Create review

POST

/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/reviews

curl --request POST \
  --url https://localhost:10001/api/v1/projects/example/policies/example/controls/example/reviews \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "commentType": "GENERAL", "extra": { "additionalProperty": "example" }, "outcome": "NON_COMPLIANT", "statement": "example", "subjectLine": "example", "submittedBy": "example" }'

Submit a review for a specific control and return the persisted record

Authorizations

• BearerAuth

Parameters

Path Parameters

projectId

required

string

Project ID, UUID (urn:uuid optional), or slug:my-project

appliedPolicyId

required

string

Applied policy ID, slug:my-policy, or urn:cid:bafy…

appliedPolicyControlId

required

string

Applied policy control ID, code:AC-1, or urn:cid:bafy…

Request Body

Review data

Media type application/json

object

commentType

Only used when outcome is COMMENT

string

Allowed values: GENERAL ACCEPTED QUESTIONED

extra

Hashed into the CID; not stored

object

key

additional properties

string

outcome

required

string

Allowed values: NON_COMPLIANT NOT_APPLICABLE COMPLIANT COMMENT

statement

string

subjectLine

string

submittedBy

Defaults to the caller identity

string

Responses

201

Created review

Media type application/json

A reviewer’s verdict on a control, recording the outcome and any supporting evidence

object

appliedPolicyControlId

Taken from the path on create

integer

attachmentCid

Derived from the uploaded bytes; not stored

Array<string>

cid

Assigned by the integrity service

string

commentType

Only used when outcome is COMMENT

string

Allowed values: GENERAL ACCEPTED QUESTIONED

createdAt

string format: date-time

extra

Hashed into the CID; not stored

object

key

additional properties

string

fileAttachments

Upload via the with-file endpoint

Array<object>

A file stored against a declaration or review, with its CID and retention window

object

cid

string

contentType

string

declarationId

integer

description

string

fileName

string

id

integer

isPublic

boolean

retentionExpires

string format: date-time

reviewId

integer

sizeBytes

integer

storagePath

string

uploadedAt

string format: date-time

uploadedBy

string

uploadedByDid

Verifiable actor; uploadedBy is the label

string

id

integer

outcome

string

Allowed values: NON_COMPLIANT NOT_APPLICABLE COMPLIANT COMMENT

statement

string

subjectLine

string

submittedAt

string format: date-time

submittedBy

Defaults to the caller identity

string

submittedByDid

Verifiable actor; submittedBy is the label

string

updatedAt

string format: date-time

Example

{
  "commentType": "GENERAL",
  "outcome": "NON_COMPLIANT"
}

400

Bad request - Invalid IDs or request body

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

401

Unauthorized - Authentication required

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

403

Forbidden - Insufficient permissions for this review outcome

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

404

No matching control found in applied policy

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

500

Internal server error

Media type application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}