{ "openapi": "3.0.0", "components": { "examples": {}, "headers": {}, "parameters": {}, "requestBodies": {}, "responses": {}, "schemas": { "PageInfo": { "description": "Provides information about the pagination of a dataset.", "properties": { "endCursor": { "type": "string", "nullable": true, "description": "The cursor that points to the end of the current page, or null if there is no such cursor." }, "hasNextPage": { "type": "boolean", "description": "Indicates if there is another page after the current page." }, "hasPreviousPage": { "type": "boolean", "description": "Indicates if there is a page before the current page." }, "startCursor": { "type": "string", "nullable": true, "description": "The cursor that points to the start of the current page, or null if there is no such cursor." } }, "required": [ "endCursor", "hasNextPage", "hasPreviousPage", "startCursor" ], "type": "object", "additionalProperties": false }, "AuditFocus": { "type": "string", "enum": [ "EXTERNAL", "INTERNAL" ] }, "Audit": { "properties": { "id": { "type": "string", "description": "The unique identifier for the audit." }, "customerOrganizationName": { "type": "string", "description": "The domain name of the customer organization being audited (e.g. vanta.com)" }, "customerDisplayName": { "type": "string", "nullable": true, "description": "The human readable name of the customer organization being audited (e.g. Vanta)" }, "customerOrganizationId": { "type": "string", "description": "The uuid of the customer organization being audited" }, "auditStartDate": { "type": "string", "format": "date-time", "description": "The start of the audit window. This is also when data collection for audit starts." }, "auditEndDate": { "type": "string", "format": "date-time", "description": "The end of the audit window." }, "earlyAccessStartsAt": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp at which auditors gain access to the audit. Occurs before the audit window begins" }, "framework": { "type": "string", "description": "The name of the framework for the audit" }, "displayName": { "type": "string", "description": "The display name for the audit. Returns the custom audit name if set,\notherwise returns the framework name." }, "allowAuditorEmails": { "items": { "type": "string" }, "type": "array", "description": "Emails of auditors with access to audit" }, "allowAllAuditors": { "type": "boolean", "description": "Set to true if all auditors in audit firm have access" }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the audit was deleted" }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the audit was created" }, "modificationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the audit was updated" }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the audit was marked completed, and report was uploaded" }, "auditFocus": { "$ref": "#/components/schemas/AuditFocus", "description": "Audit focus determines if the audit is internal or external facing" }, "auditorRequestListMetadata": { "properties": { "requestsSharedWithCustomer": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when information requests were shared with the customer. Null if not shared." } }, "required": [ "requestsSharedWithCustomer" ], "type": "object", "description": "Metadata about the auditor request list. This field is only present for IRL (Information\nRequest List) based audits and will be undefined for standard audits. Use the presence\nof this field to differentiate between IRL and non-IRL audits." } }, "required": [ "id", "customerOrganizationName", "customerDisplayName", "customerOrganizationId", "auditStartDate", "auditEndDate", "earlyAccessStartsAt", "framework", "displayName", "allowAuditorEmails", "allowAllAuditors", "deletionDate", "creationDate", "modificationDate", "completionDate", "auditFocus" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_Audit_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/Audit" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ListAuditsPageSize": { "type": "integer", "format": "int32", "default": 10, "description": "Controls the maximum number of items returned in one response from the listAudits API.\n\nWe have increased the pagination size for this endpoint to enable our upmarket audit firms to\nsync in a timely manner. The rest of the API will use a pagination size of 100.", "minimum": 1, "maximum": 200 }, "PageCursor": { "type": "string", "description": "A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset.\nNote that the requested page will not include the item that corresponds to this cursor but will start from the one immediately\nafter this cursor." }, "VendorAuthenticationMethod": { "description": "The authentication method a vendor uses:\n- AUTH_0: The vendor authenticates using Auth0\n- AZURE_AD: The vendor authenticates using Azure Active Directory\n- G_SUITE: The vendor authenticates using Google Workspace\n- O_AUTH: The vendor authenticates using OAuth\n- O365: The vendor authenticates using Office 365\n- OKTA: The vendor authenticates using Okta\n- ONE_LOGIN: The vendor authenticates using OneLogin\n- OWA: The vendor authenticates using OWA\n- SSO: The vendor authenticates using SSO\n- USERNAME_PASSWORD: The vendor authenticates using usernames and passwords", "enum": [ "AUTH_0", "AZURE_AD", "GOOGLE_WORKSPACE", "O_AUTH", "O365", "OKTA", "ONE_LOGIN", "OWA", "SSO", "USERNAME_PASSWORD", "OTHER" ], "type": "string" }, "VendorStatus": { "description": "The current state of a vendor:\n- MANAGED: The vendor is actively managed.\n- ARCHIVED: The vendor has been archived\n- IN_PROCUREMENT: The vendor is in the procurement process", "enum": [ "MANAGED", "ARCHIVED", "IN_PROCUREMENT" ], "type": "string" }, "VendorRiskLevel": { "description": "The risk level of a vendor:\n- CRITICAL: The vendor has a critical security risk\n- HIGH: The vendor has a high security risk\n- MEDIUM: The vendor has a medium security risk\n- LOW: The vendor has a low security risk\n- UNSCORED: The vendor has not been given a risk level", "enum": [ "CRITICAL", "HIGH", "LOW", "MEDIUM", "UNSCORED" ], "type": "string" }, "CountryCode": { "enum": [ "EUE", "AND", "ARE", "AFG", "ATG", "AIA", "ALB", "ARM", "AGO", "ATA", "ARG", "ASM", "AUT", "AUS", "ABW", "ALA", "AZE", "BIH", "BRB", "BGD", "BEL", "BFA", "BGR", "BHR", "BDI", "BEN", "BLM", "BMU", "BRN", "BOL", "BES", "BRA", "BHS", "BTN", "BVT", "BWA", "BLR", "BLZ", "CAN", "CCK", "COD", "CAF", "COG", "CHE", "CIV", "COK", "CHL", "CMR", "CHN", "COL", "CRI", "CUB", "CPV", "CUW", "CXR", "CYP", "CZE", "DEU", "DJI", "DNK", "DMA", "DOM", "DZA", "ECU", "EST", "EGY", "ESH", "ERI", "ESP", "ETH", "FIN", "FJI", "FLK", "FSM", "FRO", "FRA", "GAB", "ENG", "SCT", "GBR", "WAL", "NIR", "GRD", "GEO", "GUF", "GGY", "GHA", "GIB", "GRL", "GMB", "GIN", "GLP", "GNQ", "GRC", "SGS", "GTM", "GUM", "GNB", "GUY", "HKG", "HMD", "HND", "HRV", "HTI", "HUN", "IDN", "IRL", "ISR", "IMN", "IND", "IOT", "IRQ", "IRN", "ISL", "ITA", "JEY", "JAM", "JOR", "JPN", "KEN", "KGZ", "KHM", "KIR", "COM", "KNA", "PRK", "KOR", "KWT", "CYM", "KAZ", "LAO", "LBN", "LCA", "LIE", "LKA", "LBR", "LSO", "LTU", "LUX", "LVA", "LBY", "MAR", "MCO", "MDA", "MNE", "MAF", "MDG", "MHL", "MKD", "MLI", "MMR", "MNG", "MAC", "MNP", "MTQ", "MRT", "MSR", "MLT", "MUS", "MDV", "MWI", "MEX", "MYS", "MOZ", "NAM", "NCL", "NER", "NFK", "NGA", "NIC", "NLD", "NOR", "NPL", "NRU", "NIU", "NZL", "OMN", "PAN", "PER", "PYF", "PNG", "PHL", "PAK", "POL", "SPM", "PCN", "PRI", "PSE", "PRT", "PLW", "PRY", "QAT", "REU", "ROU", "SRB", "RUS", "RWA", "SAU", "SLB", "SYC", "SDN", "SWE", "SGP", "SHN", "SVN", "SJM", "SVK", "SLE", "SMR", "SEN", "SOM", "SUR", "SSD", "STP", "SLV", "SXM", "SYR", "SWZ", "TCA", "TCD", "ATF", "TGO", "THA", "TJK", "TKL", "TLS", "TKM", "TUN", "TON", "TUR", "TTO", "TUV", "TWN", "TZA", "UKR", "UGA", "UMI", "USA", "URY", "UZB", "VAT", "VCT", "VEN", "VGB", "VIR", "VNM", "VUT", "WLF", "WSM", "YEM", "MYT", "ZAF", "ZMB", "ZWE" ], "type": "string" }, "CurrencyCode": { "enum": [ "ARS", "AUD", "BRL", "CAD", "COP", "CZK", "DKK", "EUR", "GBP", "ILS", "INR", "JPY", "MXN", "NOK", "NZD", "PHP", "PKR", "PLN", "RSD", "SEK", "SGD", "UAH", "USD", "ZAR" ], "type": "string" }, "VendorContractAmount": { "properties": { "amount": { "type": "number", "format": "double", "description": "The amount of the contract." }, "currency": { "$ref": "#/components/schemas/CurrencyCode", "description": "The currency of the contract." } }, "required": [ "amount", "currency" ], "type": "object", "additionalProperties": false }, "CustomField": { "properties": { "label": { "type": "string" }, "value": { "anyOf": [ { "type": "string" }, { "items": { "type": "string" }, "type": "array" } ] } }, "required": [ "label", "value" ], "type": "object", "additionalProperties": false }, "VendorDecisionStatus": { "enum": [ "APPROVED", "CONDITIONALLY_APPROVED", "NOT_APPROVED" ], "type": "string" }, "VendorDecision": { "description": "The decision for a vendor.", "properties": { "status": { "$ref": "#/components/schemas/VendorDecisionStatus" }, "lastUpdatedAt": { "type": "string", "format": "date-time" } }, "required": [ "status", "lastUpdatedAt" ], "type": "object", "additionalProperties": false }, "Vendor": { "properties": { "id": { "type": "string", "description": "The vendor's unique ID." }, "name": { "type": "string", "description": "The vendor's display name." }, "websiteUrl": { "type": "string", "nullable": true, "description": "The vendor's website URL." }, "accountManagerName": { "type": "string", "nullable": true, "description": "The vendor's external account manager name." }, "accountManagerEmail": { "type": "string", "nullable": true, "description": "The vendor's external account manager email." }, "servicesProvided": { "type": "string", "nullable": true, "description": "Services provided by the vendor." }, "additionalNotes": { "type": "string", "nullable": true, "description": "Any additional notes about the vendor" }, "securityOwnerUserId": { "type": "string", "nullable": true, "description": "The vendor's security owner's Vanta user ID." }, "businessOwnerUserId": { "type": "string", "nullable": true, "description": "The vendor's business owner's Vanta user ID." }, "contractStartDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the contract with the vendor began." }, "contractRenewalDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the contract with the vendor is up for renewal." }, "contractTerminationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the contract with the vendor was terminated." }, "nextSecurityReviewDueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The next due date for a security review." }, "lastSecurityReviewCompletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The most recent date a security review was completed." }, "isVisibleToAuditors": { "type": "boolean", "nullable": true, "description": "Whether or not auditors can view this vendor." }, "isRiskAutoScored": { "type": "boolean", "nullable": true, "description": "Whether or not the vendor's risk is automatically scored." }, "riskAttributeIds": { "items": { "type": "string" }, "type": "array", "description": "The list of risk attribute IDs the vendor has been assigned to." }, "category": { "properties": { "displayName": { "type": "string" } }, "required": [ "displayName" ], "type": "object", "nullable": true, "description": "The vendor's category." }, "authDetails": { "properties": { "passwordMinimumLength": { "type": "number", "format": "double", "nullable": true, "description": "Minimum number for chacters required for passwords for this vendor." }, "passwordRequiresSymbol": { "type": "boolean", "nullable": true, "description": "Whether or not the vendor requires passwords to have a symbol." }, "passwordRequiresNumber": { "type": "boolean", "nullable": true, "description": "Whether or not the vendor requires passwords to have a number." }, "passwordMFA": { "type": "boolean", "nullable": true, "description": "Whether or not the vendor requires passwords to have multi factor authentication." }, "method": { "allOf": [ { "$ref": "#/components/schemas/VendorAuthenticationMethod" } ], "nullable": true, "description": "The vendor's authentication method." } }, "required": [ "passwordMinimumLength", "passwordRequiresSymbol", "passwordRequiresNumber", "passwordMFA", "method" ], "type": "object", "description": "The vendor's authentication details." }, "status": { "$ref": "#/components/schemas/VendorStatus", "description": "The vendor's current status." }, "inherentRiskLevel": { "$ref": "#/components/schemas/VendorRiskLevel", "description": "The vendor's risk level." }, "residualRiskLevel": { "$ref": "#/components/schemas/VendorRiskLevel", "description": "The vendor's residual risk level." }, "vendorHeadquarters": { "allOf": [ { "$ref": "#/components/schemas/CountryCode" } ], "nullable": true, "description": "The vendor's headquarters." }, "contractAmount": { "allOf": [ { "$ref": "#/components/schemas/VendorContractAmount" } ], "nullable": true, "description": "The contract amount for the vendor." }, "customFields": { "items": { "$ref": "#/components/schemas/CustomField" }, "type": "array", "nullable": true, "description": "The vendor's custom fields." }, "latestDecision": { "allOf": [ { "$ref": "#/components/schemas/VendorDecision" } ], "nullable": true, "description": "The vendor's latest decision status. Null means no decision has been made." }, "linkedTaskTrackerTaskProcurementRequest": { "properties": { "url": { "type": "string" }, "service": { "type": "string" } }, "required": [ "url", "service" ], "type": "object", "nullable": true, "description": "The task tracker procurement request associated with this vendor (if linked)." } }, "required": [ "id", "name", "websiteUrl", "accountManagerName", "accountManagerEmail", "servicesProvided", "additionalNotes", "securityOwnerUserId", "businessOwnerUserId", "contractStartDate", "contractRenewalDate", "contractTerminationDate", "nextSecurityReviewDueDate", "lastSecurityReviewCompletionDate", "isVisibleToAuditors", "isRiskAutoScored", "riskAttributeIds", "category", "authDetails", "status", "inherentRiskLevel", "residualRiskLevel", "vendorHeadquarters", "contractAmount", "customFields", "latestDecision", "linkedTaskTrackerTaskProcurementRequest" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_Vendor_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/Vendor" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "PageSize": { "type": "integer", "format": "int32", "default": 10, "description": "Controls the maximum number of items returned in one response from the API.", "minimum": 1, "maximum": 100 }, "ComputerStatusOutcome": { "description": "The possible outcomes of a status check. The outcome can be one of the following:\nFAIL: The check is failing.\nIN_PROGRESS: The check needs further data from the given computer in order to evaluate. The field(s) needed from a computer to calculate the ComputerStatusOutcome were null.\nNA: The check is not applicable for the given computer.\nPASS: The check is passing.", "enum": [ "FAIL", "IN_PROGRESS", "NA", "PASS" ], "type": "string" }, "ComputerStatus": { "description": "The a status check for a computer. Representation for screenlock, diskEncryption, passwordManager, and antivirusInstallation.", "properties": { "outcome": { "$ref": "#/components/schemas/ComputerStatusOutcome", "description": "The outcome of the status check." } }, "required": [ "outcome" ], "type": "object", "additionalProperties": false }, "OperatingSystemType": { "description": "The possible types of the operating system. One of `mac_OS`, `linux`, or `windows`.", "enum": [ "macOS", "linux", "windows" ], "type": "string" }, "OperatingSystem": { "description": "The computer's operating system type and version.", "properties": { "type": { "$ref": "#/components/schemas/OperatingSystemType", "description": "The type of the operating system." }, "version": { "type": "string", "nullable": true, "description": "The version of the operating system." } }, "required": [ "type", "version" ], "type": "object", "additionalProperties": false }, "Owner": { "properties": { "id": { "type": "string", "description": "Unique identifier for the person." }, "displayName": { "type": "string", "description": "Name of the person that is shown in product." }, "emailAddress": { "type": "string", "description": "Email address of the person." } }, "required": [ "id", "displayName", "emailAddress" ], "type": "object", "additionalProperties": false }, "MonitoredComputer": { "properties": { "id": { "type": "string", "description": "Unique identifier for the monitored computer." }, "integrationId": { "type": "string", "description": "Hard-coded enums for Vanta-built integrations or application IDs for 3rd-party-built integrations." }, "lastCheckDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date of the computer's most recent report." }, "screenlock": { "$ref": "#/components/schemas/ComputerStatus", "description": "Whether or not the computer has screenlock enabled." }, "diskEncryption": { "$ref": "#/components/schemas/ComputerStatus", "description": "Whether or not the computer's hard drive is encrypted." }, "passwordManager": { "$ref": "#/components/schemas/ComputerStatus", "description": "Whether or not the computer has a password manager installed." }, "antivirusInstallation": { "$ref": "#/components/schemas/ComputerStatus", "description": "Whether or not the computer has antivirus software installed." }, "operatingSystem": { "allOf": [ { "$ref": "#/components/schemas/OperatingSystem" } ], "nullable": true, "description": "The computer's operating system name and version." }, "owner": { "allOf": [ { "$ref": "#/components/schemas/Owner" } ], "nullable": true, "description": "The name, unique identifier, and email address of the computer's owner." }, "serialNumber": { "type": "string", "nullable": true, "description": "The serial number of the computer. This value may be null if it is not reported by the device." }, "udid": { "type": "string", "nullable": true, "description": "The universal device id of the computer." } }, "required": [ "id", "integrationId", "lastCheckDate", "screenlock", "diskEncryption", "passwordManager", "antivirusInstallation", "operatingSystem", "owner", "serialNumber", "udid" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_MonitoredComputer_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/MonitoredComputer" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ComputerStatusFilter": { "description": "Enum representing computer compliance statuses that can be utilized as a filter. The meanings are as follows:\nAV_NOT_INSTALLED: The computer does not have antivirus software installed.