---
title: "Submit Responses"
method: POST
path: "/api/assessment/v2/assessments/{assessmentId}/responses"
tags: ["Assessment Actions"]
---

# Submit Responses

`POST /api/assessment/v2/assessments/{assessmentId}/responses`

Use this API to submit responses for an assessment. The assessment will be updated with the submitted response.

> 🗒 Things to Know  
>
> - Responses cannot be added to assessments that have already been completed.

## Path parameters

- `assessmentId` string, uuid, required

## Query parameters

- `filter` 'ALL_QUESTIONS' | 'UNANSWERED_QUESTIONS' | 'REQUIRED_QUESTIONS' | 'REQUIRED_UNANSWERED_QUESTIONS' | 'EFFECTIVENESS_SCALE_QUESTIONS'

## Request body

- PrivacyAutomationAssessmentAutomationAssessmentSubmissionInformation[] — List of responses to submit for the assessment
  - `assessmentId` string, uuid, required — Unique identifier of the assessment for which responses are being submitted
  - `sectionId` string, uuid, required — Unique identifier of the section containing the question being answered
  - `questionId` string, uuid, required — Unique identifier of the question being answered
  - `parentAssessmentDetailId` string, uuid — Unique identifier of the parent assessment detail for attribute questions. Required for attribute questions only.
  - `parentPersonalDataDetailId` string, uuid — Unique identifier of the parent personal data detail for personal data relationship attribute questions. Required for personal data relationship attribute questions only.
  - `responses` PrivacyAutomationAssessmentAutomationAssessmentResponseInformation[], required — List of response information objects containing the actual responses to the question
    - `responseId` string, uuid
    - `response` string
    - `responseKey` string
    - `type` 'NOT_SURE, JUSTIFICATION, NOT_APPLICABLE, DEFAULT, OTHERS'
    - `responseSourceType` 'LAUNCH_FROM_INVENTORY/LAUNCH_FROM_INCIDENT/INCIDENT_TEMPLATE/LAUNCH_FROM_CONTROL_IMPLEMENTATION/AI_IMPORT/AI_ACCEPT'
    - `errorCode` 'ATTRIBUTE_DISABLED' | 'ATTRIBUTE_OPTION_DISABLED' | 'INVALID_RESPONSE_VALUE' | 'INVENTORY_NOT_EXISTS' | 'RELATED_INVENTORY_ATTRIBUTE_DISABLED' | 'DATA_ELEMENT_NOT_EXISTS' | 'DATA_SUBJECT_NOT_EXISTS' | 'DUPLICATE_INVENTORY' | 'INVENTORY_ASSOCIATION_TYPE_INVALID' | 'INVENTORY_ASSOCIATION_TYPE_NOT_APPLICABLE' | 'MULTIPLE_SERVICE_PROVIDER_VENDOR_ASSET_RELATION' | 'EMAIL_INVALID' | 'RELATIONSHIP_ATTRIBUTE_OPTION_DISABLED' | 'CONTRACT_NOT_FOUND' | 'VENDOR_CHILD_ATTRIBUTE_INVALID_VALUE_FORMAT' | 'VENDOR_CHILD_ATTRIBUTE_VALUE_LONG' | 'CONTRACT_INVALID_NAME' | 'ENGAGEMENT_NOT_FOUND' | 'DUPLICATE_ENGAGEMENT' | 'INVALID_ENTITY' | 'NOT_FOUND_LINK_TYPE' | 'LINK_TYPE_DOES_NOT_BELONG_TO_ENTITY_TYPE' | 'LINK_RECORD_CANNOT_BE_CREATED_BETWEEN_SAME_ENTITY' | 'LINK_TYPE_DISABLED' | 'INVALID_CONTROL' | 'GENERIC_EXCEPTION' | 'UNKNOWN_MODULE_CLIENT_ERROR' — not required
    - `errorTranslationKey` string — not required
    - `responseMap` object — only applicable for inventory type responses. Allowable values for the key: ASSETS, PROCESSING_ACTIVITY, VENDORS, DATA_SUBJECTS, DATA_ELEMENTS, DATA_CATEGORIES
    - `scaleResponseMap` object — only applicable for YES_NO_PARTIALLY type responses. key should be OVERALL or LAW Name
    - `controlResponse` PrivacyAutomationAssessmentAutomationControlResponse
      - `control id` string, uuid
      - `control identifier` string
      - `control name` string
      - `framework id` string, uuid
      - `framework name` string
      - `category id` string, uuid
      - `category name` string
    - `responseAdditionalDetails` PrivacyAutomationAssessmentAutomationResponseAdditionalDetails
      - `entity Number` integer
      - `source Id` string, uuid
      - `source Name` string
      - `source type` 'Risks, Assets, ProcessingActivities, Vendors, Entities'
      - `Business key` string
    - `contractResponse` PrivacyAutomationAssessmentAutomationContractAdditionalResponseInformation
      - `attachmentId` string, uuid
    - `relationshipResponseDetails` PrivacyAutomationAssessmentAutomationRelationshipResponseDetailsDto[]
      - `relationshipNodeType` string — Type of the relationship node
      - `entityId` string, uuid, required — Unique identifier of the related entity
      - `entityDisplayName` string — Display name of the related entity
      - `entityType` PrivacyAutomationAssessmentAutomationEntityTypeInformation, required
        - `id` string, uuid — Unique identifier of the entity type
        - `name` string — Name of the entity type
        - `nameKey` string — Translation key for the entity type name
        - `moduleName` string — Module name that owns this entity type
        - `schemaName` string — Schema name for this entity type
        - `seeded` boolean — Whether this entity type is seeded
        - `validEntityType` boolean
    - `valid` boolean — not required
    - `textRedacted` boolean — Applicable for attribute text questions
    - `lastModifiedDate` string, date-time
    - `assessmentDetailId` string, uuid — Assessment Detail Identifier of the question response
    - `personalDataDetailId` string, uuid — Pre-generated ID for AssessmentPersonalDataDetail entity, used in AI auto-suggestion mode
    - `dataSubject` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `dataCategory` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `dataElement` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
  - `responseProvidedForOthers` boolean

