Create an audit

Updated: November 13, 2026

POST/qms/{connection_id}/audit

Creates a QmsAudit. Provide the unified QmsAudit fields in the request body; they are mapped to the provider's API. Returns the created QmsAudit.

Parameters

Payload

An internal, supplier, customer or certification audit

idstring

created_atdate-time

(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)

updated_atdate-time

(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)

numberstring

namestring

descriptionstring

type enum

Valid values:

"INTERNAL"

"SUPPLIER"

"CUSTOMER"

"CERTIFICATION"

"OTHER"

original_typestring

The vendor's own audit type name

status enum

Valid values:

"OPEN"

"IN_PROGRESS"

"IN_REVIEW"

"CLOSED"

"CANCELLED"

Normalized status of a quality record

lifecycle_statestring

Vendor's own state or workflow step name

standardstring

Standard audited against, e.g. AS9100D

scopestring

supplier_namestring

user_idstring

Lead auditor (reference to HrisEmployee)

scheduled_atdate-time

(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)

start_atdate-time

(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)

end_atdate-time

(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)

closed_atdate-time

(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)

issue_idsstring array

Findings, as QmsIssue IDs

file_idsstring array

Attachment IDs retrievable from StorageFile

urlstring

Deep link to the vendor UI

metadata array

raw

Raw data from integration

Returns

QmsAudit

Response field	Type	Required	Description
`id`	string	No
`created_at`	string (date-time)	No	(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)
`updated_at`	string (date-time)	No	(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)
`number`	string	No
`name`	string	No
`description`	string	No
`type`	enum	No	Values: `INTERNAL`, `SUPPLIER`, `CUSTOMER`, `CERTIFICATION`, `OTHER`
`original_type`	string	No	The vendor's own audit type name
`status`	enum	No	Normalized status of a quality record Values: `OPEN`, `IN_PROGRESS`, `IN_REVIEW`, `CLOSED`, `CANCELLED`
`lifecycle_state`	string	No	Vendor's own state or workflow step name
`standard`	string	No	Standard audited against, e.g. AS9100D
`scope`	string	No
`supplier_name`	string	No
`user_id`	string	No	Lead auditor (reference to HrisEmployee)
`scheduled_at`	string (date-time)	No	(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)
`start_at`	string (date-time)	No	(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)
`end_at`	string (date-time)	No	(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)
`closed_at`	string (date-time)	No	(ISO-8601 / YYYY-MM-DDTHH:MM:SSZ format)
`issue_ids`	string[]	No	Findings, as QmsIssue IDs
`file_ids`	string[]	No	Attachment IDs retrievable from StorageFile
`url`	string	No	Deep link to the vendor UI
`metadata`	QmsMetadata[]	No
`metadata[].id`	string	No	The ID of the custom field definition (from the metadata/metadata endpoint).
`metadata[].slug`	string	No	The integration's API name (key) of an existing custom field.
`metadata[].value`	object	No	The field's value, typed by `format`.
`metadata[].namespace`	string	No
`metadata[].format`	enum	No	The data type of the custom field, which determines how `value` is formatted. Values: `TEXT`, `NUMBER`, `DATE`, `BOOLEAN`, `FILE`, `TEXTAREA`, `SINGLE_SELECT`, `MULTIPLE_SELECT`, `MEASUREMENT`, `PRICE`, `YES_NO`, `CURRENCY`, `URL`
`metadata[].extra_data`	object	No

Errors

Errors return the HTTP status code and a JSON body with statusCode, error (the short label) and message (a human-readable detail).

{
  "statusCode": 429,
  "error": "Too Many Requests",
  "message": "Too many requests to unified.to API; max requests per minute: N"
}

Status	Error	Meaning
`400`	Bad Request	The request was malformed or failed validation.
`401`	Unauthorized	The connection is likely broken; re-authorize it.
`403`	Forbidden	The connection is missing permissions or scopes.
`404`	Not Found	The requested resource does not exist.
`429`	Too Many Requests	Rate limit exceeded (see the two sources below).
`500`	Internal Server Error	An unexpected error occurred.
`501`	Not Implemented	Not supported by this integration.

Errors from the underlying integration pass through: the integration's status comes back as ours (429, 401, 403, 404 or 5xx), usually with its message. When the integration's error body is unclear, Unified extracts what it can and returns a clearer message.

429 Too Many Requests

A 429 has two possible sources:

The integration's own rate limit, passed through.
Unified's workspace limit: a rolling 60 seconds, set by plan, with the message Too many requests to unified.to API; max requests per minute: N.

const options = {
  method: 'POST',
  url: 'https://api.unified.to/qms/5de520f96e439b002043d8dc/audit',
  headers: {
    authorization: 'bearer .....'
  },
  data: undefined,
  params: {
    fields: '',
    raw: '',
  }
};

const results = await axios.request(options);

Code Samples

Node.js SDK

import { UnifiedTo } from '@unified-api/typescript-sdk';

const sdk = new UnifiedTo({
    security: {
        jwt: '<YOUR_API_KEY_HERE>',
    },
});

const connectionId = '5de520f96e439b002043d8dc';

const results = await sdk.qms.createQmsAudit({ connectionId, qmsAudit: { }, 
    fields: '',
    raw: '',
 });

Node.js (axios)

const options = {
  method: 'POST',
  url: 'https://api.unified.to/qms/5de520f96e439b002043d8dc/audit',
  headers: {
    authorization: 'bearer .....'
  },
  data: undefined,
  params: {
    fields: '',
    raw: '',
  }
};

const results = await axios.request(options);

Java

AsyncHttpClient client = new DefaultAsyncHttpClient();

client.prepare("POST", "https://api.unified.to/qms/5de520f96e439b002043d8dc/audit?fields=&raw=")
  .setHeader("accept", "application/json")
  .setHeader("authorization", ".....")
  .execute()
  .toCompletableFuture()
  .thenAccept(System.out::println)
  .join();

client.close();

Go

import (
	"fmt"
	"net/http"
	"io/ioutil"
)

url := `https://api.unified.to/qms/5de520f96e439b002043d8dc/audit?fields=&raw=

req, _ := http.NewRequest("POST", url, nil)

req.Header.Add("accept", "application/json")
req.Header.Add("authorization", ".....")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)

Python

import requests

url = "https://api.unified.to/qms/5de520f96e439b002043d8dc/audit?fields=&raw="

headers = {
    "accept": "application/json",
    "authorization": "....."
}

response = requests.post(url, headers=headers)

PHP

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.unified.to/qms/5de520f96e439b002043d8dc/audit?fields=&raw=",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "accept: application/json",
    "authorization: ....."
  ],
]);

Ruby

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api.unified.to/qms/5de520f96e439b002043d8dc/audit?fields=&raw=")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["accept"] = 'application/json'
request["authorization"] = '....'

response = http.request(request)
puts response.read_body

cURL

curl --request POST \
  --url 'https://api.unified.to/qms/5de520f96e439b002043d8dc/audit?fields=&raw=' \
  --header 'accept: application/json' \
  --header 'authorization: .....'

Are we missing anything? Let us know

Was this page helpful?