EQTY LabDocs

Register agent submission

Registers an assessment's submission for review: the configuration, operating profile and declarations it stands on, the controls it claims do not apply, and each control's evidence. It is linked to every control of the program, since every control is judged against it. The assessment must belong to the caller's organization, and submittedBy must be the caller's DID.

posthttps://<host>/gov/v1/agent/submission/{assessment_uuid}
bash
curl --request POST \
  --url 'https://<host>/gov/v1/agent/submission/{assessment_uuid}' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{"configurationCid":"urn:cid:configuration_cid","controls":[{"controlCid":"urn:cid:control_cid","evidenceCid":"urn:cid:evidence_cid"}],"declarationCid":"[\"urn:cid:declaration_one\"]","documentType":"string","extra":{"key":null},"notApplicable":[{"controlCid":"urn:cid:control_cid","statement":"The agent has no network access."}],"profileCid":"urn:cid:profile_cid","programCid":"urn:cid:program_cid","statement":"string","submittedAt":"2026-10-08T12:00:06Z","submittedBy":"did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"}'
javascript
const response = await fetch("https://<host>/gov/v1/agent/submission/{assessment_uuid}", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "configurationCid": "urn:cid:configuration_cid",
    "controls": [
      {
        "controlCid": "urn:cid:control_cid",
        "evidenceCid": "urn:cid:evidence_cid"
      }
    ],
    "declarationCid": "[\"urn:cid:declaration_one\"]",
    "documentType": "string",
    "extra": {
      "key": null
    },
    "notApplicable": [
      {
        "controlCid": "urn:cid:control_cid",
        "statement": "The agent has no network access."
      }
    ],
    "profileCid": "urn:cid:profile_cid",
    "programCid": "urn:cid:program_cid",
    "statement": "string",
    "submittedAt": "2026-10-08T12:00:06Z",
    "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
  })
});

const data = await response.json();
typescript
interface StatementResponse {
  documentCid: string;
  statement: Record<string, unknown>;
  statementCid: string;
}

const response = await fetch("https://<host>/gov/v1/agent/submission/{assessment_uuid}", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "configurationCid": "urn:cid:configuration_cid",
    "controls": [
      {
        "controlCid": "urn:cid:control_cid",
        "evidenceCid": "urn:cid:evidence_cid"
      }
    ],
    "declarationCid": "[\"urn:cid:declaration_one\"]",
    "documentType": "string",
    "extra": {
      "key": null
    },
    "notApplicable": [
      {
        "controlCid": "urn:cid:control_cid",
        "statement": "The agent has no network access."
      }
    ],
    "profileCid": "urn:cid:profile_cid",
    "programCid": "urn:cid:program_cid",
    "statement": "string",
    "submittedAt": "2026-10-08T12:00:06Z",
    "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
  })
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);

