Document Submission - SANNOS Partner API

Uploads documents and initiates compliance analysis in a single call. Two mutually exclusive submission modes. Endpoint: POST /v2/documents/submit (Company Key) — multipart/form-data

Partner ──POST /v2/documents/submit──> API ──> Validate files (max 50MB each)
                                           ──> Validate complianceFrameworkId + controlId (Mode A)
                                           ──> Create or append to Compliance Review
                                           ──> Upload and convert documents to PDF
                                           ──> Queue for async compliance analysis
       <── 200 OK ──────────────────── API
           { documentId, complianceReviewId, status: "Pending",
             files, controlItemCount }

Form data fields:

Field	Type	Required	Description
`files`	File[]	Yes	First = parent doc, rest = appendices
`organizationUnitId`	string	XOR	Creates new compliance review under an organization unit of any type (see Organization Units)
`complianceReviewId`	string	XOR	Appends to existing review
`controlId`	string	No	Control to use for a new review (from GET /v2/compliance-frameworks, nested in framework). Defaults to your partner’s configured default control
`selectedControlItemIds`	JSON string	No	Subset of control items to evaluate
`selectedControlClusterIds`	string	Optional	JSON array of cluster ULIDs. All non-obsolete items within those clusters are included. Unioned with `selectedControlItemIds` if both are provided.
`auditLanguageId`	string	No	Language for analysis output

Control Item Selection: Use selectedControlClusterIds, selectedControlItemIds, or both to narrow the analysis scope:

Both provided → union of cluster items and individual items
Clusters only → all non-obsolete items within those clusters
Items only → only those specific items
Neither → all non-obsolete items across the entire control (default)

Invalid cluster IDs (not belonging to the active control) return 422. Response (200):

{
  "documentId": "01HXYZ...",
  "complianceReviewId": "01HXYZ...",
  "status": "Pending",
  "files": [
    { "fileName": "policy.pdf", "type": "parent" },
    { "fileName": "appendix.pdf", "type": "child" }
  ],
  "controlItemCount": 15,
  "message": "Document submitted successfully"
}

Constraints:

Max 50MB per file
Supported formats: PDF, DOCX, XLSX, PPTX
organizationUnitId and complianceReviewId are mutually exclusive — provide exactly one. Both or neither returns 422 with Provide either complianceReviewId OR organizationUnitId, not both or neither.
An organizationUnitId that is not found, is archived or belongs to another company returns 422 with genericErrors: Organization unit not found or access denied

Still on the v1 submit route? It is deprecated; see Migrating to v2.