---
title: "Submit Responses"
method: POST
path: "/api/assessment/v2/assessments/{assessmentId}/responses"
tags: ["Assessment Actions"]
---

# Submit Responses

`POST /api/assessment/v2/assessments/{assessmentId}/responses`

## Request

- Base URL: `https://hostname`
- URL: `https://hostname/api/assessment/v2/assessments/{assessmentId}/responses`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://{hostname}/api/access/v1/oauth/token` scopes: `ASSESSMENT`

Use this API to submit responses for an assessment. The assessment will be updated with the submitted response.

> 🗒 Things to Know  
>
> - Responses cannot be added to assessments that have already been completed.

## Path parameters

- `assessmentId` string, uuid, required

## Query parameters

- `filter` 'ALL_QUESTIONS' | 'UNANSWERED_QUESTIONS' | 'REQUIRED_QUESTIONS' | 'REQUIRED_UNANSWERED_QUESTIONS' | 'EFFECTIVENESS_SCALE_QUESTIONS'

## Request body

- PrivacyAutomationAssessmentAutomationAssessmentSubmissionInformation[]: List of responses to submit for the assessment
  - `assessmentId` string, uuid, required: Unique identifier of the assessment for which responses are being submitted
  - `sectionId` string, uuid, required: Unique identifier of the section containing the question being answered
  - `questionId` string, uuid, required: Unique identifier of the question being answered
  - `parentAssessmentDetailId` string, uuid: Unique identifier of the parent assessment detail for attribute questions. Required for attribute questions only.
  - `parentPersonalDataDetailId` string, uuid: Unique identifier of the parent personal data detail for personal data relationship attribute questions. Required for personal data relationship attribute questions only.
  - `responses` PrivacyAutomationAssessmentAutomationAssessmentResponseInformation[], required: List of response information objects containing the actual responses to the question
    - `responseId` string, uuid
    - `response` string
    - `responseKey` string
    - `type` 'NOT_SURE' | 'JUSTIFICATION' | 'NOT_APPLICABLE' | 'DEFAULT' | 'MATURITY_SCALE' | 'EFFECTIVENESS_SCALE' | 'OTHERS': Type of response provided
    - `responseSourceType` 'LAUNCH_FROM_INVENTORY' | 'LAUNCH_FROM_INCIDENT' | 'INCIDENT_TEMPLATE' | 'LAUNCH_FROM_CONTROL_IMPLEMENTATION' | 'RESPONSE_DRIVEN_INVENTORY' | 'RESPONSE_DRIVEN_CONTROL_IMPLEMENTATION' | 'PRIMARY_SOURCE' | 'PRIMARY_PARENT_SOURCE' | 'RESPONSE_DRIVEN_PRIMARY_SOURCE' | 'FORCE_CREATED_SOURCE' | 'AI_IMPORT' | 'AI_ACCEPT': Source that produced this response
    - `errorCode` 'ATTRIBUTE_DISABLED' | 'ATTRIBUTE_OPTION_DISABLED' | 'INVALID_RESPONSE_VALUE' | 'INVENTORY_NOT_EXISTS' | 'RELATED_INVENTORY_ATTRIBUTE_DISABLED' | 'DATA_ELEMENT_NOT_EXISTS' | 'DATA_SUBJECT_NOT_EXISTS' | 'DUPLICATE_INVENTORY' | 'INVENTORY_ASSOCIATION_TYPE_INVALID' | 'INVENTORY_ASSOCIATION_TYPE_NOT_APPLICABLE' | 'MULTIPLE_SERVICE_PROVIDER_VENDOR_ASSET_RELATION' | 'EMAIL_INVALID' | 'RELATIONSHIP_ATTRIBUTE_OPTION_DISABLED' | 'CONTRACT_NOT_FOUND' | 'VENDOR_CHILD_ATTRIBUTE_INVALID_VALUE_FORMAT' | 'VENDOR_CHILD_ATTRIBUTE_VALUE_LONG' | 'CONTRACT_INVALID_NAME' | 'ENGAGEMENT_NOT_FOUND' | 'DUPLICATE_ENGAGEMENT' | 'INVALID_ENTITY' | 'NOT_FOUND_LINK_TYPE' | 'LINK_TYPE_DOES_NOT_BELONG_TO_ENTITY_TYPE' | 'LINK_RECORD_CANNOT_BE_CREATED_BETWEEN_SAME_ENTITY' | 'LINK_TYPE_DISABLED' | 'INVALID_CONTROL' | 'GENERIC_EXCEPTION' | 'UNKNOWN_MODULE_CLIENT_ERROR' | 'DATE_DISCOVERED_BEFORE_DATE_OCCURRED' | 'UNSAFE_HTML_EXCEPTION': not required
