--- title: "Search Assessments" method: POST path: "/api/assessment/v2/assessments/search" tags: ["Assessments"] --- # Search Assessments `POST /api/assessment/v2/assessments/search` ## Request - Base URL: `https://hostname` - URL: `https://hostname/api/assessment/v2/assessments/search` - Auth: OAuth 2 - Client credentials - Token URL: `https://{hostname}/api/access/v1/oauth/token` scopes: `ASSESSMENT_READ`, `ASSESSMENT` Use this API to search assessments across the tenant based on template type and filter criteria. The response returns a list of matching assessments up to the specified `limit`, along with `totalCount` and `hasMore` values to indicate whether additional assessments are available. ## Query parameters - `templateTypes` string[], required - `text` string - `limit` integer - `sort` string[] ## Request body - PrivacyAutomationAssessmentAutomationAssessmentMcpListRequest - `filterCriteria` PrivacyAutomationAssessmentAutomationSearchCriteriaInformation[]: Criteria to filter the assessment list by. Each item filters on one field. - `field` string: The field name to apply the search criterion to - `operation` '=' | '!=' | '<' | '>' | 'BW' | 'IN' | 'NOT IN' | 'EMPTY': The operation to apply. - `value` union: The value to compare against. Can be a single value or a list of values depending on the operation - object - string - number - boolean - unknown[] - unknown - `toValue` union: The upper bound value for 'between' operations - object - string - number - `assessmentListViewType` 'VENDOR_VIEW' | 'CONTROL_VIEW' | 'ASSESSMENT_AUTOMATION_LIST_VIEW' | 'DATA_MAPPING_LIST_VIEW' | 'ITRM_LIST_VIEW' | 'INCIDENT_LIST_VIEW' | 'ESG_LIST_VIEW' | 'ENGAGEMENT_LIST_VIEW' | 'EXCHANGE_LIST_VIEW' | 'DISCLOSURE_LIST_VIEW' | 'EMPLOYEE_DISCLOSURE_LIST_VIEW' | 'TPDD_LIST_VIEW' | 'GENERAL_LIST': View type to load assessments for. Ignored by the linked assessments endpoint, which derives it from entityTypeReference. Defaults to ASSESSMENT_AUTOMATION_LIST_VIEW on the search endpoint. - `visibleColumns` string[]: Column names to include in the response. Omit or send an empty list to use the default set of columns. - `adminOnlyView` boolean: Loads the admin view. Used by the search endpoint only. ## Response `200` OK - PrivacyAutomationAssessmentAutomationAssessmentMcpListResponseAssessmentListViewResponseV2 - `content` PrivacyAutomationAssessmentAutomationAssessmentListViewResponseV2[]: The assessment data content, capped at the requested limit - `assessmentId` string, uuid: Unique identifier for the assessment - `number` integer: Assessment number used for reference - `name` string: Name of the assessment - `status` 'NOT_STARTED' | 'IN_PROGRESS' | 'UNDER_REVIEW' | 'COMPLETED': Current status of the assessment - `result` string: Result of the assessment approval process - `orgGroupId` string, uuid: Unique identifier of the organization group this assessment belongs to - `orgGroupName` string: Name of the organization group this assessment belongs to - `assessmentCreatedBy` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `respondent` string - `respondents` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail[] - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `approver` string - `creator` string: Name of the assessment creator - `approvers` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail[] - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `deadline` string, date-time: Deadline date for assessment completion - `createDT` string, date-time: Date and time when the assessment was created - `createdBy` string, uuid: Unique identifier of the user who created the assessment - `completedOn` string, date-time: Date and time when the assessment was completed - `completedBy` string, uuid: Unique identifier of the user who completed the assessment - `templateId` string, uuid: Unique identifier of the template used for this assessment - `templateRootVersionId` string, uuid: Unique identifier of the template root version - `templateName` string: Name of the template used for this assessment - `assessmentRiskLevelId` integer: Identifier of the assessment risk level - `assessmentRiskScore` number: Numerical score representing the assessment risk - `assessmentRiskLevelName` string: Name of the assessment risk level - `templateType` 'PIA' | 'VENDOR' | 'ITRM' | 'CONTROL' | 'INCIDENT' | 'EXCHANGE' | 'ESG' | 'DISCLOSURE' | 'DISCLOSURE_YOY' | 'ERM' | 'TPDD' | 'AIGOVERNANCE': Type of the assessment template - `templateVersion` integer: Version number of the template - `editAllResponsesWhenInProgress` boolean: Flag indicating if all responses can be edited when assessment is in progress - `deletedDT` string, date-time: Date and time when the assessment was deleted (if applicable) - `deletedBy` string, uuid: Unique identifier of the user who deleted the assessment - `assessmentDeletedBy` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `assessmentCompletedBy` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `pendingReviews` string: Comma-separated list of pending reviewer names - `pendingReviewers` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail[]: Set of pending reviewer user details - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `submittedDT` string, date-time: Date and time when the assessment was submitted - `canResendLink` boolean: Flag indicating if assessment link can be resent - `inherentRiskScore` number: Numerical score representing the inherent risk - `inherentRiskLevelId` integer: Identifier of the inherent risk level - `inherentRiskLevelName` string: Name of the inherent risk level - `primaryRecordName` string: Name of the primary record associated with this assessment - `primaryRecordNumber` string: Reference number of the primary record - `targetRiskScore` number: Target numerical score for risk after mitigation - `targetRiskLevelId` integer: Identifier of the target risk level - `targetRiskLevelName` string: Name of the target risk level - `workflowId` string, uuid: Unique identifier of the workflow - `workflowStageId` string, uuid: Unique identifier of the current workflow stage - `workflowName` string: Name of the workflow - `approvalStageName` string: Name of the current approval stage - `badgeColor` string: Color code for the approval stage badge - `updatedDT` string, date-time: Date and time when the assessment was last updated - `assessmentDeleteStatus` 'ACTIVE' | 'SOFT_DELETED' | 'HARD_DELETED': Status of assessment deletion - `attestationRequired` boolean: Flag indicating if attestation is required - `attestationCompleted` string, date-time: Date and time when attestation was completed - `finalComment` string: Final comment provided on the assessment - `openRiskCount` integer: Count of open risks associated with this assessment - `openInfoRequestCount` integer: Count of open information requests associated with this assessment - `tags` string: Comma-separated list of tags associated with the assessment - `redacted` boolean: Flag indicating if the assessment is redacted - `assessmentDetailUrl` string: URL link to the assessment - `recordAdminId` string, uuid: Unique identifier of the record admin user - `recordAdmin` PrivacyAutomationAssessmentAutomationBasicUserEntityDetail - `id` string, uuid: Unique identifier of the user - `fullName` string: Full name of the user - `email` string: Email address of the user - `deleted` boolean: Flag indicating whether the user has been deleted - `assigneeType` string: Type of assignee (e.g., USER, GROUP) - `totalCount` integer: Total number of assessments matching the given criteria, independent of the limit applied - `hasMore` boolean: Whether more assessments exist beyond the ones returned in content, i.e. totalCount > content.size() ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden - `429`: Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview). - `500`: Internal Server Error --- [API](https://skmtc.dev/onetrust/apis/privacy-automation-assessment-automation.md) - [All operations](https://skmtc.dev/onetrust/apis/privacy-automation-assessment-automation/llms.txt) - [OpenAPI document](https://skmtc.dev/onetrust/apis/privacy-automation-assessment-automation/revisions/fbdf0c71bfe5?raw)