Skip to content
Governance Platform

Create declaration with attachment

POST
/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/declarations/with-file
 
curl --request POST \
  --url https://localhost:10001/api/v1/projects/example/policies/example/controls/example/declarations/with-file \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: multipart/form-data' \
  --form declaration=example

Create a declaration on a control with file attachment(s) and return the declaration with stored attachments

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
projectId
required
string

Project ID, UUID (urn:uuid optional), or slug:my-project

appliedPolicyId
required
string

Applied policy ID, slug:my-policy, or urn:cid:bafy…

appliedPolicyControlId
required
string

Applied policy control ID, code:AC-1, or urn:cid:bafy…

FormData Parameters

Section titled “FormData Parameters ”
declaration
required
string

Declaration JSON string

files
file

Attachment files

description
string

Attachment description

isPublic
string

Whether the file is public

retentionPeriod
string

Retention policy

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Created declaration with attachments

Media type application/json

A newly created declaration together with the attachments uploaded alongside it

object
attachments
Array<object>

A file stored against a declaration or review, with its CID and retention window

object
cid
string
contentType
string
declarationId
integer
description
string
fileName
string
id
integer
isPublic
boolean
retentionExpires
string format: date-time
reviewId
integer
sizeBytes
integer
storagePath
string
uploadedAt
string format: date-time
uploadedBy
string
uploadedByDid

Verifiable actor; uploadedBy is the label

string
declaration

A submitted claim that a control has been implemented, optionally attested by a CID

object
appliedPolicyControlId

Taken from the path on create

integer
attachmentCid

Derived from the uploaded bytes; not stored

Array<string>
cid

Assigned by the integrity service

string
createdAt
string format: date-time
extra

Hashed into the CID; not stored

object
key
additional properties
string
fileAttachments

Upload via the with-file endpoint

Array<object>

A file stored against a declaration or review, with its CID and retention window

object
cid
string
contentType
string
declarationId
integer
description
string
fileName
string
id
integer
isPublic
boolean
retentionExpires
string format: date-time
reviewId
integer
sizeBytes
integer
storagePath
string
uploadedAt
string format: date-time
uploadedBy
string
uploadedByDid

Verifiable actor; uploadedBy is the label

string
id
integer
isAutomated

True for indicator-generated only

boolean
isReadyForReview

Needs submit_controls_for_review

boolean
statement
string
subjectLine
string
submittedAt
string format: date-time
submittedBy

Defaults to the caller identity

string
submittedByDid

Verifiable actor; submittedBy is the label

string
updatedAt
string format: date-time
Example generated
{
  "attachments": [
    {
      "cid": "example",
      "contentType": "example",
      "declarationId": 1,
      "description": "example",
      "fileName": "example",
      "id": 1,
      "isPublic": true,
      "retentionExpires": "2026-04-15T12:00:00Z",
      "reviewId": 1,
      "sizeBytes": 1,
      "storagePath": "example",
      "uploadedAt": "2026-04-15T12:00:00Z",
      "uploadedBy": "example"
    }
  ],
  "declaration": {
    "extra": {
      "additionalProperty": "example"
    },
    "isReadyForReview": true,
    "statement": "example",
    "subjectLine": "example",
    "submittedBy": "example"
  }
}

400

Section titled “400 ”

Bad request - Invalid IDs or declaration data

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object
error
string
Example 
{
  "error": "Invalid request body"
}

401

Section titled “401 ”

Unauthorized - Authentication required

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object
error
string
Example 
{
  "error": "Invalid request body"
}

403

Section titled “403 ”

Forbidden - Insufficient permissions to create declarations

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object
error
string
Example 
{
  "error": "Invalid request body"
}

404

Section titled “404 ”

Not found - Unknown or mismatched identifier

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object
error
string
Example 
{
  "error": "Invalid request body"
}

500

Section titled “500 ”

Internal server error

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object
error
string
Example 
{
  "error": "Invalid request body"
}