const data: StatementResponse = await response.json();
python
import requests

response = requests.post(
    "https://<host>/gov/v1/agent/submission/{assessment_uuid}",
    headers={
        "Authorization": "Bearer <token>",
        "Content-Type": "application/json",
    },
    json={
        "configurationCid": "urn:cid:configuration_cid",
        "controls": [
            {
                "controlCid": "urn:cid:control_cid",
                "evidenceCid": "urn:cid:evidence_cid",
            },
        ],
        "declarationCid": "[\"urn:cid:declaration_one\"]",
        "documentType": "string",
        "extra": {
            "key": None,
        },
        "notApplicable": [
            {
                "controlCid": "urn:cid:control_cid",
                "statement": "The agent has no network access.",
            },
        ],
        "profileCid": "urn:cid:profile_cid",
        "programCid": "urn:cid:program_cid",
        "statement": "string",
        "submittedAt": "2026-10-08T12:00:06Z",
        "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1",
    },
)
response.raise_for_status()
print(response.json())
go
package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{
	  "configurationCid": "urn:cid:configuration_cid",
	  "controls": [
	    {
	      "controlCid": "urn:cid:control_cid",
	      "evidenceCid": "urn:cid:evidence_cid"
	    }
	  ],
	  "declarationCid": "[\"urn:cid:declaration_one\"]",
	  "documentType": "string",
	  "extra": {
	    "key": null
	  },
	  "notApplicable": [
	    {
	      "controlCid": "urn:cid:control_cid",
	      "statement": "The agent has no network access."
	    }
	  ],
	  "profileCid": "urn:cid:profile_cid",
	  "programCid": "urn:cid:program_cid",
	  "statement": "string",
	  "submittedAt": "2026-10-08T12:00:06Z",
	  "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
	}`)
	req, err := http.NewRequest(http.MethodPost, "https://<host>/gov/v1/agent/submission/{assessment_uuid}", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer <token>")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.Status, string(data))
}
java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://<host>/gov/v1/agent/submission/{assessment_uuid}"))
            .header("Authorization", "Bearer <token>")
            .header("Content-Type", "application/json")
            .method("POST", HttpRequest.BodyPublishers.ofString("""
                {
                  "configurationCid": "urn:cid:configuration_cid",
                  "controls": [
                    {
                      "controlCid": "urn:cid:control_cid",
                      "evidenceCid": "urn:cid:evidence_cid"
                    }
                  ],
                  "declarationCid": "[\\"urn:cid:declaration_one\\"]",
                  "documentType": "string",
                  "extra": {
                    "key": null
                  },
                  "notApplicable": [
                    {
                      "controlCid": "urn:cid:control_cid",
                      "statement": "The agent has no network access."
                    }
                  ],
                  "profileCid": "urn:cid:profile_cid",
                  "programCid": "urn:cid:program_cid",
                  "statement": "string",
                  "submittedAt": "2026-10-08T12:00:06Z",
                  "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
                }
                """))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}
csharp
using System.Net.Http.Headers;
using System.Text;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://<host>/gov/v1/agent/submission/{assessment_uuid}");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
request.Content = new StringContent("""
    {
      "configurationCid": "urn:cid:configuration_cid",
      "controls": [
        {
          "controlCid": "urn:cid:control_cid",
          "evidenceCid": "urn:cid:evidence_cid"
        }
      ],
      "declarationCid": "[\"urn:cid:declaration_one\"]",
      "documentType": "string",
      "extra": {
        "key": null
      },
      "notApplicable": [
        {
          "controlCid": "urn:cid:control_cid",
          "statement": "The agent has no network access."
        }
      ],
      "profileCid": "urn:cid:profile_cid",
      "programCid": "urn:cid:program_cid",
      "statement": "string",
      "submittedAt": "2026-10-08T12:00:06Z",
      "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
    }
    """, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");
php
<?php

$ch = curl_init('https://<host>/gov/v1/agent/submission/{assessment_uuid}');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer <token>',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => <<<'JSON'
    {
      "configurationCid": "urn:cid:configuration_cid",
      "controls": [
        {
          "controlCid": "urn:cid:control_cid",
          "evidenceCid": "urn:cid:evidence_cid"
        }
      ],
      "declarationCid": "[\"urn:cid:declaration_one\"]",
      "documentType": "string",
      "extra": {
        "key": null
      },
      "notApplicable": [
        {
          "controlCid": "urn:cid:control_cid",
          "statement": "The agent has no network access."
        }
      ],
      "profileCid": "urn:cid:profile_cid",
      "programCid": "urn:cid:program_cid",
      "statement": "string",
      "submittedAt": "2026-10-08T12:00:06Z",
      "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
    }
    JSON,
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;
ruby
require "net/http"

uri = URI("https://<host>/gov/v1/agent/submission/{assessment_uuid}")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer <token>"
request["Content-Type"] = "application/json"
request.body = <<~'JSON'
  {
    "configurationCid": "urn:cid:configuration_cid",
    "controls": [
      {
        "controlCid": "urn:cid:control_cid",
        "evidenceCid": "urn:cid:evidence_cid"
      }
    ],
    "declarationCid": "[\"urn:cid:declaration_one\"]",
    "documentType": "string",
    "extra": {
      "key": null
    },
    "notApplicable": [
      {
        "controlCid": "urn:cid:control_cid",
        "statement": "The agent has no network access."
      }
    ],
    "profileCid": "urn:cid:profile_cid",
    "programCid": "urn:cid:program_cid",
    "statement": "string",
    "submittedAt": "2026-10-08T12:00:06Z",
    "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
puts "#{response.code} #{response.body}"
rust
// Cargo.toml dependencies: reqwest (features "json"), serde_json, tokio (features "full")
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let response = reqwest::Client::new()
        .post("https://<host>/gov/v1/agent/submission/{assessment_uuid}")
        .header("Authorization", "Bearer <token>")
        .json(&json!({
            "configurationCid": "urn:cid:configuration_cid",
            "controls": [
                {
                    "controlCid": "urn:cid:control_cid",
                    "evidenceCid": "urn:cid:evidence_cid"
                }
            ],
            "declarationCid": "[\"urn:cid:declaration_one\"]",
            "documentType": "string",
            "extra": {
                "key": null
            },
            "notApplicable": [
                {
                    "controlCid": "urn:cid:control_cid",
                    "statement": "The agent has no network access."
                }
            ],
            "profileCid": "urn:cid:profile_cid",
            "programCid": "urn:cid:program_cid",
            "statement": "string",
            "submittedAt": "2026-10-08T12:00:06Z",
            "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
        }))
        .send()
        .await?;