    - `errorTranslationKey` string: not required
    - `responseMap` object: only applicable for inventory type responses. Allowable values for the key: ASSETS, PROCESSING_ACTIVITY, VENDORS, DATA_SUBJECTS, DATA_ELEMENTS, DATA_CATEGORIES
    - `scaleResponseMap` object: only applicable for YES_NO_PARTIALLY type responses. key should be OVERALL or LAW Name
    - `controlResponse` PrivacyAutomationAssessmentAutomationControlResponse
      - `controlId` string, uuid: UUID of the control
      - `controlIdentifier` string: Identifier of the control
      - `controlName` string: Name of the control
      - `frameworkId` string, uuid: UUID of the framework the control belongs to
      - `frameworkName` string: Name of the framework the control belongs to
      - `categoryId` string, uuid: UUID of the control category
      - `categoryName` string: Name of the control category
    - `responseAdditionalDetails` PrivacyAutomationAssessmentAutomationResponseAdditionalDetails
      - `entityNumber` integer: Number of the entity
      - `sourceId` string, uuid: UUID of the source entity
      - `sourceName` string: Name of the source entity
      - `entitySourceType` 'Risks' | 'Assets' | 'ProcessingActivities' | 'Vendors' | 'Entities' | 'EntityScope': Type of the source entity
      - `entityBusinessKey` string: Business key of the entity
    - `contractResponse` PrivacyAutomationAssessmentAutomationContractAdditionalResponseInformation
      - `attachmentId` string, uuid
    - `relationshipResponseDetails` PrivacyAutomationAssessmentAutomationRelationshipResponseDetailsDto[]
      - `relationshipNodeType` string: Type of the relationship node
      - `entityId` string, uuid, required: Unique identifier of the related entity
      - `entityDisplayName` string: Display name of the related entity
      - `entityType` PrivacyAutomationAssessmentAutomationEntityTypeInformation, required
        - `id` string, uuid: Unique identifier of the entity type
        - `name` string: Name of the entity type
        - `nameKey` string: Translation key for the entity type name
        - `moduleName` string: Module name that owns this entity type
        - `schemaName` string: Schema name for this entity type
        - `seeded` boolean: Whether this entity type is seeded
        - `validEntityType` boolean
    - `valid` boolean: not required
    - `textRedacted` boolean: Applicable for attribute text questions
    - `lastModifiedDate` string, date-time
    - `assessmentDetailId` string, uuid: Assessment Detail Identifier of the question response
    - `personalDataDetailId` string, uuid: Pre-generated ID for AssessmentPersonalDataDetail entity, used in AI auto-suggestion mode
    - `dataSubject` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
      - `name` string: Display name of the entity (organization name or user's full name)
      - `nameKey` string: Translation key for the name, used for internationalization
    - `dataCategory` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
      - `name` string: Display name of the entity (organization name or user's full name)
      - `nameKey` string: Translation key for the name, used for internationalization
    - `dataElement` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
      - `name` string: Display name of the entity (organization name or user's full name)
      - `nameKey` string: Translation key for the name, used for internationalization
  - `responseProvidedForOthers` boolean