\nHD_NOT_ENCRYPTED: The computer's harddrive is not encrypted.\nLAST_CHECK_OVER_14_DAYS: No data has been received from computer for over 14 days.\nPWM_NOT_INSTALLED: The computer does not have a password manager installed.\nSCREENLOCK_NOT_CONFIGURED: The computer does not have screenlock configured appropriately.", "enum": [ "PWM_NOT_INSTALLED", "HD_NOT_ENCRYPTED", "AV_NOT_INSTALLED", "SCREENLOCK_NOT_CONFIGURED", "LAST_CHECK_OVER_14_DAYS" ], "type": "string" }, "EvidenceUrl": { "properties": { "id": { "type": "string", "description": "Vanta internal reference to evidence" }, "url": { "type": "string", "description": "Pre-signed S3 URL for evidence" }, "filename": { "type": "string", "description": "File name of evidence" }, "isDownloadable": { "type": "boolean", "description": "Set to true if this is a presigned s3 url. Set to false if this is a customer uploaded link" }, "mimeType": { "type": "string", "nullable": true, "description": "MIME type of the evidence file (e.g., \"application/pdf\", \"image/png\")" } }, "required": [ "id", "url", "filename", "isDownloadable", "mimeType" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_EvidenceUrl_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/EvidenceUrl" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "EmploymentStatus": { "description": "The employment status of a person:\n- UPCOMING: The person is not yet employed and will start employment in the future.\n- CURRENT: The person is currently employed.\n- ON_LEAVE: The person is on leave.\n- INACTIVE: The person's employment is inactive.\n- FORMER: The person was previously employed.", "enum": [ "UPCOMING", "CURRENT", "ON_LEAVE", "INACTIVE", "FORMER" ], "type": "string" }, "LeaveStatus": { "description": "User can be active or upcoming leave period", "enum": [ "ACTIVE", "UPCOMING" ], "type": "string" }, "LeaveInfo": { "properties": { "startDate": { "type": "string", "format": "date-time", "description": "The start of the person's leave." }, "endDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The end of the person's leave. Null endDate implies indefinite leave." }, "status": { "$ref": "#/components/schemas/LeaveStatus", "description": "ACTIVE if the leave is currently ongoing. UPCOMING if the startDate is in the future." } }, "required": [ "startDate", "endDate", "status" ], "type": "object", "additionalProperties": false }, "PersonInfoSourceType.VANTA": { "enum": [ "VANTA" ], "type": "string" }, "VantaBasedPersonInfoSource": { "description": "The person's information comes from what is set in Vanta.", "properties": { "type": { "$ref": "#/components/schemas/PersonInfoSourceType.VANTA" } }, "required": [ "type" ], "type": "object", "additionalProperties": false }, "PersonInfoSourceType.SCIM": { "enum": [ "SCIM" ], "type": "string" }, "ScimBasedPersonInfoSource": { "description": "The person's information comes from SCIM.", "properties": { "type": { "$ref": "#/components/schemas/PersonInfoSourceType.SCIM" } }, "required": [ "type" ], "type": "object", "additionalProperties": false }, "PersonInfoSourceType.INTEGRATION": { "enum": [ "INTEGRATION" ], "type": "string" }, "IntegrationBasedPersonInfoSource": { "description": "The person's information comes from an integration.", "properties": { "integrationId": { "type": "string" }, "resourceId": { "type": "string", "nullable": true }, "type": { "$ref": "#/components/schemas/PersonInfoSourceType.INTEGRATION" } }, "required": [ "integrationId", "resourceId", "type" ], "type": "object", "additionalProperties": false }, "PersonInfoSource": { "anyOf": [ { "$ref": "#/components/schemas/VantaBasedPersonInfoSource" }, { "$ref": "#/components/schemas/ScimBasedPersonInfoSource" }, { "$ref": "#/components/schemas/IntegrationBasedPersonInfoSource" } ], "description": "The source of the person's information." }, "TasksSummaryStatus": { "description": "The overall status of a person's outstanding tasks:\n- NONE: There are no tasks.\n- DUE_SOON: At least one task is due soon.\n- OVERDUE: At least one task is overdue. Has a higher priority than DUE_SOON.\n- COMPLETE: All tasks are complete.\n- PAUSED: All tasks are paused.\n- OFFBOARDING_DUE_SOON: At least one offboarding task is due soon.\n- OFFBOARDING_OVERDUE: At least one offboarding task is overdue. Has a higher priority than OFFBOARDING_DUE_SOON.\n- OFFBOARDING_COMPLETE: All offboarding tasks are complete.", "enum": [ "COMPLETE", "DUE_SOON", "NONE", "OFFBOARDING_COMPLETE", "OFFBOARDING_DUE_SOON", "OFFBOARDING_OVERDUE", "OVERDUE", "PAUSED" ], "type": "string" }, "TaskType.COMPLETE_TRAININGS": { "enum": [ "COMPLETE_TRAININGS" ], "type": "string" }, "Training": { "description": "A person's security training.", "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "TaskType": { "description": "The type a task summary falls into.\nCOMPLETE_TRAININGS: The task summary containing security trainings.\nACCEPT_POLICIES: The task summary containing policy acceptance.\nCOMPLETE_CUSTOM_TASKS: The task summary containing custom tasks.\nINSTALL_DEVICE_MONITORING: The task summary containing device monitoring installation.\nCOMPLETE_BACKGROUND_CHECKS: The task summary containing background checks.", "enum": [ "COMPLETE_TRAININGS", "ACCEPT_POLICIES", "COMPLETE_CUSTOM_TASKS", "COMPLETE_CUSTOM_OFFBOARDING_TASKS", "INSTALL_DEVICE_MONITORING", "COMPLETE_BACKGROUND_CHECKS" ], "type": "string" }, "TaskStatus": { "description": "The status of a task.\n- COMPLETE: The task has been completed.\n- DUE_SOON: The task is due soon.\n- OVERDUE: The task is overdue.\n- NONE: The task is not assigned.", "enum": [ "COMPLETE", "DUE_SOON", "OVERDUE", "NONE" ], "type": "string" }, "CompleteTrainingsTaskSummary": { "description": "Task summary for completing all trainings.", "properties": { "taskType": { "$ref": "#/components/schemas/TaskType.COMPLETE_TRAININGS" }, "status": { "$ref": "#/components/schemas/TaskStatus" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the task was completed." }, "disabled": { "properties": { "date": { "type": "string", "format": "date-time" }, "reason": { "type": "string", "nullable": true } }, "required": [ "date", "reason" ], "type": "object", "nullable": true, "description": "If the task is disabled, the reason and date when it was disabled." }, "incompleteTrainings": { "items": { "$ref": "#/components/schemas/Training" }, "type": "array", "description": "Incomplete security trainings that are relevant given a person's requirements." }, "completedTrainings": { "items": { "$ref": "#/components/schemas/Training" }, "type": "array", "description": "Security trainings that have been completed and are relevant given a person's current requirements." } }, "required": [ "taskType", "status", "dueDate", "completionDate", "disabled", "incompleteTrainings", "completedTrainings" ], "type": "object", "additionalProperties": false }, "TaskType.ACCEPT_POLICIES": { "enum": [ "ACCEPT_POLICIES" ], "type": "string" }, "AcceptPoliciesTaskSummary": { "description": "Policy acceptance details for a person.", "properties": { "taskType": { "$ref": "#/components/schemas/TaskType.ACCEPT_POLICIES" }, "status": { "$ref": "#/components/schemas/TaskStatus" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the task was completed." }, "disabled": { "properties": { "date": { "type": "string", "format": "date-time" }, "reason": { "type": "string", "nullable": true } }, "required": [ "date", "reason" ], "type": "object", "nullable": true, "description": "If the task is disabled, the reason and date when it was disabled." }, "unacceptedPolicies": { "items": { "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": "object" }, "type": "array", "description": "Unaccepted policies that are relevant to the person." }, "acceptedPolicies": { "items": { "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": "object" }, "type": "array", "description": "Accepted policies that are relevant to the person." } }, "required": [ "taskType", "status", "dueDate", "completionDate", "disabled", "unacceptedPolicies", "acceptedPolicies" ], "type": "object", "additionalProperties": false }, "TaskType.COMPLETE_CUSTOM_TASKS": { "enum": [ "COMPLETE_CUSTOM_TASKS" ], "type": "string" }, "CustomTask": { "description": "A custom task.", "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "CompleteCustomTasksTaskSummary": { "description": "Task summary for completing all custom tasks.", "properties": { "taskType": { "$ref": "#/components/schemas/TaskType.COMPLETE_CUSTOM_TASKS" }, "status": { "$ref": "#/components/schemas/TaskStatus" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the task was completed." }, "disabled": { "properties": { "date": { "type": "string", "format": "date-time" }, "reason": { "type": "string", "nullable": true } }, "required": [ "date", "reason" ], "type": "object", "nullable": true, "description": "If the task is disabled, the reason and date when it was disabled." }, "incompleteCustomTasks": { "items": { "$ref": "#/components/schemas/CustomTask" }, "type": "array", "description": "Incomplete custom tasks that are relevant given a person's requirements." }, "completedCustomTasks": { "items": { "$ref": "#/components/schemas/CustomTask" }, "type": "array", "description": "Custom tasks that have been completed and are relevant given a person's current requirements." } }, "required": [ "taskType", "status", "dueDate", "completionDate", "disabled", "incompleteCustomTasks", "completedCustomTasks" ], "type": "object", "additionalProperties": false }, "TaskType.COMPLETE_CUSTOM_OFFBOARDING_TASKS": { "enum": [ "COMPLETE_CUSTOM_OFFBOARDING_TASKS" ], "type": "string" }, "CompleteOffboardingCustomTasksTaskSummary": { "description": "Task summary for completing all offboarding custom tasks.", "properties": { "taskType": { "$ref": "#/components/schemas/TaskType.COMPLETE_CUSTOM_OFFBOARDING_TASKS" }, "status": { "$ref": "#/components/schemas/TaskStatus" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the task was completed." }, "disabled": { "properties": { "date": { "type": "string", "format": "date-time" }, "reason": { "type": "string", "nullable": true } }, "required": [ "date", "reason" ], "type": "object", "nullable": true, "description": "If the task is disabled, the reason and date when it was disabled." }, "incompleteCustomOffboardingTasks": { "items": { "$ref": "#/components/schemas/CustomTask" }, "type": "array", "description": "Incomplete custom tasks that are relevant given a person's requirements." }, "completedCustomOffboardingTasks": { "items": { "$ref": "#/components/schemas/CustomTask" }, "type": "array", "description": "Custom tasks that have been completed and are relevant given a person's current requirements." } }, "required": [ "taskType", "status", "dueDate", "completionDate", "disabled", "incompleteCustomOffboardingTasks", "completedCustomOffboardingTasks" ], "type": "object", "additionalProperties": false }, "TaskType.INSTALL_DEVICE_MONITORING": { "enum": [ "INSTALL_DEVICE_MONITORING" ], "type": "string" }, "InstallDeviceMonitoringTaskSummary": { "description": "Task summary for installing device monitoring.", "properties": { "taskType": { "$ref": "#/components/schemas/TaskType.INSTALL_DEVICE_MONITORING" }, "status": { "$ref": "#/components/schemas/TaskStatus" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the task was completed." }, "disabled": { "properties": { "date": { "type": "string", "format": "date-time" }, "reason": { "type": "string", "nullable": true } }, "required": [ "date", "reason" ], "type": "object", "nullable": true, "description": "If the task is disabled, the reason and date when it was disabled." } }, "required": [ "taskType", "status", "dueDate", "completionDate", "disabled" ], "type": "object", "additionalProperties": false }, "TaskType.COMPLETE_BACKGROUND_CHECKS": { "enum": [ "COMPLETE_BACKGROUND_CHECKS" ], "type": "string" }, "CompleteBackgroundChecksTaskSummary": { "description": "Task summary for completing background checks.", "properties": { "taskType": { "$ref": "#/components/schemas/TaskType.COMPLETE_BACKGROUND_CHECKS" }, "status": { "$ref": "#/components/schemas/TaskStatus" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date the task was completed." }, "disabled": { "properties": { "date": { "type": "string", "format": "date-time" }, "reason": { "type": "string", "nullable": true } }, "required": [ "date", "reason" ], "type": "object", "nullable": true, "description": "If the task is disabled, the reason and date when it was disabled." } }, "required": [ "taskType", "status", "dueDate", "completionDate", "disabled" ], "type": "object", "additionalProperties": false }, "TaskSummaryDetails": { "description": "All detailed information about a person's tasks, split across task categories.", "properties": { "completeTrainings": { "$ref": "#/components/schemas/CompleteTrainingsTaskSummary" }, "acceptPolicies": { "$ref": "#/components/schemas/AcceptPoliciesTaskSummary" }, "completeCustomTasks": { "$ref": "#/components/schemas/CompleteCustomTasksTaskSummary" }, "completeOffboardingCustomTasks": { "$ref": "#/components/schemas/CompleteOffboardingCustomTasksTaskSummary" }, "installDeviceMonitoring": { "$ref": "#/components/schemas/InstallDeviceMonitoringTaskSummary" }, "completeBackgroundChecks": { "$ref": "#/components/schemas/CompleteBackgroundChecksTaskSummary" } }, "required": [ "completeTrainings", "acceptPolicies", "completeCustomTasks", "completeOffboardingCustomTasks", "installDeviceMonitoring", "completeBackgroundChecks" ], "type": "object", "additionalProperties": false }, "Person": { "properties": { "id": { "type": "string" }, "userId": { "type": "string", "nullable": true, "description": "The ID of the Vanta user account associated with this person, if one exists." }, "emailAddress": { "type": "string" }, "employment": { "properties": { "status": { "$ref": "#/components/schemas/EmploymentStatus", "description": "The person's employment status." }, "startDate": { "type": "string", "format": "date-time", "description": "The date the person's employment started." }, "jobTitle": { "type": "string", "nullable": true, "description": "The person's job title." }, "endDate": { "type": "string", "format": "date-time", "nullable": true, "description": "If present, the date the person's employment ended." } }, "required": [ "status", "startDate", "jobTitle", "endDate" ], "type": "object" }, "leaveInfo": { "allOf": [ { "$ref": "#/components/schemas/LeaveInfo" } ], "nullable": true, "description": "If present, the user's active/upcoming leave. Empty if the user has no active/upcoming leave." }, "groupIds": { "items": { "type": "string" }, "type": "array", "description": "The id of each group the user belongs to. This includes both manually created groups in Vanta and groups imported from an identity provider." }, "name": { "properties": { "first": { "type": "string", "nullable": true, "description": "The person's first (given) name." }, "last": { "type": "string", "nullable": true, "description": "The person's last (family) name." }, "display": { "type": "string", "description": "The person's display name, used in Vanta." } }, "required": [ "first", "last", "display" ], "type": "object" }, "sources": { "properties": { "employment": { "properties": { "endDate": { "$ref": "#/components/schemas/PersonInfoSource", "description": "The source of the person's employment end date." }, "startDate": { "$ref": "#/components/schemas/PersonInfoSource", "description": "The source of the person's employment start date." } }, "required": [ "endDate", "startDate" ], "type": "object" }, "emailAddress": { "$ref": "#/components/schemas/PersonInfoSource", "description": "The source of the person's email address." } }, "required": [ "employment", "emailAddress" ], "type": "object", "description": "The sources of the person's information." }, "tasksSummary": { "properties": { "details": { "$ref": "#/components/schemas/TaskSummaryDetails" }, "status": { "$ref": "#/components/schemas/TasksSummaryStatus", "description": "The status of the person's tasks summary." }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date of the person's