---
title: "Create Assessment"
method: POST
path: "/assessments"
tags: ["assessments"]
---

# Create Assessment

`POST /assessments`

## Request

- Base URL: `https://api.openproof.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openproof.io/assessments`
- Auth: HTTP bearer

Save an assessment. Unwraps nested payload if frontend sent {responses:{...}, score:{...}}.

RBAC note (Tier 4, 7 Aug 2026): business_id is resolved via
get_active_business_id_optional -- for a normal single-user account
this is just current_user.id, unchanged. For an invited teammate, it
resolves to the BUSINESS OWNER's id, so the assessment is correctly
attributed to the shared business. owner_user (may differ from
current_user) is used wherever plan/company_name/activated_at need
to reflect the business. The notification email still goes to
current_user (whoever actually submitted it), not the owner.

## Request body

- AssessmentCreate
  - `responses` object, required
  - `score` object, nullable
  - `company_name` string, nullable
  - `email` string, nullable

## Response `200`

Successful Response

- AssessmentResponse
  - `id` string, required
  - `report_ref` string, required
  - `responses` object, required
  - `scores` object, nullable
  - `fix_list` object[], nullable
  - `overall` integer, nullable
  - `band` string, nullable
  - `fixed_count` integer, nullable
  - `completed_at` string, date-time, nullable
  - `created_at` string, date-time, required
  - `version_stamp` string, required
  - `company_name` string, nullable
  - `plan_limit_warning` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/openproof/apis/openproof-api.md) · [All operations](https://skmtc.dev/openproof/apis/openproof-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openproof/apis/openproof-api/revisions/ddd0cac7c37e?raw)