---
title: "List the assets of the company an answer request is about"
method: GET
path: "/api/questionnaires/requests/{requestId}/assets"
tags: ["Questionnaire Responses"]
---

# List the assets of the company an answer request is about

`GET /api/questionnaires/requests/{requestId}/assets`

The documents, certificates or audits held by the company a questionnaire request is *about* — the picker behind every asset-link question. The company comes from the request's `onBehalfOfCompanyId`, never from the caller. Readable by **all three** parties to the request: the answering company selecting an asset, the brand reviewing the answer, and the subject company itself; anyone else gets 404 `request_not_found`. This exists because the generic pickers reach these rows through the caller's own network (certificates) or through per-asset sharing rows (audits), so a delegated answering party saw an empty list and could only ever create a new asset, never select one the company already holds — and a linked asset rendered blank when the page was reopened. Archived and soft-deleted assets are excluded.

## Path parameters

- `requestId` string, required

## Query parameters

- `bucket` 'document' | 'certificate' | 'audit', required

## Response `200`

Default Response

- object
  - `metadata` object, required
    - `success` boolean, required — True when the request succeeded.
  - `data` object, required
    - `assets` object[], required
      - `id` string, required
      - `subTypeId` string, required
      - `subTypeName` string, required
      - `name` string, required
      - `hasFile` boolean, required
      - `issuedAt` unknown, required
      - `expiresAt` unknown, required
      - `details` union, required
        - object
          - `bucket` 'document', required
          - `file` object, required
            - `fileId` string, required
            - `fileUrl` string, required
            - `fileType` string, required
            - `contentType` string, required
            - `fileName` string, required
        - object
          - `bucket` 'certificate', required
          - `standardType` string, required
          - `status` string, required
          - `issuedBy` string, required
          - `documentNumber` string, required
          - `licenseNumber` string, required
          - `file` object, required
            - `fileId` string, required
            - `fileUrl` string, required
            - `fileType` string, required
            - `contentType` string, required
            - `fileName` string, required
        - object
          - `bucket` 'audit', required
          - `referenceNumber` string, required
          - `auditedBy` string, required
          - `facilityScore` string, required
          - `auditReportFile` object, required
            - `fileId` string, required
            - `fileUrl` string, required
            - `fileType` string, required
            - `contentType` string, required
            - `fileName` string, required
          - `correctiveActionPlanFile` object, required
            - `fileId` string, required
            - `fileUrl` string, required
            - `fileType` string, required
            - `contentType` string, required
            - `fileName` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response

## Changes

> 21 revisions in range; 1 not diffed.

- **2026-08-24** `d1450ba9a75a` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/retraced/apis/api-reference/changes/api/questionnaires/requests/:requestId/assets/get.md)

---

[API](https://skmtc.dev/retraced/apis/api-reference.md) · [All operations](https://skmtc.dev/retraced/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/retraced/api-reference/revisions/1df37791a1bb/schema)