earliest-due task." }, "completionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date when person's tasks were completed." } }, "required": [ "details", "status", "dueDate", "completionDate" ], "type": "object", "description": "The person's tasks summary, which aggregates their current status across\nall of their relevant tasks." } }, "required": [ "id", "userId", "emailAddress", "employment", "leaveInfo", "groupIds", "name", "sources", "tasksSummary" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_Person_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/Person" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "VulnerabilityRemediation": { "properties": { "id": { "type": "string", "description": "Unique identifier for the remediation." }, "vulnerabilityId": { "type": "string", "description": "Unique identifier for the vulnerability that the remediation is for." }, "vulnerableAssetId": { "type": "string", "description": "Unique identifier for the vulnerable asset that the remediation is for." }, "severity": { "type": "string", "description": "Severity of the vulnerability." }, "detectedDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability was first detected." }, "slaDeadlineDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability should be remediated by." }, "remediationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability was remediated." } }, "required": [ "id", "vulnerabilityId", "vulnerableAssetId", "severity", "detectedDate", "slaDeadlineDate", "remediationDate" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_VulnerabilityRemediation_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/VulnerabilityRemediation" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ExternalFindingSeverity": { "description": "ExternalFindingSeverity describes the severity of an external finding (Vulnerability or Security Alert)", "enum": [ "CRITICAL", "HIGH", "LOW", "MEDIUM" ], "type": "string" }, "AuditEvidenceState": { "type": "string", "enum": [ "Accepted", "Flagged", "Initialized", "NA", "Not ready for audit", "Ready for audit" ] }, "AuditEvidenceType": { "type": "string", "enum": [ "Evidence Request", "Policy", "Test" ] }, "EvidenceControl": { "properties": { "name": { "type": "string", "description": "Name of control associated to this evidence" }, "sectionNames": { "items": { "type": "string" }, "type": "array", "description": "A list sections associated to the control" } }, "required": [ "name", "sectionNames" ], "type": "object", "additionalProperties": false }, "Evidence": { "properties": { "id": { "type": "string", "description": "Vanta internal reference to evidence" }, "externalId": { "type": "string", "description": "This is a static UUID to map Audit Firm controls to Vanta controls" }, "status": { "$ref": "#/components/schemas/AuditEvidenceState", "description": "Vanta internal statuses for audit evidence" }, "name": { "type": "string", "description": "Mutable name for evidence. Not guaranteed to be unique." }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The date this Audit Evidence was deleted" }, "creationDate": { "type": "string", "format": "date-time", "description": "The date this Audit Evidence was created" }, "statusUpdatedDate": { "type": "string", "format": "date-time", "description": "Point in time that status was last updated" }, "testStatus": { "type": "string", "nullable": true, "description": "The outcome of the automated test run, for Test-type evidence" }, "evidenceType": { "$ref": "#/components/schemas/AuditEvidenceType", "description": "The type of Audit Evidence" }, "evidenceId": { "type": "string", "description": "Unique identifier for evidence" }, "relatedControls": { "items": { "$ref": "#/components/schemas/EvidenceControl" }, "type": "array", "description": "The controls associated to this evidence" }, "description": { "type": "string", "nullable": true, "description": "The description for the evidence. It will be set to null if the evidence is deleted" } }, "required": [ "id", "externalId", "status", "name", "deletionDate", "creationDate", "statusUpdatedDate", "testStatus", "evidenceType", "evidenceId", "relatedControls", "description" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_Evidence_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/Evidence" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "Comment": { "properties": { "id": { "type": "string", "description": "The unique identifier for the comment" }, "auditEvidenceId": { "type": "string", "description": "The unique identifier for the audit evidence related to the comment." }, "text": { "type": "string", "description": "The comment message" }, "creationDate": { "type": "string", "format": "date-time", "description": "When the comment was created" }, "modificationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "When the comment was updated" }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "When the comment was deleted" }, "email": { "type": "string", "nullable": true, "description": "The email of the comment author. This acts as a unique identifier to map users between Vanta and external systems." }, "authorName": { "type": "string", "nullable": true, "description": "Human-readable display name of the comment author.\nNull if the author's name is not available (e.g., user was deleted).\nThis enables correct author attribution in integrations where users cannot\nbe reliably matched across systems by email alone." } }, "required": [ "id", "auditEvidenceId", "text", "creationDate", "modificationDate", "deletionDate", "email", "authorName" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_Comment_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/Comment" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "SectionPrinciple": { "properties": { "id": { "type": "string", "description": "The principle's unique ID." }, "name": { "type": "string", "description": "The principle's name." } }, "required": [ "id", "name" ], "type": "object", "additionalProperties": false }, "Section": { "properties": { "name": { "type": "string", "description": "The section name" }, "framework": { "type": "string", "description": "The section framework" }, "principle": { "allOf": [ { "$ref": "#/components/schemas/SectionPrinciple" } ], "nullable": true, "description": "The principle that groups this section, if any." } }, "required": [ "name", "framework", "principle" ], "type": "object", "additionalProperties": false }, "ControlSource": { "enum": [ "Vanta", "Custom" ], "type": "string" }, "AuditorControl": { "properties": { "id": { "type": "string", "description": "The control's unique ID." }, "externalId": { "type": "string", "nullable": true, "description": "The control's external ID." }, "name": { "type": "string", "description": "The control's name." }, "description": { "type": "string", "description": "The control's description." }, "source": { "$ref": "#/components/schemas/ControlSource", "description": "The control's source, either \"VANTA\" or \"CUSTOM\"." }, "domains": { "items": { "type": "string" }, "type": "array", "description": "The security domains that the control belongs to." }, "owner": { "allOf": [ { "$ref": "#/components/schemas/Owner" } ], "nullable": true, "description": "The control's owner." }, "role": { "type": "string", "nullable": true, "description": "The control's GDPR role, if the control is a GDPR control." }, "customFields": { "items": { "$ref": "#/components/schemas/CustomField" }, "type": "array", "description": "The control's custom field values, if control custom fields is included in your Vanta instance." }, "creationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "When the control was created. Returns null for Vanta library controls." }, "modificationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "When the control was last modified. Returns null for Vanta library controls." }, "framework": { "type": "string", "description": "The report standard framework fulfilled by the control." }, "sections": { "items": { "$ref": "#/components/schemas/Section" }, "type": "array", "description": "Sections of a framework that this control satisfies" } }, "required": [ "id", "externalId", "name", "description", "source", "domains", "owner", "customFields", "creationDate", "modificationDate", "framework", "sections" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AuditorControl_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AuditorControl" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AddCommentInput": { "properties": { "text": { "type": "string", "description": "Text value of the comment" }, "email": { "type": "string", "description": "Email of author. Must match an existing