## Response `202`

Accepted

- PrivacyAutomationAssessmentAutomationAssessmentInformationUiDto
  - `assessmentId` string, uuid: UUID of the assessment
  - `assessmentNumber` integer: Number of the assessment
  - `name` string: Name of the assessment
  - `description` string: Description of the assessment
  - `orgGroup` PrivacyAutomationAssessmentAutomationBasicEntityDetail
    - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
    - `name` string: Display name of the entity (organization name or user's full name)
    - `nameKey` string: Translation key for the name, used for internationalization
  - `template` PrivacyAutomationAssessmentAutomationTemplateHeaderInformation
    - `id` string, uuid
    - `name` string
    - `templateType` 'PIA' | 'VENDOR' | 'RA' | 'GRA' | 'DINA' | 'BENCHMARKING' | 'ITRM' | 'CONTROL' | 'INCIDENT' | 'EXCHANGE' | 'ESG' | 'DISCLOSURE' | 'DISCLOSURE_YOY' | 'ERM' | 'TPDD' | 'AIGOVERNANCE' | 'DYNAMIC'
    - `templateVersion` integer
    - `hasApproverSection` boolean
    - `nameKey` string
    - `translatedLanguageCodes` string[]
    - `templateLanguageCode` string
  - `firstAssignedTemplateId` string, uuid: Template ID to which the assessment was originally assigned
  - `status` 'NOT_STARTED' | 'IN_PROGRESS' | 'UNDER_REVIEW' | 'COMPLETED': Current stage of the assessment
  - `result` string: Result of the assessment
  - `createdBy` PrivacyAutomationAssessmentAutomationBasicEntityDetail
    - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
    - `name` string: Display name of the entity (organization name or user's full name)
    - `nameKey` string: Translation key for the name, used for internationalization
  - `createdDT` string, date-time: Date and time the assessment was created
  - `sectionHeaders` PrivacyAutomationAssessmentAutomationAssessmentSectionHeaderInformation[]: List of section headers for the assessment
    - `sectionId` string, uuid: Unique identifier for the section
    - `name` string: Name of the section
    - `description` string: Description of the section
    - `sequence` integer: Sequence number indicating the order of the section in the assessment
    - `hidden` boolean: Indicates if the section is hidden based on navigation rules
    - `invalidQuestionIds` unknown[]
      - unknown
    - `requiredUnansweredQuestionIds` unknown[]
      - unknown
    - `requiredQuestionIds` unknown[]
      - unknown
    - `unansweredQuestionIds` unknown[]
      - unknown
    - `effectivenessQuestionIds` string[]
    - `autoAnsweredQuestionIds` string[]
    - `riskStatistics` PrivacyAutomationAssessmentAutomationRiskStatistics
      - `sectionId` string, uuid
      - `riskCount` integer
      - `maxRiskLevel` integer
    - `status` string: Current status of the section
    - `nameKey` string: Translation key for the section name
    - `descriptionKey` string: Translation key for the section description
    - `openNMIQuestionIds` unknown[]
      - unknown
    - `sectionUserType` 'APPROVER' | 'RESPONDENT': Type of user assigned to the section (e.g., RESPONDENT, APPROVER)
    - `flaggedQuestionIds` unknown[]
      - unknown
    - `submitted` boolean
  - `section` PrivacyAutomationAssessmentAutomationAssessmentSectionInformationUiDto
    - `sectionId` string, uuid
    - `name` string
    - `description` string
    - `hidden` boolean
    - `invalidQuestionIds` string[]
    - `requiredUnansweredQuestionIds` string[]
    - `requiredQuestionIds` string[]
    - `unansweredQuestionIds` string[]
    - `effectivenessQuestionIds` string[]
    - `autoAnsweredQuestionIds` string[]
    - `riskStatistics` PrivacyAutomationAssessmentAutomationSectionRiskStats
      - `sectionId` string, uuid
      - `riskCount` integer
      - `maxRiskLevel` integer
    - `hasNavigationRules` boolean
    - `submittedBy` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
      - `name` string: Display name of the entity (organization name or user's full name)
      - `nameKey` string: Translation key for the name, used for internationalization
    - `submittedDt` string, date-time
    - `nameKey` string
    - `descriptionKey` string
    - `submitted` boolean
  - `approvers` PrivacyAutomationAssessmentAutomationApproverInformation[]: List of approvers for the assessment
    - `id` string, uuid
    - `workflowStageId` string, uuid
    - `name` string
    - `approver` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail
      - `id` string, uuid: Unique identifier of the user
      - `fullName` string: Full name of the user
      - `email` string: Email address of the user
