Every API here is available over the APIs.io API and to AI agents over MCP.
openapi: 3.2.0
info:
title: Privacy Automation - Assessment Automation Assessments API
version: '1.0'
contact:
name: OneTrust Support
url: https://my.onetrust.com/s/contactsupport
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0
description: The Assessment Automation APIs provide functionality for managing assessment template lifecycle operations, including template export and import for cross-environment migration, retrieving published template metadata with filtering by template type, and template deletion with comprehensive validation checks.
servers:
- url: https://{hostname}
variables:
hostname:
default: hostname
description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:
- name: Assessments
description: The Assessments APIs are used to retrieve assessment data and details.
externalDocs:
description: OpenAPI 3.1.0 - Download Definition
url: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
x-displayName: Assessments
paths:
/api/assessment/v2/assessment-tags:
get:
operationId: getTagsUsingGET
summary: Get List of Assessment Tags
description: 'Use this API to retrieve all available assessment tags that can be used to categorize or label assessments.
> 🗒 Things to Know
>
> - The list of tag IDs returned in the response can be used to update a specific assessment''s tag using the Update Assessment Tags API.'
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_TagEntityDetail'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments:
get:
operationId: getAllAssessmentBasicDetailsUsingGET
summary: Get List of Assessments
description: 'Use this API to retrieve a list of all assessments with basic assessment details. The response will include details such as the assessment ID, number, stage, result, and associated organization.
> 🗒 Things to Know
>
> - All assessments regardless of their stage are returned in the response by default.
>
> - The assessments can be filtered by stage using the `assessmentStatuses` query parameter.
>
> - The `size` and `page` query parameters can be used to paginate the response (list of assessments). The `size` parameter defines the number of assessments to be returned in each page. The `page` parameter defines the page number. The first page and default `page` is page number 0. The `size` parameter is optional and default value is 20, but cannot exceed 2000. If you input a value greater than 2000, then 2000 will be used for the `size`.'
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
parameters:
- name: templateTypes
in: query
description: 'List of template types to filter assessments by. Available options:
- **PIA** (PIA & DPIA Automation)
- **VENDOR** (Third-Party Risk Management)
- **ITRM** (IT & Security Risk Management)
- **CONTROL** (Risk and Controls)
- **INCIDENT** (Incident Management)
- **EXCHANGE** (Third-Party Risk Exchange)
- **ESG** (ESG Program Reporting)
- **DISCLOSURE** (Disclosure Management)
- **DISCLOSURE_YOY** (Year Over Year Disclosures)
- **ERM** (Enterprise Risk Management)
- **TPDD** (Third-Party Due Diligence)
- **AIGOVERNANCE** (AI Governance)'
required: false
schema:
type: array
items:
type: string
description: Template types used in assessments
enum:
- PIA
- VENDOR
- ITRM
- CONTROL
- INCIDENT
- EXCHANGE
- ESG
- DISCLOSURE
- DISCLOSURE_YOY
- ERM
- TPDD
- AIGOVERNANCE
example:
- PIA
- VENDOR
- ITRM
- name: assessmentStatuses
in: query
description: List of assessment statuses to filter by
required: false
schema:
type: array
items:
type: string
enum:
- NOT_STARTED
- IN_PROGRESS
- UNDER_REVIEW
- COMPLETED
example:
- NOT_STARTED
- IN_PROGRESS
- UNDER_REVIEW
- COMPLETED
- name: assessmentArchivalState
in: query
description: Filter by archival state
required: false
schema:
type: string
enum:
- ALL
- ARCHIVED
- NON_ARCHIVED
example: NON_ARCHIVED
- name: page
in: query
description: Results page to be retrieved (0..N). Example- '?page=1
schema:
type: integer
format: int32
default: 0
minimum: 0
example: 1
- name: size
in: query
description: Number of records per page (1…N).
schema:
type: integer
format: int32
default: 20
maximum: 2000
minimum: 1
example: 20
- name: sort
in: query
description: 'Sorting criteria in the format: property(,asc|desc). Default sort order is ascending. Multiple sort criteria are supported.'
schema:
type: string
default: createdDate,desc
enum:
- number,asc
- number,desc
- status,asc
- status,desc
- createdDate,asc
- createdDate,desc
- name,asc
- name,desc
- result,asc
- result,desc
- orgGroupName,asc
- orgGroupName,desc
- deadline,asc
- deadline,desc
- openRiskCount,asc
- openRiskCount,desc
- openInfoRequestCount,asc
- openInfoRequestCount,desc
example: createdDate,desc
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_PageAssessmentListViewBasicDto'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments/activities/types/assessmentdelete:
get:
operationId: getAssessmentDeleteLogsUsingGET
summary: Export Deleted Assessment Audit Log
description: 'Use this API to export a log of all deleted assessments. The response will include details such as the assessment name, assessment ID, user who deleted the assessment, and deletion timestamp.
