---
title: "Create a comment on a questionnaire"
method: POST
path: "/vendor/questionnaire/comments/add"
tags: ["vendors"]
---

# Create a comment on a questionnaire

`POST /vendor/questionnaire/comments/add`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/vendor/questionnaire/comments/add`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/vendor/questionnaire/comments/add/post.ts> (a function with typed inputs; its response is checked against the schema)

Comments can be added to a questionnaire at the top-level (for general questionnaire commentary), or attached to specific questions.
Top-level comments can be replied to.
Comment authors can be any user in your organization.

Required API key permissions: `VendorRisk` + `ReadWrite` (select when creating API key in Account Settings)

## Request body

- CreateQuestionnaireCommentRequest
  - `author_email_address` string, required: The email address of the user creating the comment. Must be associated with a user in your organization.
  - `private` boolean: If true, the new comment will be private, visible only to your organization.
  - `question_id` string: If populated, the new comment will be associated with a specific question in the questionnaire. Mutually exclusive with `reply_to_comment_id`, a comment cannot be both a question-specific comment and a reply.
  - `questionnaire_id` integer, required: The ID of the questionnaire to add a comment to.
  - `reply_to_comment_id` integer: If populated, the new comment will be a reply to an existing comment. Must be a top-level comment ID. Mutually exclusive with `question_id`, a comment cannot be both a reply and a question-specific comment.
  - `text` string, required: The comment text (max 4000 characters).

## Response `200`

OK

## Other responses

- `403`: Account does not have access to requested entities
- `404`: The vendor was not found.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/vendor/questionnaire/comments/add/post.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)