## Response `202`

Accepted

- PrivacyAutomationAssessmentAutomationAssessmentInformationUiDto
  - `assessment id` string, uuid
  - `assessment number` integer
  - `assessment name` string
  - `assessment description` string
  - `assessment org group` PrivacyAutomationAssessmentAutomationBasicEntityDetail
    - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
    - `name` string — Display name of the entity (organization name or user's full name)
    - `nameKey` string — Translation key for the name, used for internationalization
  - `assessment template` PrivacyAutomationAssessmentAutomationTemplateHeaderInformation
    - `id` string, uuid
    - `name` string
    - `templateType` 'PIA' | 'VENDOR' | 'RA' | 'GRA' | 'DINA' | 'BENCHMARKING' | 'ITRM' | 'CONTROL' | 'INCIDENT' | 'EXCHANGE' | 'ESG' | 'DISCLOSURE' | 'DISCLOSURE_YOY' | 'ERM' | 'TPDD' | 'AIGOVERNANCE' | 'DYNAMIC'
    - `templateVersion` integer
    - `hasApproverSection` boolean
    - `nameKey` string
    - `translatedLanguageCodes` string[]
    - `templateLanguageCode` string
  - `template id to which assessment was originally assigned to` string, uuid
  - `assessment stage` 'NOT_STARTED' | 'IN_PROGRESS' | 'UNDER_REVIEW' | 'COMPLETED'
  - `assessment result` string
  - `created by user id` PrivacyAutomationAssessmentAutomationBasicEntityDetail
    - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
    - `name` string — Display name of the entity (organization name or user's full name)
    - `nameKey` string — Translation key for the name, used for internationalization
  - `created date time` string, date-time
  - `list of sections` PrivacyAutomationAssessmentAutomationAssessmentSectionHeaderInformation[]
    - `sectionId` string, uuid — Unique identifier for the section
    - `name` string — Name of the section
    - `description` string — Description of the section
    - `sequence` integer — Sequence number indicating the order of the section in the assessment
    - `hidden` boolean — Indicates if the section is hidden based on navigation rules
    - `invalidQuestionIds` unknown[]
      - unknown
    - `requiredUnansweredQuestionIds` unknown[]
      - unknown
    - `requiredQuestionIds` unknown[]
      - unknown
    - `unansweredQuestionIds` unknown[]
      - unknown
    - `effectivenessQuestionIds` string[]
    - `autoAnsweredQuestionIds` string[]
    - `riskStatistics` PrivacyAutomationAssessmentAutomationRiskStatistics
      - `sectionId` string, uuid
      - `riskCount` integer
      - `maxRiskLevel` integer
    - `status` string — Current status of the section
    - `nameKey` string — Translation key for the section name
    - `descriptionKey` string — Translation key for the section description
    - `openNMIQuestionIds` unknown[]
      - unknown
    - `sectionUserType` 'APPROVER' | 'RESPONDENT' — Type of user assigned to the section (e.g., RESPONDENT, APPROVER)
    - `submitted` boolean
  - `current section information` PrivacyAutomationAssessmentAutomationAssessmentSectionInformationUiDto
    - `sectionId` string, uuid
    - `name` string
    - `description` string
    - `hidden` boolean
    - `invalidQuestionIds` string[]
    - `requiredUnansweredQuestionIds` string[]
    - `requiredQuestionIds` string[]
    - `unansweredQuestionIds` string[]
    - `effectivenessQuestionIds` string[]
    - `autoAnsweredQuestionIds` string[]
    - `riskStatistics` PrivacyAutomationAssessmentAutomationSectionRiskStats
      - `sectionId` string, uuid
      - `riskCount` integer
      - `maxRiskLevel` integer
    - `hasNavigationRules` boolean
    - `submittedBy` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `submittedDt` string, date-time
    - `nameKey` string
    - `descriptionKey` string
    - `submitted` boolean
  - `approvers` PrivacyAutomationAssessmentAutomationApproverInformation[]
    - `id` string, uuid