Vanta user and the user must exist under the Audit Firm who is making the API request" }, "creationDate": { "type": "string", "format": "date-time", "description": "When the comment was created in the external system" } }, "required": [ "text", "email", "creationDate" ], "type": "object", "additionalProperties": false }, "AuditorEnabledStateTransition": { "type": "string", "enum": [ "ACCEPT", "MARK_APPLICABLE", "FLAG", "MARK_NA", "READY_FOR_AUDIT" ] }, "AuditEvidenceUpdateInput": { "properties": { "statusUpdate": { "properties": { "auditorEmail": { "type": "string", "description": "Email of the auditor who changed the state" }, "stateTransition": { "$ref": "#/components/schemas/AuditorEnabledStateTransition", "description": "State change for audit evidence" } }, "required": [ "auditorEmail", "stateTransition" ], "type": "object" } }, "type": "object", "additionalProperties": false }, "RecurrenceDuration": { "enum": [ "P0D", "P1D", "P1W", "P1M", "P3M", "P6M", "P1Y", "P2Y" ], "type": "string" }, "CustomEvidenceRequest": { "properties": { "id": { "type": "string", "description": "Internal id of the custom evidence request within Vanta" }, "controlIds": { "items": { "type": "string" }, "type": "array", "description": "A set of controls, referenced by id, to map the evidence to" }, "title": { "type": "string", "description": "Title for the evidence request" }, "description": { "type": "string", "description": "Description for the evidence request" }, "cadence": { "$ref": "#/components/schemas/RecurrenceDuration", "description": "Renewal cadence" }, "reminderWindow": { "$ref": "#/components/schemas/RecurrenceDuration", "description": "Duration representing when to send notifications, relative to renewal date" }, "isRestricted": { "type": "boolean", "description": "Whether this document contains sensitive data and needs more restrictive read access" } }, "required": [ "id", "controlIds", "title", "description", "cadence", "reminderWindow", "isRestricted" ], "type": "object", "additionalProperties": false }, "CreateCustomEvidenceRequestInput": { "properties": { "controlIds": { "items": { "type": "string" }, "type": "array", "description": "A set of controls, referenced by id, to map the evidence to" }, "title": { "type": "string", "description": "Title for the evidence request" }, "description": { "type": "string", "description": "Description for the evidence request" }, "cadence": { "$ref": "#/components/schemas/RecurrenceDuration", "description": "Renewal cadence" }, "reminderWindow": { "$ref": "#/components/schemas/RecurrenceDuration", "description": "Duration representing when to send notifications, relative to renewal date" }, "isRestricted": { "type": "boolean", "description": "Whether this document contains sensitive data and needs more restrictive read access" }, "auditorEmail": { "type": "string", "description": "Email of the auditor who created the custom evidence request." } }, "required": [ "controlIds", "title", "description", "cadence", "reminderWindow", "isRestricted", "auditorEmail" ], "type": "object", "additionalProperties": false }, "Control": { "properties": { "id": { "type": "string", "description": "The control's unique ID." }, "externalId": { "type": "string", "nullable": true, "description": "The control's external ID." }, "name": { "type": "string", "description": "The control's name." }, "description": { "type": "string", "description": "The control's description." }, "source": { "$ref": "#/components/schemas/ControlSource", "description": "The control's source, either \"VANTA\" or \"CUSTOM\"." }, "domains": { "items": { "type": "string" }, "type": "array", "description": "The security domains that the control belongs to." }, "owner": { "allOf": [ { "$ref": "#/components/schemas/Owner" } ], "nullable": true, "description": "The control's owner." }, "role": { "type": "string", "nullable": true, "description": "The control's GDPR role, if the control is a GDPR control." }, "customFields": { "items": { "$ref": "#/components/schemas/CustomField" }, "type": "array", "description": "The control's custom field values, if control custom fields is included in your Vanta instance." }, "creationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "When the control was created. Returns null for Vanta library controls." }, "modificationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "When the control was last modified. Returns null for Vanta library controls." } }, "required": [ "id", "externalId", "name", "description", "source", "domains", "owner", "customFields", "creationDate", "modificationDate" ], "type": "object", "additionalProperties": false }, "ControlDomain": { "enum": [ "ARTIFICIAL_&_AUTONOMOUS_TECHNOLOGY", "ASSET_MANAGEMENT", "BUSINESS_CONTINUITY_&_DISASTER_RECOVERY", "CAPACITY_&_PERFORMANCE_PLANNING", "CHANGE_MANAGEMENT", "CLOUD_SECURITY", "COMPLIANCE", "CONFIGURATION_MANAGEMENT", "CONTINUOUS_MONITORING", "CRYPTOGRAPHIC_PROTECTIONS", "DATA_CLASSIFICATION_&_HANDLING", "EMBEDDED_TECHNOLOGY", "ENDPOINT_SECURITY", "HUMAN_RESOURCES_SECURITY", "IDENTIFICATION_&_AUTHENTICATION", "INCIDENT_RESPONSE", "INFORMATION_ASSURANCE", "MAINTENANCE", "MOBILE_DEVICE_MANAGEMENT", "NETWORK SECURITY", "PHYSICAL_&_ENVIRONMENTAL_SECURITY", "PRIVACY", "PROJECT_&_RESOURCE MANAGEMENT", "RISK_MANAGEMENT", "SECURE_ENGINEERING_&_ARCHITECTURE", "SECURITY_AWARENESS_&_TRAINING", "SECURITY_OPERATIONS", "SECURITY_&_PRIVACY_GOVERNANCE", "TECHNOLOGY_DEVELOPMENT_&_ACQUISITION", "THIRD-PARTY_MANAGEMENT", "THREAT_MANAGEMENT", "VULNERABILITY_&_PATCH_MANAGEMENT", "WEB_SECURITY", "ADMINISTRATIVE", "PHYSICAL", "TECHNICAL", "BASIC", "DERIVED" ], "type": "string" }, "FrameworkId": { "enum": [ "AU_E_8", "AWS_FTR", "CCPA", "CIS_V8", "CPS_234", "DORA", "FEDRAMP", "GDPR", "HIPAA", "HITRUST_E1", "ISO_27001", "ISO_27001_2022", "ISO_27017", "ISO_27018", "ISO_27701", "ISO_42001", "ISO_9001", "MSFT_SSPA", "MVSP", "NIS_2D", "NIST_171", "NIST_53", "NIST_AI_RMF", "NIST_CSF", "NIST_CSF_2", "OFDSS", "PCI_SAQ_A", "PCI_SAQ_A_EP", "PCI_SAQ_D_MERCHANT", "PCI_SAQ_D_SP", "PCI_DDS_4", "SOC_2", "SOX_ITGC", "UK_CYBER_ESSENTIALS", "US_DATA_PRIVACY" ], "type": "string" }, "FrameworkSection": { "properties": { "frameworkId": { "anyOf": [ { "$ref": "#/components/schemas/FrameworkId" }, { "type": "string" } ] }, "sectionId": { "type": "string" } }, "required": [ "frameworkId", "sectionId" ], "type": "object", "additionalProperties": false }, "GdprRole": { "enum": [ "BOTH", "CONTROLLER", "PROCESSOR" ], "type": "string" }, "CreateCustomControlInput": { "properties": { "externalId": { "type": "string", "description": "The external id of the control." }, "name": { "type": "string", "nullable": true, "description": "The name of the control." }, "description": { "type": "string", "description": "The description of the control." }, "effectiveDate": { "type": "string", "format": "date-time", "description": "The effective date of the control." }, "category": { "$ref": "#/components/schemas/ControlDomain", "description": "The category of the control. See the ControlDomain enum for possible values." }, "sections": { "items": { "$ref": "#/components/schemas/FrameworkSection" }, "type": "array", "nullable": true, "description": "Framework sections that the control should be mapped to." }, "role": { "allOf": [ { "$ref": "#/components/schemas/GdprRole" } ], "nullable": true, "description": "The GDPR role of the control, which specifies whether the data is being \"collected\" or \"processed\". See the GdprRole enum for possible values.\nThis field should only be included for controls that are to be mapped to the GDPR framework." } }, "required": [ "externalId", "name", "description", "effectiveDate", "category" ], "type": "object", "additionalProperties": false }, "VulnerabilityType": { "type": "string", "enum": [ "CONFIGURATION", "COMMON", "GROUPED" ] }, "ExternalFindingSeverityType": { "type": "string", "enum": [ "CRITICAL", "HIGH", "LOW", "MEDIUM" ], "nullable": false }, "AuditorApiVulnerability": { "properties": { "id": { "type": "string", "description": "Unique identifier for the vulnerability." }, "name": { "type": "string", "description": "Display name of the vulnerability." }, "description": { "type": "string", "description": "Description of the vulnerability." }, "integrationId": { "type": "string", "description": "Integration that the vulnerability is scanned by." }, "packageIdentifier": { "type": "string", "nullable": true, "description": "Identifier for the package that the vulnerability is found on.\nOnly relevant to vulnerabilities of type COMMON or GROUPED." }, "vulnerabilityType": { "$ref": "#/components/schemas/VulnerabilityType", "description": "Type of the vulnerability.