> 🗒 Things to Know
>
> - The exported log only includes assessments deleted after OneTrust 4.1.'
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentDeleteLogInformation'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments/assessment-results:
get:
operationId: getAssessmentResultsUsingGET
summary: Get List of Assessment Results
description: Use this API to retrieve a list of all assessment result options that can be used to complete an assessment. The `id` corresponding to each result option in the response can be used to complete assessments using the Complete Assessment API.
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
parameters:
- name: filterValue
in: query
description: Filter to apply when retrieving assessment results. Use ACTIVE_EXCLUDING_INTERNAL to exclude internal results.
required: false
schema:
type: string
enum:
- ACTIVE_EXCLUDING_INTERNAL
example: ACTIVE_EXCLUDING_INTERNAL
- name: templateTypes
in: query
description: 'List of template types to filter assessment results by. Available options:
- **PIA** (PIA & DPIA Automation)
- **VENDOR** (Third-Party Risk Management)
- **ITRM** (IT & Security Risk Management)
- **CONTROL** (Risk and Controls)
- **INCIDENT** (Incident Management)
- **EXCHANGE** (Third-Party Risk Exchange)
- **ESG** (ESG Program Reporting)
- **ERM** (Enterprise Risk Management)
- **TPDD** (Third-Party Due Diligence)
- **AIGOVERNANCE** (AI Governance)'
required: false
schema:
type: array
items:
type: string
description: Template types used in assessments
enum:
- PIA
- VENDOR
- ITRM
- CONTROL
- INCIDENT
- EXCHANGE
- ESG
- DISCLOSURE
- DISCLOSURE_YOY
- ERM
- TPDD
- AIGOVERNANCE
example:
- PIA
- VENDOR
- ITRM
- name: includeMasterResults
in: query
description: Flag to include master results
required: false
schema:
type: boolean
default: true
example: false
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentResultDto'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments/reference-objects/{id}/assessments:
get:
operationId: getLinkedAssessmentsInformationUsingGET
summary: Get List of Linked Assessments
description: 'Use this API to retrieve a list of all assessments linked to a particular record. The linked assessments list will support all copied, reassessed, and rule triggered related assessments.
> 🗒 Things to Know
>
> - The following APIs can be used to retrieve the record ID (`id`):
>
> - For Assets, Processing Activities, & Entities, use the Get List of Inventories API.
>
> - For Vendors, use the List Vendors API.
>
> - For Engagements, use the Get List of Engagements API.
>
> - For Incidents, use the List Incidents API.
>
> - For Control Implementations, use the List Controls API.
>
> - If the ID does not match the entered reference-object from the URL, 0 results will be returned.'
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
parameters:
- name: id
in: path
description: UUID of the reference object
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
- name: referenceType
in: query
description: Type of reference object
required: true
schema:
type: string
enum:
- INVENTORY
- CONTROL_IMPLEMENTATION
- ENGAGEMENT
- INCIDENT
- CUSTOM_ENTITY
- DYNAMIC
example: INVENTORY
- name: linkTypes
in: query
description: Types of links to filter by
required: false
schema:
type: array
items:
type: string
enum:
- PRIMARY
- AUTO
- MANUAL
example:
- PRIMARY
- AUTO
- name: page
in: query
description: Results page to be retrieved (0..N)
schema:
type: integer
format: int32
default: 0
minimum: 0
example: 0
- name: size
in: query
description: Number of records per page (1…N)
schema:
type: integer
format: int32
default: 20
maximum: 2000
minimum: 1
example: 20
- name: sort
in: query
description: 'Sorting criteria in the format: property(,asc|desc). Default sort order is ascending. Multiple sort criteria are supported.'
schema:
type: string
default: createdDate,desc
enum:
- number,asc
- number,desc
- status,asc
- status,desc
- createdDate,asc
- createdDate,desc
- name,asc
- name,desc
- result,asc
- result,desc
- orgGroupName,asc
- orgGroupName,desc
- deadline,asc
- deadline,desc
- openRiskCount,asc
- openRiskCount,desc
- openInfoRequestCount,asc
- openInfoRequestCount,desc
example: createdDate,desc
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_PageLinkedAssessmentInformation'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments/{assessmentId}/export:
get:
operationId: exportAssessmentUsingGET
summary: Get Assessment
description: 'Use this API to retrieve details of a specific assessment. The response will include details such as basic assessment information, respondents, approvers, assessment questions and responses, and assessment risks.
