---
title: "Create Audit"
method: POST
path: "/api/audit-management/v1/audits"
tags: ["Audits"]
---

# Create Audit

`POST /api/audit-management/v1/audits`

## Request

- Base URL: `https://hostname`
- URL: `https://hostname/api/audit-management/v1/audits`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://{hostname}/api/access/v1/oauth/token` scopes: `AUDIT_MANAGEMENT`

Use this API to create a new audit.

## Request body

- AuditCreateModel
  - `header` AuditHeaderModel, required
    - `name` string, required: Audit Name
    - `auditTypeId` string, uuid, required: Audit Type Identifier
    - `goal` string: The goal of the Audit.
    - `startDate` string, date: Audit Start Date
    - `endDate` string, date: Audit End Date
  - `auditSourceType` 'NONE' | 'VENDOR' | 'ASSET' | 'PROCESING_ACTIVITY', required: Audit source type
  - `orgGroup` OrgGroupAssignmentModel, required
    - `id` string, uuid, required: Audit Organization Group Identifier
    - `name` string: Audit Organization Group
  - `framework` FrameworkAssignmentModel, required
    - `id` string, uuid, required: Framework Identifier
    - `name` string: Framework Name
  - `auditors` UserAssignmentModel[], required: List of auditors. A minimum of one auditor has to be assigned to the audit
    - `email` string, required: Email
  - `approvers` UserAssignmentModel[], required: List of approvers. A minimum of one approver has to be assigned to the audit
    - `email` string, required: Email
  - `scopes` ScopesAssignmentRequest[], required: List of scopes (controls). A minimum of one scope has to be assigned to the audit
    - `controlId` string, uuid, required: The guid of Master Control for the Audit Scope. This should match the framework of the Audit.
    - `auditorEmail` string: The email address of the Auditor to be assigned to the scope.
    - `approverEmail` string: The email address of the Approver to be assigned to the scope.
  - `attributes` object: Custom Attributes

## Response `201`

Created

- string, uuid

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500`: Internal Server Error

---

[API](https://skmtc.dev/onetrust/apis/tech-risk-compliance-audit-management.md) - [All operations](https://skmtc.dev/onetrust/apis/tech-risk-compliance-audit-management/llms.txt) - [OpenAPI document](https://skmtc.dev/onetrust/apis/tech-risk-compliance-audit-management/revisions/b01323a55e99?raw)