      - `deleted` boolean: Flag indicating whether the user has been deleted
      - `assigneeType` string: Type of assignee (e.g., USER, GROUP)
    - `approvedOn` string, date-time
    - `approvalState` 'OPEN' | 'APPROVED' | 'REJECTED'
    - `resultId` string, uuid
    - `resultName` string
    - `resultNameKey` string
    - `approverAssignedDate` string, date-time: Date and time when the approver was assigned to the assessment.
  - `respondents` PrivacyAutomationAssessmentAutomationBasicEntityDetail[]: List of respondents for this assessment
    - `id` string, uuid: Unique identifier of the entity (organization group, user, etc.)
    - `name` string: Display name of the entity (organization name or user's full name)
    - `nameKey` string: Translation key for the name, used for internationalization
  - `deadline` string, date-time: Deadline to complete the assessment (format: YYYY-MM-DDTHH:MM:SS.FFFZ)
  - `reminder` integer: Number of days before the deadline when the reminder should be sent
  - `reminderSchedules` PrivacyAutomationAssessmentAutomationReminderScheduleDto[]: List of reminder schedules to be sent before the deadline
    - `id` string, uuid: Unique identifier for the reminder schedule.
    - `assessmentId` string, uuid: Identifier of the assessment this reminder schedule applies to.
    - `sectionId` string, uuid: Identifier of a specific assessment section this reminder schedule targets (optional).
    - `reminderInterval` integer: Interval in days between consecutive reminders.
    - `reminderReceiverEntityType` 'APPROVER' | 'RESPONDENT' | 'ALL', required: Recipient type who will receive the reminder notifications.
  - `canSubmit` boolean: Indicates if the assessment or sections can be submitted
  - `canApproveAssessment` boolean: Indicates if the assessment can be approved
  - `displayState` 'REFRESH_NONE' | 'REFRESH_ALL' | 'REFRESH_PARTIAL': Assessment display state, used only by the OneTrust user interface
  - `questions` PrivacyAutomationAssessmentAutomationAssessmentQuestionInformationUiDto
    - `allIds` string[]: Ordered set of all question UUIDs
    - `byId` object: Map of question UUID to the question details
  - `inventoryLinks` PrivacyAutomationAssessmentAutomationInventoryLink[]: Set of inventory links associated with the assessment
    - `type` string: Type of the link
    - `link` string: URL of the link
  - `hasRequestInformation` boolean: Indicates if the assessment has request information
  - `invalidQuestionToRiskIdMap` object: Map of invalid question IDs to their associated risk IDs
  - `invalidQuestionToIssueIdMap` object: Map of invalid question IDs to their associated issue IDs
  - `laws` string[]: List of laws associated with the assessment
  - `maturityType` 'BASIC' | 'ADVANCED' | 'EXPERT': Complexity level of the assessment's response
  - `tags` PrivacyAutomationAssessmentAutomationTagEntityDetail[]: List of tags associated with the assessment
    - `id` string, uuid: Unique identifier for the tag
    - `option` string: Display text for the tag that appears in the UI
  - `reviewChangedResponses` boolean
  - `parentAssessmentId` string, uuid: UUID of the assessment from which this assessment is copied
  - `editAllResponsesWhenInProgress` boolean
  - `primaryInventoryName` string
  - `primaryInventoryNumber` integer
  - `userAssignmentMode` 'ASSESSMENT' | 'SECTION'
  - `assessmentProgressInformation` PrivacyAutomationAssessmentAutomationAssessmentProgressInformation
    - `totalQuestions` integer
    - `respondedQuestions` integer
    - `flaggedQuestions` integer
  - `welcomeSectionInformation` PrivacyAutomationAssessmentAutomationWelcomeSection
    - `gettingStartedBannerEnabled` boolean: Indicates if the getting-started banner is enabled
    - `welcomeTitle` string: Title of the welcome section
    - `welcomeText` string: Text of the welcome section
    - `welcomeTitleKey` string
    - `welcomeTextKey` string
    - `hideWelcomeSection` boolean: Indicates if the welcome section is hidden
  - `viewer` boolean
  - `welcomeSection` boolean
  - `firstSection` boolean
  - `lastSection` boolean
  - `welcomeText` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500`: Internal Server Error

---

[API](https://skmtc.dev/onetrust/apis/privacy-automation-assessment-automation.md) - [All operations](https://skmtc.dev/onetrust/apis/privacy-automation-assessment-automation/llms.txt) - [OpenAPI document](https://skmtc.dev/onetrust/apis/privacy-automation-assessment-automation/revisions/fbdf0c71bfe5?raw)