Create review with attachment

POST

/api/v1/projects/{projectId}/policies/{appliedPolicyId}/controls/{appliedPolicyControlId}/reviews/with-file

const url = 'https://localhost:10001/api/v1/projects/example/policies/example/controls/example/reviews/with-file';
const form = new FormData();
form.append('review', 'example');

const options = {method: 'POST', headers: {Authorization: '<Authorization>'}};

options.body = form;

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://localhost:10001/api/v1/projects/example/policies/example/controls/example/reviews/with-file \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: multipart/form-data' \
  --form review=example

Submit a review for a specific control with file attachment(s) and return the review with stored attachments

Authorizations

BearerAuth

Parameters

Path Parameters

projectId

required

string

Project ID, UUID (urn:uuid optional), or slug:my-project

appliedPolicyId

required

string

Applied policy ID, slug:my-policy, or urn:cid:bafy…

appliedPolicyControlId

required

string

Applied policy control ID, code:AC-1, or urn:cid:bafy…

FormData Parameters

review

required

string

Review JSON string

files

file

Attachment files

description

string

Attachment description

isPublic

string

Whether the file is public

retentionPeriod

string

Retention policy

Responses

201

Created review with attachments

application/json

A newly created review together with the attachments uploaded alongside it

object

attachments

Array<object>

A file stored against a declaration or review, with its CID and retention window

object

cid

string

contentType

string

declarationId

integer

description

string

fileName

string

integer

isPublic

boolean

retentionExpires

string format: date-time

reviewId

integer

sizeBytes

integer

storagePath

string

uploadedAt

string format: date-time

uploadedBy

string

uploadedByDid

Verifiable actor; uploadedBy is the label

string

review

A reviewer’s verdict on a control, recording the outcome and any supporting evidence

object

appliedPolicyControlId

Taken from the path on create

integer

attachmentCid

Derived from the uploaded bytes; not stored

Array<string>

cid

Assigned by the integrity service

string

commentType

Only used when outcome is COMMENT

string

Allowed values: GENERAL ACCEPTED QUESTIONED

createdAt

string format: date-time

extra

Hashed into the CID; not stored

object

key

additional properties

string

fileAttachments

Upload via the with-file endpoint

Array<object>

A file stored against a declaration or review, with its CID and retention window

object

cid

string

contentType

string

declarationId

integer

description

string

fileName

string

integer

isPublic

boolean

retentionExpires

string format: date-time

reviewId

integer

sizeBytes

integer

storagePath

string

uploadedAt

string format: date-time

uploadedBy

string

uploadedByDid

Verifiable actor; uploadedBy is the label

string

integer

outcome

string

Allowed values: NON_COMPLIANT NOT_APPLICABLE COMPLIANT COMMENT

statement

string

subjectLine

string

submittedAt

string format: date-time

submittedBy

Defaults to the caller identity

string

submittedByDid

Verifiable actor; submittedBy is the label

string

updatedAt

string format: date-time

Example

{
  "review": {
    "commentType": "GENERAL",
    "outcome": "NON_COMPLIANT"
  }
}

400

Bad request - Invalid IDs or review data

application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

401

Unauthorized - Authentication required

application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

403

Forbidden - Insufficient permissions for this review outcome

application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

404

No matching control found in applied policy

application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}

500

Internal server error

application/json

Error body returned by the governance endpoints; the message is human-readable and not a stable identifier

object

error

string

Example

{
  "error": "Invalid request body"
}