Audit Introduction

Latest Update Time: 2026-07-01 00:00:00

Audit APIs allow you to programmatically create audit orders and search or retrieve audit reports. QIMA supports several audit types, including Ethical Audit (EA), Manufacturing Audit (MA), and Environmental Audit (ENVA). All Audit endpoints require authentication and share a common set of request headers.

This page documents the shared setup used by every Audit guide. Each API-specific guide links back here for authentication, headers, and environment details.

Base URL

All Audit APIs are served from the QIMA Public API host for your environment:

https://ppapi.qima.com

For production integrations, replace the host with the QIMA API host provided for your environment.

Required Headers

Call the Auth API first (POST /auth/v2/token) before any Audit request. See the Getting Started Guide or Get Token API for authentication setup.

You also need a QIMA customer account with permission for the target Audit operation, and an Ai-Api-Access-Token for the target environment provided by QIMA. Each API guide lists additional operation-specific requirements.

Header / Parameter	Location	Source	Description
Ai-Api-Access-Token	Request header (all Audit APIs)	Provided by QIMA	Request source identifier. Each client may have a different value per environment.
Ai-User-Id	Request header (all Audit APIs)	Auth API response userId	QIMA client user login ID of the authenticated user.
Authorization	Request header (all Audit APIs)	Auth API access token	Format: Bearer <access-token>. Use the token from the same Auth API session as the other headers.
Referer	Request header (all Audit APIs)	Fixed value	https://preprodmy.qima.com/
userId	Path parameter (report search and detail)	Auth API response userId	QIMA client user login ID whose audit reports are being queried. Same value as Ai-User-Id.

Common Authentication Errors

These errors apply to all Audit APIs:

Status	Meaning	Recommended Action
401 Unauthorized	Token or user authentication failed.	Confirm the Authorization, Ai-User-Id (userId), and Ai-Api-Access-Token headers are from the same Auth API session and environment.
403 Forbidden	The user does not have access to the requested resource.	Verify account permissions for the target Audit operation.

Each API guide includes additional operation-specific error codes.

Available APIs

API	Method	Endpoint	Guide	API Reference
Create audit order	POST	/v1.0/audit	Audit Order Create Guide	API Reference
Search audit reports	GET	/user/{userId}/audit-reports	Audit Reports Search Guide	API Reference
Get audit report details	GET	/user/{userId}/audit-reports/{reportId}	Audit Report Detail Guide	API Reference

Integration Workflows

The diagrams below show recommended API sequences for common integration scenarios. Follow the linked guides for request examples, field notes, and error handling.

1. Authenticate (Required for All Flows)

All Audit workflows begin with authentication. Store userId and the access token from the response before calling any Audit endpoint.

• Guide: Getting Started Guide
• API Reference: Get Token

2. Create an Audit Order

Use this flow when you want to submit a new audit booking through the API.

Typical steps:

1. Authenticate via the Auth API.
2. Collect supplier information. Either provide a valid supplierCode, or provide the supplier's name, contact, location, and product lines.
3. Optionally provide factory details (factoryCode, or full factory name/contact/location/product lines) so the factory can be auto-confirmed.
4. Call Create Audit Order with the booking details in the request body.
5. If the response is 202 Accepted with a "factory not confirmed" message, the factory must be confirmed separately before the order proceeds.

Step	Guide
Create audit order	Audit Order Create Guide

Factory confirmation: When the factory is not confirmed automatically, it must be confirmed using the factory confirmation API before the audit proceeds. This API is documented separately under the Supplier module.

3. Search and Retrieve Audit Reports

Use this flow when you need to find completed audit reports and view their full details.

Typical steps:

1. Authenticate via the Auth API.
2. Call Search Audit Reports with the target userId and optional filters (date range, keyword, sorting) to locate the target report.
3. Call Get Audit Report Details, passing the orderId from the search results as the reportId path parameter — despite its name, reportId is the audit order ID, not a separate report identifier.

Step	Guide
Search audit reports	Audit Reports Search Guide
Get report details	Audit Report Detail Guide

Choosing the Right API

Your goal	Recommended APIs
Submit a new audit booking	Create Audit Order
List or filter audit reports	Search Audit Reports
View full report details, findings, and scores	Get Audit Report Details

Related Documentation

• Getting Started Guide — Authentication and first API call
• Module Overview — Overview of all QIMA Public API modules
• API Reference — Interactive endpoint explorer for all Public APIs