    println!("{} {}", response.status(), response.text().await?);
    Ok(())
}

Authorizations

  • BearerAuth · HTTP bearer (JWT)

Parameters

Path parameters

NameTypeDescription
assessment_uuid
required
string<uuid>

The assessment graph

Request bodyrequired

application/json
  • configurationCidstringrequired

    The agent configuration snapshot the assessment pins

  • controlsControlEvidence[]

    Every program control and the evidence it is judged on, in control CID order, as /gov/v1/agent/evidence computes it. Empty on submissions registered before controls named their evidence, which can no longer be reviewed

    Show properties

    Array of ControlEvidence

    • controlCidstringrequired
    • evidenceCidstringrequired

      The CID of the control's AgentControlEvidenceV1 document

  • declarationCidstring[]

    Declarations registered in this assessment that the submission stands on

  • documentTypestring
  • extraobject | null
    Show properties

    Map of any

  • notApplicableNotApplicableClaim[]
    Show properties

    Array of NotApplicableClaim

    • controlCidstringrequired
    • statementstringrequired
  • profileCidstring | null

    The operating profile the assessment pins, when one is pinned. A submission names exactly the pin, and omits the field when nothing is pinned, so a submission from before profiles keeps its CID

  • programCidstringrequired

    The program manifest the assessment is held to

  • statementstring | null
  • submittedAtstring<date-time>required
  • submittedBystringrequired
Examplejson
{
  "configurationCid": "urn:cid:configuration_cid",
  "controls": [
    {
      "controlCid": "urn:cid:control_cid",
      "evidenceCid": "urn:cid:evidence_cid"
    }
  ],
  "declarationCid": "[\"urn:cid:declaration_one\"]",
  "documentType": "string",
  "extra": {
    "key": null
  },
  "notApplicable": [
    {
      "controlCid": "urn:cid:control_cid",
      "statement": "The agent has no network access."
    }
  ],
  "profileCid": "urn:cid:profile_cid",
  "programCid": "urn:cid:program_cid",
  "statement": "string",
  "submittedAt": "2026-10-08T12:00:06Z",
  "submittedBy": "did:key:z6MkvWwG4YJDNEBq6ufypq6mBGpKje7bfJefcQkMoGWPjoq1"
}

Responses

200Governance statement created for the submission

application/json
  • documentCidstringrequired
  • statementGovernanceStatementrequired

    Records governance information for a subject This statement type associates governance documents (policies, procedures, compliance documents) with subjects in the lineage system.

    Show GovernanceStatement
    • @contextstringrequired

      JSON-LD context URL

    • @idstringrequired

      Unique identifier for this statement

    • @typestringrequired

      Statement type identifier

    • documentstringrequired

      CID of the governance document

    • registeredBystringrequired

      DID of the entity that registered this statement

    • subjectstringrequired

      The subject to which governance applies

    • timestampstringrequired

      ISO 8601 timestamp of when the statement was created

  • statementCidstringrequired
Examplejson
{
  "documentCid": "string",
  "statement": {
    "@context": "string",
    "@id": "string",
    "@type": "string",
    "document": "string",
    "registeredBy": "string",
    "subject": "string",
    "timestamp": "string"
  },
  "statementCid": "string"
}

401Missing or invalid bearer token, or submittedBy is not the caller's DID

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

403The assessment graph is not registered, or belongs to an organization other than the caller's

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

409The same submission document is already registered; vary its submittedAt

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

422The document is not a submission, names another program, a configuration or operating profile other than the one pinned on the assessment (or a profile when none is pinned), cites a declaration not registered in the assessment, claims not applicable a control outside the program or one already claimed, or names controls' evidence other than /gov/v1/agent/evidence computes for it

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

500Internal error

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}

503Auth Service or blob storage unavailable

application/json
  • callstackobject
    Show properties

    object | null

  • errorstringrequired
Examplejson
{
  "callstack": {},
  "error": "string"
}