\nPossible values: CONFIGURATION, COMMON, GROUPED." }, "targetId": { "type": "string", "description": "Unique identifier for the underlying resource that the vulnerability is found on." }, "firstDetectedDate": { "type": "string", "format": "date-time", "description": "Date when the vulnerability was first detected by Vanta." }, "sourceDetectedDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability was first detected by the source." }, "lastDetectedDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability was last detected." }, "severity": { "$ref": "#/components/schemas/ExternalFindingSeverityType", "description": "Severity of the vulnerability.\nPossible values: LOW, MEDIUM, HIGH, CRITICAL." }, "cvssSeverityScore": { "type": "number", "format": "double", "nullable": true, "description": "CVSS severity score of the vulnerability." }, "scannerScore": { "type": "number", "format": "double", "nullable": true, "description": "Scanner score of the vulnerability." }, "isFixable": { "type": "boolean", "description": "Whether the vulnerability is fixable." }, "remediateByDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability should be remediated by." }, "relatedVulns": { "items": { "type": "string" }, "type": "array", "description": "Related vulnerabilities.\nOnly relevant to vulnerabilities of type GROUPED." }, "relatedUrls": { "items": { "type": "string" }, "type": "array", "description": "Related URLs." }, "externalURL": { "type": "string", "description": "External URL for the vulnerability." }, "scanSource": { "type": "string", "description": "Scanning tool that detected the vulnerability" }, "deactivateMetadata": { "properties": { "isVulnDeactivatedIndefinitely": { "type": "boolean", "description": "Whether the vulnerability is deactivated indefinitely." }, "deactivatedUntilDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the vulnerability will be reactivated." }, "deactivationReason": { "type": "string", "description": "Reason for deactivating the vulnerability." }, "deactivatedOnDate": { "type": "string", "format": "date-time", "description": "Date when the vulnerability was deactivated." }, "deactivatedBy": { "type": "string", "description": "Identifier of the user who deactivated the vulnerability." } }, "required": [ "isVulnDeactivatedIndefinitely", "deactivatedUntilDate", "deactivationReason", "deactivatedOnDate", "deactivatedBy" ], "type": "object", "nullable": true, "description": "Metadata for the deactivation of the vulnerability." } }, "required": [ "id", "name", "description", "integrationId", "packageIdentifier", "vulnerabilityType", "targetId", "firstDetectedDate", "sourceDetectedDate", "lastDetectedDate", "severity", "cvssSeverityScore", "scannerScore", "isFixable", "remediateByDate", "relatedVulns", "relatedUrls", "externalURL", "deactivateMetadata" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AuditorApiVulnerability_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AuditorApiVulnerability" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "VulnerableAssetType": { "type": "string", "enum": [ "SERVER", "SERVERLESS_FUNCTION", "CONTAINER", "CONTAINER_REPOSITORY", "CONTAINER_REPOSITORY_IMAGE", "CODE_REPOSITORY", "MANIFEST_FILE", "WORKSTATION", "OTHER" ], "description": "VulnerableAssetType describes the types of assets a vulnerability is on." }, "KeyValuePair": { "properties": { "key": { "type": "string", "description": "Key of key-value pair." }, "value": { "type": "string", "description": "Value of key-value pair." } }, "required": [ "key", "value" ], "type": "object", "additionalProperties": false }, "VulnerableAssetScanner": { "properties": { "resourceId": { "type": "string", "description": "The scanned asset's Vanta resource id." }, "integrationId": { "type": "string", "description": "Integration that the the vulnerable asset is scanned by." }, "imageDigest": { "type": "string", "nullable": true, "description": "Digest of the scanned container image." }, "imagePushedAtDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Push date of the scanned container image." }, "imageTags": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "Tags of the scanned container image." }, "assetTags": { "items": { "$ref": "#/components/schemas/KeyValuePair" }, "type": "array", "nullable": true, "description": "Tags of the scanned asset." }, "parentAccountOrOrganization": { "type": "string", "nullable": true, "description": "The parent account or organization of the scanned asset." }, "biosUuid": { "type": "string", "nullable": true, "description": "BIOS UUID of the scanned asset." }, "ipv4s": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "IPV4s of the scanned asset." }, "ipv6s": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "IPV6s of the scanned asset." }, "macAddresses": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "Mac addresses of the scanned asset." }, "hostnames": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "Host names of the scanned asset." }, "fqdns": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "fqdns of the scanned asset." }, "operatingSystems": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "Operating systems of the scanned asset." }, "targetId": { "type": "string", "nullable": true, "description": "The asset's identifier code." } }, "required": [ "resourceId", "integrationId", "imageDigest", "imagePushedAtDate", "imageTags", "assetTags", "parentAccountOrOrganization", "biosUuid", "ipv4s", "ipv6s", "macAddresses", "hostnames", "fqdns", "operatingSystems", "targetId" ], "type": "object", "additionalProperties": false }, "VulnerableAsset": { "properties": { "id": { "type": "string", "description": "Unique identifier for the vulnerable asset." }, "name": { "type": "string", "description": "Display name of the vulnerable asset." }, "assetType": { "$ref": "#/components/schemas/VulnerableAssetType", "description": "Type of the vulnerable asset.\nPossible values: CODE_REPOSITORY, CONTAINER_REPOSITORY, CONTAINER_REPOSITORY_IMAGE, MANIFEST_FILE, SERVER, SERVERLESS_FUNCTION, WORKSTATION." }, "hasBeenScanned": { "type": "boolean", "description": "Whether the vulnerable asset has been scanned." }, "imageScanTag": { "type": "string", "nullable": true, "description": "Only relevant for container repositories. This field sets the container image tag that vulnerabilities will be retrieved for. If null, the latest image will be retrieved." }, "scanners": { "items": { "$ref": "#/components/schemas/VulnerableAssetScanner" }, "type": "array", "description": "The integrations that are scanning this vulnerable asset." } }, "required": [ "id", "name", "assetType", "hasBeenScanned", "imageScanTag", "scanners" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_VulnerableAsset_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/VulnerableAsset" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "WorkpaperStatus": { "type": "string", "enum": [ "NOT_GENERATED", "IN_PROGRESS", "READY" ] }, "TestWorkpaperResponse": { "properties": { "status": { "$ref": "#/components/schemas/WorkpaperStatus" }, "url": { "type": "string", "nullable": true }, "filename": { "type": "string", "nullable": true }, "mimeType": { "type": "string", "nullable": true } }, "required": [ "status", "url", "filename", "mimeType" ], "type": "object", "additionalProperties": false }, "AuditVendorRiskLevel": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "UNSCORED" ] }, "AuditVendorStatus": { "type": "string", "enum": [ "ACTIVE", "ARCHIVED", "IN_PROCUREMENT" ] }, "AuditVendor": { "description": "Managed vendor row returned by the auditor managed-vendors API.\n\nOnly `id` and `name` are required. All other fields are optional to support\ncontrolled audits where only approved columns are returned and\ncustomizable field visibility.", "properties": { "id": { "type": "string", "description": "Vendor record ID.", "example": "5f2c939a52855e725c8d5824" }, "name": { "type": "string", "description": "Vendor name.", "example": "Acme Corp" }, "inherentRisk": { "$ref": "#/components/schemas/AuditVendorRiskLevel", "description": "Inherent risk level of the vendor.", "example": "HIGH" }, "status": { "$ref": "#/components/schemas/AuditVendorStatus", "description": "Vendor status.", "example": "ACTIVE" }, "findings": { "type": "number", "format": "double", "description": "Number of findings associated with the vendor.", "example": 3 }, "lastReviewedCompleted": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the last security review was completed, or null if none.", "example": "2025-01-15T10:00:00.000Z" }, "nextSecurityReviewDueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Date when the next security review is due, or null if not scheduled.", "example": "2025-07-15T10:00:00.000Z" }, "vendorCategory": { "type": "string", "nullable": true, "description": "Vendor category (e.g. cloud provider, SaaS).", "example": "cloudProvider" }, "residualRisk": { "allOf": [ { "$ref": "#/components/schemas/AuditVendorRiskLevel" } ], "nullable": true, "description": "Residual risk level of the vendor.