> 🗒 Things to Know
>
> - The API response body will include all assessment responses received for that assessment after the assessment was launched. If a response record references an object (such as vendors, engagements, or assets) that was subsequently deleted from the OneTrust Platform after the assessment was launched, that record would still be included within the response body but would no longer exist in the OneTrust Platform.'
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
parameters:
- name: assessmentId
in: path
description: UUID of the assessment to export
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
- name: excludeSkippedQuestions
in: query
description: Flag to exclude skipped questions from the export
required: false
schema:
type: boolean
default: false
example: false
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentExportInformation'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments/{assessmentId}/record:
get:
operationId: getAssessmentRecordUsingGET
summary: Get Assessment Record
description: Use this API to retrieve an assessment record containing basic assessment information, sections with questions and responses, and current status. By default, returns a lightweight version that excludes risk information, approvers, respondents, attachments, and other detailed metadata. Set showAllDetails=true to get the full export equivalent response.
tags:
- Assessments
parameters:
- name: assessmentId
in: path
description: UUID of the assessment
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
- name: showAllDetails
in: query
description: When true, returns the full assessment export with all details including risks, approvers, respondents, attachments, etc. When false (default), returns a lightweight record with only basic info, sections, questions, and responses.
required: false
schema:
type: boolean
default: false
example: false
- name: excludeSkippedQuestions
in: query
description: Flag to exclude skipped questions (only applicable when showAllDetails=true)
required: false
schema:
type: boolean
default: false
example: false
responses:
'200':
description: OK
content:
application/json:
schema:
type: string
oneOf:
- $ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentRecordInformation'
- $ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentExportInformation'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT_READ
- ASSESSMENT
/api/assessment/v2/assessments/{assessmentId}/score-profiles:
get:
operationId: getAssessmentScoreProfilesWithQuestionBreakdownUsingGET
summary: Get Assessment Score Profiles
description: 'Use this API to retrieve comprehensive score profile information for an assessment, including:
- Overall profile scores
- Question-level score breakdown
- Section and question names
- Selected options with individual scores
- Question weights and scoring types
> Things to Know
>
> - This API returns data only for assessments that have been submitted and have calculated score profiles.
>
> - Score profiles must be configured in the assessment template.
>
> - The response includes detailed breakdown of how each question contributed to the overall profile score.
>
> - Returns an empty list if no score profiles are configured or no scores have been calculated.
>
> - Each question score includes the selected options and their individual contribution to the score.
>
> - Question weights show how much each question contributes to the overall profile score.'
tags:
- Assessments
parameters:
- name: assessmentId
in: path
description: The unique ID of the assessment for which to retrieve score profiles.
required: true
schema:
type: string
format: uuid
example: 123e4567-e89b-12d3-a456-426614174000
responses:
'200':
description: Successfully retrieved score profiles with question breakdown
content:
application/json:
schema:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentProfileScoreWithQuestionsDto'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Access denied to the assessment
content:
'*/*':
schema:
type: array
items:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentProfileScoreWithQuestionsDto'
'404':
description: Assessment not found
content:
'*/*':
schema:
type: array
items:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_AssessmentProfileScoreWithQuestionsDto'
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
headers:
Retry-After:
schema:
description: The number of seconds after which requests will be allowed again.
format: int32
ot-period:
schema:
description: The unit of time for which the rate limit applies
enum:
- HOUR
- MINUTE
ot-ratelimit-event-id:
schema:
description: The unique identifier for the rate-limiting event.
format: uuid
ot-request-made:
schema:
description: The number of requests made within the specified period.
format: int32
ot-requests-allowed:
schema:
description: The number of requests allowed within the specified period.
format: int32
'500':
description: Internal Server Error
security:
- PrivacyAutomation-AssessmentAutomation_OAUTH2:
- ASSESSMENT
- ASSESSMENT_READ
/api/assessment/v2/assessments/{assessmentId}/workflows:
get:
operationId: getWorkflowDetailsForAssessmentUsingGET
summary: Get Assessment Workflow Stages
description: 'Use this API to retrieve workflow and approval stage details of an assessment. The response will include details such as the workflow ID, workflow name, stage ID, and stage name.
> 🗒 Things to Know
>
> - Workflow stage indicates the current stage of the workflow that the assessment is in.'
tags:
- Assessments
x-onetrust:
spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-assessment-automation.json
parameters:
- name: assessmentId
in: path
description: The unique ID of the assessment to retrieve workflow details for
required: true
schema:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PrivacyAutomation-AssessmentAutomation_WorkflowAndApprovalStageDetails'
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
# --- truncated at 32 KB (115 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-assessments-api-openapi.yml