    - `workflowStageId` string, uuid
    - `name` string
    - `approver` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail
      - `id` string, uuid — Unique identifier of the user
      - `fullName` string — Full name of the user
      - `email` string — Email address of the user
      - `deleted` boolean — Flag indicating whether the user has been deleted
      - `assigneeType` string — Type of assignee (e.g., USER, GROUP)
    - `approvedOn` string, date-time
    - `approvalState` 'OPEN' | 'APPROVED' | 'REJECTED'
    - `resultId` string, uuid
    - `resultName` string
    - `resultNameKey` string
  - `List of respondents for this assessment` PrivacyAutomationAssessmentAutomationBasicEntityDetail[]
    - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
    - `name` string — Display name of the entity (organization name or user's full name)
    - `nameKey` string — Translation key for the name, used for internationalization
  - `deadline to complete the assessment, format - YYYY-MM-DDTHH:MM:SS.FFFZ` string, date-time
  - `reminder to be sent the number of days before the deadline denoted by this value` integer
  - `reminder to be sent the number of days before the deadline denoted by these values` PrivacyAutomationAssessmentAutomationReminderScheduleDto[]
    - `id` string, uuid — Unique identifier for the reminder schedule.
    - `assessmentId` string, uuid — Identifier of the assessment this reminder schedule applies to.
    - `sectionId` string, uuid — Identifier of a specific assessment section this reminder schedule targets (optional).
    - `reminderInterval` integer — Interval in days between consecutive reminders.
    - `reminderReceiverEntityType` 'APPROVER' | 'RESPONDENT' | 'ALL', required — Recipient type who will receive the reminder notifications.
  - `indicates if the assessment or sections can be submitted` boolean
  - `indicates if the assessment can be approved` boolean
  - `assessment display state. Used only by our own use interface` 'REFRESH_NONE, REFRESH_ALL, REFRESH_PARTIAL'
  - `assessment question information` PrivacyAutomationAssessmentAutomationAssessmentQuestionInformationUiDto
    - `set of all question ids` string[]
    - `map containing the question id and the details` object
  - `set of inventory links` PrivacyAutomationAssessmentAutomationInventoryLink[]
    - `link type` string
    - `link` string
  - `indicates if it has request information` boolean
  - `map containing invalid questions and the associated risks` object
  - `List of laws associated with the assessment` string[]
  - `Complexity level of Assessment' response` 'BASIC' | 'ADVANCED' | 'EXPERT'
  - `List of tags associated with the assessment` PrivacyAutomationAssessmentAutomationTagEntityDetail[]
    - `id` string, uuid — Unique identifier for the tag
    - `option` string — Display text for the tag that appears in the UI
  - `reviewChangedResponses` boolean
  - `assessment id from where this assessment is copied` string, uuid
  - `editAllResponsesWhenInProgress` boolean
  - `primaryInventoryName` string
  - `primaryInventoryNumber` integer
  - `userAssignmentMode` 'ASSESSMENT' | 'SECTION'
  - `Indicates progress on assessment with overall questionnaires` PrivacyAutomationAssessmentAutomationAssessmentProgressInformation
    - `totalQuestions` integer
    - `respondedQuestions` integer
  - `Welcome Section Information` PrivacyAutomationAssessmentAutomationWelcomeSection
    - `Is getting started banner enabled?` boolean
    - `Welcome Title` string
    - `Welcome Text` string
    - `welcomeTitleKey` string
    - `welcomeTextKey` string
    - `Is Welcome section hidden?` boolean
  - `viewer` boolean
  - `welcomeSection` boolean
  - `firstSection` boolean
  - `lastSection` boolean
  - `welcomeText` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/revisions/21de3aa0b170/schema)