---
title: "Create an audit on the company an answer request is about"
method: POST
path: "/api/questionnaires/requests/{requestId}/audits"
tags: ["Questionnaire Responses"]
---

# Create an audit on the company an answer request is about

`POST /api/questionnaires/requests/{requestId}/audits`

Creates an audit as the answer to an AUDIT question, on the company the request is *about*. The target company comes from the request's `onBehalfOfCompanyId` and is not accepted in the body. Only the answering company may call it, and only while the brand that issued the request is still connected to it; anyone else gets 404 `request_not_found`. Unlike `POST /api/audits`, the audit is then shared with the subject company **and** with the brand without requiring the sharer to be linked to them — the request is the authorization — so the factory can finally see its own audit. Through the generic endpoint that share needed an answering-party-to-subject connection, which a delegated party never has, so it threw and was swallowed. `isPublic` is not accepted and is always false: a public audit fans a read grant out to every company linked to the uploader, which would expose the subject company's audit to the answering party's entire network. A failed share is reported, not logged and forgotten.

## Path parameters

- `requestId` string, required

## Request body

- object
  - `auditTypeId` string, required
  - `auditDate` string
  - `nextPlannedAuditDate` string
  - `auditedBy` string
  - `facilityScore` string
  - `referenceNumber` string
  - `auditReportFileId` string
  - `correctiveActionPlanFileId` string

## Response `201`

Default Response

- object
  - `metadata` object, required
    - `success` boolean, required — True when the request succeeded.
  - `data` object, required
    - `id` string, required
    - `companyId` string, required
    - `auditTypeId` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response

## Changes

> 21 revisions in range; 1 not diffed.

- **2026-08-24** `d1450ba9a75a` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/retraced/apis/api-reference/changes/api/questionnaires/requests/:requestId/audits/post.md)

---

[API](https://skmtc.dev/retraced/apis/api-reference.md) · [All operations](https://skmtc.dev/retraced/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/retraced/api-reference/revisions/1df37791a1bb/schema)