Documentation

Quickstart

From policies to approved answers in four calls. Every call carries your tenant API key in the X-Api-Key header — get one from the claim page after checkout, or start the free trial there. Prefer a browser? The console runs this whole flow without code.

1. Upload a policy

Policies are chunked, indexed, and versioned per title — inside your tenant's vault only.

curl -s -H "X-Api-Key: av_live_..." -X POST https://answervault-api.onrender.com/api/policies \
  -H "Content-Type: application/json" \
  -d '{"title":"Security Policy",
       "text":"All production data is encrypted at rest using AES-256..."}'

2. Submit a questionnaire

Questions go in as a JSON list — copy them out of the buyer's SIG, CAIQ, or spreadsheet (direct file upload is on the roadmap). Each question gets a draft quoted from your policies, with evidence and a confidence score.

curl -s -H "X-Api-Key: av_live_..." -X POST https://answervault-api.onrender.com/api/questionnaires \
  -H "Content-Type: application/json" \
  -d '{"name":"Buyer SIG Lite","questions":["Is data encrypted at rest?"]}'

3. Review each answer

Approve, edit (with your own text), or reject. Nothing exports until you decide everything.

curl -s -H "X-Api-Key: av_live_..." -X POST https://answervault-api.onrender.com/api/answers/ans_xxx/decision \
  -H "Content-Type: application/json" \
  -d '{"decision":"edited","edited_text":"Yes — AES-256 at rest, TLS 1.2+ in transit."}'

4. Export

Export is JSON today (Excel/CSV with SIG Lite and CAIQ mappings is on the roadmap), and it is blocked with HTTP 409 until every answer has a human decision.

curl -s -H "X-Api-Key: av_live_..." https://answervault-api.onrender.com/api/questionnaires/qn_xxx/export

Endpoints

POST /api/policies, GET /api/policies — your versioned policy vault.
POST /api/questionnaires, GET /api/questionnaires, GET /api/questionnaires/:id — draft and review.
POST /api/answers/:id/decision — approve, edit, or reject.
GET /api/questionnaires/:id/export — JSON export of decided answers only.
GET /api/account — your plan, questionnaire usage, and seats.
GET /api/keys, POST /api/keys, DELETE /api/keys/:id — seats are API keys; mint and revoke them here or in the console.

Honest limits

Draft answers are quoted from your own uploaded policies — low-confidence questions are flagged for manual drafting, never invented.
We never claim answers are accurate without review; the approval step is mandatory and enforced by the API.
AnswerVault is a responder accelerator, not a compliance platform — no evidence collection, no auditor workflow.