
	}
	if err := form.WriteField("isPublic", "<isPublic>"); err != nil {
		panic(err)
	}
	if err := form.WriteField("retentionPeriod", "<retentionPeriod>"); err != nil {
		panic(err)
	}
	if err := form.Close(); err != nil {
		panic(err)
	}

	req, err := http.NewRequest(http.MethodPost, "https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file", &body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")
	req.Header.Set("Content-Type", form.FormDataContentType())

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.io.ByteArrayOutputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;

public class Example {
    public static void main(String[] args) throws Exception {
        String boundary = "GuardianBoundary" + System.nanoTime();
        ByteArrayOutputStream form = new ByteArrayOutputStream();
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"declaration\"\r\n\r\n<declaration>\r\n").getBytes(StandardCharsets.UTF_8));
        Path file = Path.of("<file>");
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"files\"; filename=\"" + file.getFileName() + "\"\r\n\r\n").getBytes(StandardCharsets.UTF_8));
        form.writeBytes(Files.readAllBytes(file));
        form.writeBytes("\r\n".getBytes(StandardCharsets.UTF_8));
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"description\"\r\n\r\n<description>\r\n").getBytes(StandardCharsets.UTF_8));
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"isPublic\"\r\n\r\n<isPublic>\r\n").getBytes(StandardCharsets.UTF_8));
        form.writeBytes(("--" + boundary + "\r\nContent-Disposition: form-data; name=\"retentionPeriod\"\r\n\r\n<retentionPeriod>\r\n").getBytes(StandardCharsets.UTF_8));
        form.writeBytes(("--" + boundary + "--\r\n").getBytes(StandardCharsets.UTF_8));

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file"))
            .header("Authorization", "Bearer <token>")
            .header("Content-Type", "multipart/form-data; boundary=" + boundary)
            .method("POST", HttpRequest.BodyPublishers.ofByteArray(form.toByteArray()))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
using var form = new MultipartFormDataContent();
form.Add(new StringContent("<declaration>"), "declaration");
form.Add(new StreamContent(File.OpenRead("<file>")), "files", Path.GetFileName("<file>"));
form.Add(new StringContent("<description>"), "description");
form.Add(new StringContent("<isPublic>"), "isPublic");
form.Add(new StringContent("<retentionPeriod>"), "retentionPeriod");
request.Content = form;

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
    ],
    CURLOPT_POSTFIELDS => [
        'declaration' => '<declaration>',
        'files' => new CURLFile('<file>'),
        'description' => '<description>',
        'isPublic' => '<isPublic>',
        'retentionPeriod' => '<retentionPeriod>',
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request.set_form([
  ["declaration", "<declaration>"],
  ["files", File.open("<file>")],
  ["description", "<description>"],
  ["isPublic", "<isPublic>"],
  ["retentionPeriod", "<retentionPeriod>"],
], "multipart/form-data")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest (features "multipart"), tokio (features "full")

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let form = reqwest::multipart::Form::new()
        .text("declaration", "<declaration>")
        .part("files", reqwest::multipart::Part::bytes(std::fs::read("<file>")?).file_name("<file>"))
        .text("description", "<description>")
        .text("isPublic", "<isPublic>")
        .text("retentionPeriod", "<retentionPeriod>");

    let response = reqwest::Client::new()
        .post("https://localhost:10001/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file")
        .header("Authorization", "Bearer <token>")
        .multipart(form)
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · API key in header "Authorization" — Type "Bearer" followed by a space and JWT token.

Parameters

Path parameters

NameTypeDescription
projectId
required
string

Project ID, UUID (urn:uuid optional), or slug:my-project

appliedPolicyId
required
string

Applied policy ID, slug:my-policy, or urn:cid:bafy...

appliedPolicyControlId
required
string

Applied policy control ID, code:AC-1, or urn:cid:bafy...

Form parameters

NameTypeDescription
declaration
required
string

Declaration JSON string

filesfile

Attachment files

descriptionstring

Attachment description

isPublicstring

Whether the file is public

retentionPeriodstring

Retention policy

Responses

201Created declaration with attachments

application/json
  • attachmentscore.FileAttachment[]
    Show properties

    Array of core.FileAttachment

    • assessmentDeclarationIdinteger

      AssessmentDeclarationID is set instead when the file belongs to an agent assessment's declaration

    • cidstring
    • contentTypestring
    • declarationIdinteger
    • descriptionstring
    • fileNamestring
    • idinteger
    • isPublicboolean
    • retentionExpiresstring<date-time>
    • reviewIdinteger
    • sizeBytesinteger
    • storagePathstring
    • uploadedAtstring<date-time>
    • uploadedBystring
    • uploadedByDidstringread-only

      Verifiable actor; uploadedBy is the label

  • declarationcore.Declaration

    A submitted claim that a control has been implemented, optionally attested by a CID

    Show core.Declaration
    • appliedPolicyControlIdintegerread-only

      Taken from the path on create

    • attachmentCidstring[]read-only

      Derived from the uploaded bytes; not stored

    • cidstringread-only

      Assigned by the Integrity Service

    • createdAtstring<date-time>read-only
    • extraobject

      Hashed into the CID; not stored

      Show properties

      Map of string

    • fileAttachmentscore.FileAttachment[]read-only

      Upload via the with-file endpoint

      Show properties

      Array of core.FileAttachment

      • assessmentDeclarationIdinteger

        AssessmentDeclarationID is set instead when the file belongs to an agent assessment's declaration

      • cidstring
      • contentTypestring
      • declarationIdinteger
      • descriptionstring
      • fileNamestring
      • idinteger
      • isPublicboolean
      • retentionExpiresstring<date-time>
      • reviewIdinteger
      • sizeBytesinteger
      • storagePathstring
      • uploadedAtstring<date-time>
      • uploadedBystring
      • uploadedByDidstringread-only

        Verifiable actor; uploadedBy is the label

    • idintegerread-only
    • isAutomatedbooleanread-only

      True for indicator-generated only

    • isReadyForReviewboolean

      Needs submit_controls_for_review

    • statementstring
    • subjectLinestring
    • submittedAtstring<date-time>read-only
    • submittedBystring

      Defaults to the caller identity

    • submittedByDidstringread-only

      Verifiable actor; submittedBy is the label

    • updatedAtstring<date-time>read-only
Examplejson
{
  "attachments": [
    {
      "assessmentDeclarationId": 0,
      "cid": "string",
      "contentType": "string",
      "declarationId": 0,
      "description": "string",
      "fileName": "string",
      "id": 0,
      "isPublic": true,
      "retentionExpires": "2025-01-01T00:00:00Z",
      "reviewId": 0,
      "sizeBytes": 0,
      "storagePath": "string",
      "uploadedAt": "2025-01-01T00:00:00Z",
      "uploadedBy": "string"
    }
  ],
  "declaration": {
    "extra": {
      "key": "string"
    },
    "isReadyForReview": true,
    "statement": "string",
    "subjectLine": "string",
    "submittedBy": "string"
  }
}

400Bad request - Invalid IDs or declaration data

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

401Unauthorized - Authentication required

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

403Forbidden - Insufficient permissions to create declarations

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

404Not found - Unknown or mismatched identifier

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}

500Internal server error

application/json
  • errorstring
Examplejson
{
  "error": "Invalid request body"
}