---
title: "POST /assessments"
method: POST
path: "/assessments"
---

# POST /assessments

`POST /assessments`

Creates an assessment in Audit Manager.

## Request body

- object
  - `name` string, required — The name of the assessment to be created.
  - `description` string — The optional description of the assessment to be created.
  - `assessmentReportsDestination` object, required — The location where Audit Manager saves assessment reports for the given assessment.
    - `destinationType` 'S3' — The destination type, such as Amazon S3.
    - `destination` string — The destination of the assessment report.
  - `scope` object, required — The wrapper that contains the Amazon Web Services accounts and services that are in scope for the assessment.
    - `awsAccounts` AWSAccount[] — The Amazon Web Services accounts that are included in the scope of the assessment.
      - `id` string — The identifier for the Amazon Web Services account.
      - `emailAddress` string — The email address that's associated with the Amazon Web Services account.
      - `name` string — The name of the Amazon Web Services account.
    - `awsServices` AWSService[] — The Amazon Web Services services that are included in the scope of the assessment.
      - `serviceName` string — The name of the Amazon Web Service.
  - `roles` Role[], required — The list of roles for the assessment.
    - `roleType` 'PROCESS_OWNER' | 'RESOURCE_OWNER', required — <p> The type of customer persona. </p> <note> <p>In <code>CreateAssessment</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>. </p> <p>In <code>UpdateSettings</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>.</p> <p>In <code>BatchCreateDelegationByAssessment</code>, <code>roleType</code> can only be <code>RESOURCE_OWNER</code>.</p> </note>
    - `roleArn` string, required — The Amazon Resource Name (ARN) of the IAM role.
  - `frameworkId` string, required — The identifier for the framework that the assessment will be created from.
  - `tags` object — The tags that are associated with the assessment.

