---
title: "Upload external scores for one or more suppliers"
method: POST
path: "/public/v1/scores/externals"
tags: ["Scores - Externals"]
---

# Upload external scores for one or more suppliers

`POST /public/v1/scores/externals`

Uploads scores per supplier and event type. Event types are the risk dimensions you score for a supplier (e.g. Carbon, Flood).

**What you send**
- A list of suppliers, each with how to find that supplier in Prewave and one or more scores.
- At most 100 supplier entries in `data` per request.
- At most 50 score rows per supplier in `scores` (one per event type).
- Each score needs an event type key (`eventTypeKey`), a value from 1 to 100, and an optional comment.

**Recommended workflow**
1. Call **List event types for a perspective** to see which event type keys are set up for your perspective.
2. Send this request with those keys where possible.
3. Review the response: if `success` is false, open `errors` to see which suppliers or scores failed and why.

**How to read the response**
- The request is accepted even when some rows fail. Check `success` for an all-clear result.
- Counters show how many suppliers were received, matched, and saved (`totalCount`, `validCount`, `resolvedCount`, `writtenCount`, `skippedCount`).
- Problems (unknown supplier, unknown event type key, and similar) are listed in `errors`, not only as an HTTP error.

**Required permission:** `access_public_internal_score`

## Request body

- PublicExternalScoreCreationRequest
  - `data` PublicExternalTargetScoreCollection[], required — Suppliers and their scores. At most 100 suppliers per request.
    - `identifier` PublicExternalTargetIdentifier, required — Supplier site identifier. At least one lookup key (`supplierId`, `customerId`, `ownId`, or `prewaveId`) should be set; `source` optionally narrows text identifiers.
      - `supplierId` string, nullable — Supplier ID of the target. Can be combined with customerId, ownId, and/or prewaveId.
      - `customerId` string, nullable — Customer ID of the target. Can be combined with supplierId, ownId, and/or prewaveId.
      - `ownId` string, nullable — Own site ID of the target. Can be combined with supplierId, customerId, and/or prewaveId.
      - `prewaveId` integer, nullable — Prewave ID of the target. Can be combined with supplierId, customerId, and/or ownId.
      - `source` string, nullable — Optional source system to filter by. Applies to supplierId, customerId, and ownId (not prewaveId).
    - `scores` PublicExternalTargetScore[], required — Scores for this supplier, one per event type. At most 50 per supplier.
      - `eventTypeKey` string, required
      - `scoreValue` integer, required
      - `comment` string, nullable

## Response `200`

Upload finished. Check `success`, the counters, and `errors` to see whether every supplier and score was saved.

- PublicExternalScoreCreationResponse
  - `success` boolean, required
  - `totalCount` integer, required
  - `validCount` integer, required
  - `resolvedCount` integer, required
  - `writtenCount` integer, required
  - `skippedCount` integer, required
  - `errors` PublicExternalScoreCreationError[], required
    - `entryIndex` integer, required
    - `scoreIndex` integer, nullable
    - `identifier` PublicExternalTargetIdentifier, required — Supplier site identifier. At least one lookup key (`supplierId`, `customerId`, `ownId`, or `prewaveId`) should be set; `source` optionally narrows text identifiers.
      - `supplierId` string, nullable — Supplier ID of the target. Can be combined with customerId, ownId, and/or prewaveId.
      - `customerId` string, nullable — Customer ID of the target. Can be combined with supplierId, ownId, and/or prewaveId.
      - `ownId` string, nullable — Own site ID of the target. Can be combined with supplierId, customerId, and/or prewaveId.
      - `prewaveId` integer, nullable — Prewave ID of the target. Can be combined with supplierId, customerId, and/or ownId.
      - `source` string, nullable — Optional source system to filter by. Applies to supplierId, customerId, and ownId (not prewaveId).
    - `eventTypeKey` string, nullable
    - `reason` 'INVALID_IDENTIFIER' | 'TARGET_NOT_FOUND' | 'MULTIPLE_TARGETS_MATCHED' | 'UNKNOWN_EVENT_TYPE' | 'PERSIST_ERROR' | 'UNEXPECTED_ERROR', required
    - `message` string, required

## Other responses

- `400` — The request could not be processed — for example the supplier list was empty, more than 100 suppliers were sent, more than 50 scores were sent for one supplier, a score was outside 1–100, or an event type key was missing.
- `403` — 403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.
- `429` — 429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.
- `500` — 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.

---

[API](https://skmtc.net/prewave/apis/public-prewave-api.md) · [All operations](https://skmtc.net/prewave/apis/public-prewave-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/prewave/public-prewave-api/revisions/466169815b78/schema)