## Response `200`

Success

- CreateAssessmentResponse
  - `assessment` Assessment — An entity that defines the scope of audit evidence collected by Audit Manager. An Audit Manager assessment is an implementation of an Audit Manager framework.
    - `arn` string — The Amazon Resource Name (ARN) of the assessment.
    - `awsAccount` object — The Amazon Web Services account that's associated with the assessment.
      - `id` string — The identifier for the Amazon Web Services account.
      - `emailAddress` string — The email address that's associated with the Amazon Web Services account.
      - `name` string — The name of the Amazon Web Services account.
    - `metadata` object — The metadata for the assessment.
      - `name` string — The name of the assessment.
      - `id` string — The unique identifier for the assessment.
      - `description` string — The description of the assessment.
      - `complianceType` string — The name of the compliance standard that's related to the assessment, such as PCI-DSS.
      - `status` 'ACTIVE' | 'INACTIVE' — The overall status of the assessment.
      - `assessmentReportsDestination` object — The destination that evidence reports are stored in for the assessment.
        - `destinationType` 'S3' — The destination type, such as Amazon S3.
        - `destination` string — The destination of the assessment report.
      - `scope` object — The wrapper of Amazon Web Services accounts and services that are in scope for the assessment.
        - `awsAccounts` AWSAccount[] — The Amazon Web Services accounts that are included in the scope of the assessment.
          - `id` string — The identifier for the Amazon Web Services account.
          - `emailAddress` string — The email address that's associated with the Amazon Web Services account.
          - `name` string — The name of the Amazon Web Services account.
        - `awsServices` AWSService[] — The Amazon Web Services services that are included in the scope of the assessment.
          - `serviceName` string — The name of the Amazon Web Service.
      - `roles` Role[] — The roles that are associated with the assessment.
        - `roleType` 'PROCESS_OWNER' | 'RESOURCE_OWNER', required — <p> The type of customer persona. </p> <note> <p>In <code>CreateAssessment</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>. </p> <p>In <code>UpdateSettings</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>.</p> <p>In <code>BatchCreateDelegationByAssessment</code>, <code>roleType</code> can only be <code>RESOURCE_OWNER</code>.</p> </note>
        - `roleArn` string, required — The Amazon Resource Name (ARN) of the IAM role.
      - `delegations` Delegation[] — The delegations that are associated with the assessment.
        - `id` string — The unique identifier for the delegation.
        - `assessmentName` string — The name of the assessment that's associated with the delegation.
        - `assessmentId` string — The identifier for the assessment that's associated with the delegation.
        - `status` 'IN_PROGRESS' | 'UNDER_REVIEW' | 'COMPLETE' — The status of the delegation.
        - `roleArn` string — The Amazon Resource Name (ARN) of the IAM role.
        - `roleType` 'PROCESS_OWNER' | 'RESOURCE_OWNER' — <p> The type of customer persona. </p> <note> <p>In <code>CreateAssessment</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>. </p> <p>In <code>UpdateSettings</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>.</p> <p>In <code>BatchCreateDelegationByAssessment</code>, <code>roleType</code> can only be <code>RESOURCE_OWNER</code>.</p> </note>
        - `creationTime` string, date-time — Specifies when the delegation was created.
        - `lastUpdated` string, date-time — Specifies when the delegation was last updated.
        - `controlSetId` string — The identifier for the control set that's associated with the delegation.
        - `comment` string — The comment that's related to the delegation.
        - `createdBy` string — The user or role that created the delegation.
      - `creationTime` string, date-time — Specifies when the assessment was created.
      - `lastUpdated` string, date-time — The time of the most recent update.
    - `framework` object — The framework that the assessment was created from.
      - `id` string — The unique identifier for the framework.
      - `arn` string — The Amazon Resource Name (ARN) of the framework.
      - `metadata` FrameworkMetadata — The metadata of a framework, such as the name, ID, or description.
        - `name` string — The name of the framework.
        - `description` string — The description of the framework.
        - `logo` string — The logo that's associated with the framework.
        - `complianceType` string — The compliance standard that's associated with the framework. For example, this could be PCI DSS or HIPAA.
      - `controlSets` AssessmentControlSet[] — The control sets that are associated with the framework.
        - `id` string — The identifier of the control set in the assessment. This is the control set name in a plain string format.
        - `description` string — The description for the control set.
        - `status` 'ACTIVE' | 'UNDER_REVIEW' | 'REVIEWED' — The current status of the control set.
        - `roles` Role[] — The roles that are associated with the control set.
          - `roleType` 'PROCESS_OWNER' | 'RESOURCE_OWNER', required — <p> The type of customer persona. </p> <note> <p>In <code>CreateAssessment</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>. </p> <p>In <code>UpdateSettings</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>.</p> <p>In <code>BatchCreateDelegationByAssessment</code>, <code>roleType</code> can only be <code>RESOURCE_OWNER</code>.</p> </note>
          - `roleArn` string, required — The Amazon Resource Name (ARN) of the IAM role.
        - `controls` AssessmentControl[] — The list of controls that's contained with the control set.
          - `id` string — The identifier for the control.
          - `name` string — The name of the control.
          - `description` string — The description of the control.
          - `status` 'UNDER_REVIEW' | 'REVIEWED' | 'INACTIVE' — The status of the control.
          - `response` 'MANUAL' | 'AUTOMATE' | 'DEFER' | 'IGNORE' — The response of the control.
          - `comments` ControlComment[] — The list of comments that's attached to the control.
            - `authorName` string — The name of the user who authored the comment.
            - `commentBody` string — The body text of a control comment.
            - `postedDate` string, date-time — The time when the comment was posted.
          - `evidenceSources` NonEmptyString[] — The list of data sources for the evidence.
          - `evidenceCount` integer — The amount of evidence that's collected for the control.
          - `assessmentReportEvidenceCount` integer — The amount of evidence in the assessment report.
        - `delegations` Delegation[] — The delegations that are associated with the control set.
          - `id` string — The unique identifier for the delegation.
          - `assessmentName` string — The name of the assessment that's associated with the delegation.
          - `assessmentId` string — The identifier for the assessment that's associated with the delegation.
          - `status` 'IN_PROGRESS' | 'UNDER_REVIEW' | 'COMPLETE' — The status of the delegation.
          - `roleArn` string — The Amazon Resource Name (ARN) of the IAM role.
          - `roleType` 'PROCESS_OWNER' | 'RESOURCE_OWNER' — <p> The type of customer persona. </p> <note> <p>In <code>CreateAssessment</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>. </p> <p>In <code>UpdateSettings</code>, <code>roleType</code> can only be <code>PROCESS_OWNER</code>.</p> <p>In <code>BatchCreateDelegationByAssessment</code>, <code>roleType</code> can only be <code>RESOURCE_OWNER</code>.</p> </note>
          - `creationTime` string, date-time — Specifies when the delegation was created.
          - `lastUpdated` string, date-time — Specifies when the delegation was last updated.
          - `controlSetId` string — The identifier for the control set that's associated with the delegation.
          - `comment` string — The comment that's related to the delegation.
          - `createdBy` string — The user or role that created the delegation.
        - `systemEvidenceCount` integer — The total number of evidence objects that are retrieved automatically for the control set.
        - `manualEvidenceCount` integer — The total number of evidence objects that are uploaded manually to the control set.
    - `tags` object — The tags that are associated with the assessment.

## Other responses

- `480` — ResourceNotFoundException
- `481` — ValidationException
- `482` — AccessDeniedException
- `483` — InternalServerException
- `484` — ServiceQuotaExceededException

---

[API](https://skmtc.net/aws/apis/auditmanager.md) · [All operations](https://skmtc.net/aws/apis/auditmanager/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/auditmanager/versions/27a1388d0f2a/schema)