\nFull Audit View only - omitted in Controlled Audit View.", "example": "HIGH" }, "dataAgreements": { "properties": { "total": { "type": "number", "format": "double" }, "complete": { "type": "number", "format": "double" } }, "required": [ "total", "complete" ], "type": "object", "nullable": true, "description": "BAA/DPA document completion counts, or null if no such documents are required.\nFull Audit View only - omitted in Controlled Audit View." } }, "required": [ "id", "name" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AuditVendor_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AuditVendor" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "VendorOrderBy": { "type": "string", "enum": [ "name", "inherentRisk" ] }, "OrderDirection": { "type": "string", "enum": [ "asc", "desc" ], "description": "Sort direction shared across the external REST API surface.\n\n`\"asc\"` for ascending, `\"desc\"` for descending. Endpoints expose this as the\n`orderDirection` / `sortDirection` query parameter and map it onto whatever\ninternal direction representation the underlying service expects." }, "RiskSnapshot": { "description": "A risk assessment snapshot available for an audit.\n\nRisk snapshots capture the state of an organization's risk register at a\npoint in time. Use the snapshot `id` with the `/audits/{auditId}/risks/{snapshotId}`\nendpoint to retrieve the risk scenarios within a snapshot.", "properties": { "id": { "type": "string", "description": "Unique identifier for the risk snapshot.", "example": "507f1f77bcf86cd799439011" }, "createdAt": { "type": "string", "format": "date-time", "description": "The date and time when this risk snapshot was created." } }, "required": [ "id", "createdAt" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_RiskSnapshot_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/RiskSnapshot" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AuditRiskTreatment": { "type": "string", "enum": [ "ACCEPT", "AVOID", "MITIGATE", "TRANSFER" ], "description": "Risk treatment strategy returned by the auditor API." }, "AuditRiskTreatmentStatus": { "type": "string", "enum": [ "IN_PROGRESS", "DONE" ], "description": "Treatment implementation status returned by the auditor API." }, "AuditRiskReviewStatus": { "type": "string", "enum": [ "APPROVED", "DRAFT", "NOT_REVIEWED", "AWAITING_SUBMISSION", "PENDING_APPROVAL", "REQUESTED_CHANGES" ], "description": "Risk scenario review status returned by the auditor API." }, "AuditRiskOwner": { "description": "Owner information for a risk.", "properties": { "displayName": { "type": "string", "description": "Display name of the risk owner.", "example": "Jane Doe" }, "imageUrl": { "type": "string", "nullable": true, "description": "URL of the owner's profile image, or null if not available.", "example": "https://app.vanta.com/avatar.png" } }, "required": [ "displayName", "imageUrl" ], "type": "object", "additionalProperties": false }, "AuditRiskCia": { "type": "string", "enum": [ "AVAILABILITY", "CONFIDENTIALITY", "INTEGRITY" ], "description": "CIA triad category returned by the auditor API." }, "AuditRisk": { "description": "A risk record from the risk population.\n\n`id` and `riskId` are required. All other fields are optional to support customizable field visibility.\n\nOmitted keys mean the column is not in the response; `null` means the column is present but empty.", "properties": { "id": { "type": "string", "description": "Unique identifier for the risk scenario version.", "example": "5f2c939a52855e725c8d5824" }, "riskId": { "type": "string", "nullable": true, "description": "Custom risk ID (e.g., \"RISK-001\"), or null if not available.", "example": "RISK-001" }, "riskScenario": { "type": "string", "nullable": true, "description": "Description of the risk scenario, or null if not available.", "example": "Unauthorized access to production database" }, "likelihood": { "type": "number", "format": "double", "nullable": true, "description": "Likelihood score of the risk, or null if not scored.\nFull Audit View only - omitted in Controlled Audit View.", "example": 4 }, "impact": { "type": "number", "format": "double", "nullable": true, "description": "Impact score of the risk, or null if not scored.\nFull Audit View only - omitted in Controlled Audit View.", "example": 5 }, "inherentRisk": { "type": "number", "format": "double", "nullable": true, "description": "Inherent risk score (likelihood * impact), or null if not calculable.", "example": 20 }, "treatment": { "allOf": [ { "$ref": "#/components/schemas/AuditRiskTreatment" } ], "nullable": true, "description": "Risk treatment strategy, or null if not set.", "example": "MITIGATE" }, "treatmentStatus": { "allOf": [ { "$ref": "#/components/schemas/AuditRiskTreatmentStatus" } ], "nullable": true, "description": "Treatment implementation status, or null if not set.", "example": "IN_PROGRESS" }, "residualRisk": { "type": "number", "format": "double", "nullable": true, "description": "Residual risk score after treatment, or null if not calculable.", "example": 6 }, "reviewStatus": { "allOf": [ { "$ref": "#/components/schemas/AuditRiskReviewStatus" } ], "nullable": true, "description": "Review status of the risk scenario, or null if not set.", "example": "APPROVED" }, "owner": { "allOf": [ { "$ref": "#/components/schemas/AuditRiskOwner" } ], "nullable": true, "description": "Risk owner information, or null if no owner assigned.", "example": { "displayName": "Jane Doe", "imageUrl": "https://app.vanta.com/avatar.png" } }, "categories": { "items": { "type": "string" }, "type": "array", "description": "Risk category names, or empty array if not categorized.", "example": [ "Cryptography", "Privacy" ] }, "ciaCategories": { "items": { "$ref": "#/components/schemas/AuditRiskCia" }, "type": "array", "description": "CIA triad categories, or empty array if not categorized.", "example": [ "CONFIDENTIALITY", "INTEGRITY" ] }, "linkedControlIds": { "items": { "type": "string" }, "type": "array", "description": "IDs of controls linked to this risk scenario, or empty array if none.\nFull Audit View only - omitted in Controlled Audit View.", "example": [ "control-1", "control-2" ] }, "identified": { "type": "string", "nullable": true, "description": "When the risk was identified, or null if not recorded.\nISO 8601 format.", "example": "2023-01-15T10:00:00.000Z" } }, "required": [ "id", "riskId" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AuditRisk_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AuditRisk" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "RiskOrderBy": { "type": "string", "enum": [ "inherentRisk", "riskId", "riskScenario", "treatment", "residualRisk", "reviewStatus", "owner", "categories", "ciaCategories", "identified" ] }, "PersonnelGroupTask": { "description": "A task assigned to a personnel group.", "properties": { "name": { "type": "string", "description": "Task name" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "PersonnelGroup": { "description": "A group record from the personnel population.\n\n`id` and `name` are required. All other fields are optional to support customizable field visibility.\n\nOmitted keys mean the column is not in the response; `null` means the column is present but empty.", "properties": { "id": { "type": "string", "description": "Unique identifier for the group.", "example": "5f2c939a52855e725c8d5824" }, "name": { "type": "string", "description": "Display name of the group.", "example": "Engineering" }, "members": { "type": "number", "format": "double", "description": "Number of people in this group within the audit scope.", "example": 42 }, "source": { "type": "string", "description": "The source of this group.\nFor IDP-synced groups, this is the provider name (e.g., \"Okta\", \"Azure AD\").\nFor manually created groups, this is \"Vanta\".", "example": "Okta" }, "tasks": { "items": { "$ref": "#/components/schemas/PersonnelGroupTask" }, "type": "array", "description": "Security tasks enabled for this group, or empty array if not available.", "example": [ { "name": "Security Training" }, { "name": "Policy Acceptance" } ] }, "tasksLastUpdated": { "type": "string", "nullable": true, "description": "When the group's task configuration was last updated, or null if never updated.\nISO 8601 format.", "example": "2024-06-15T10:30:00.000Z" }, "pointOfContact": { "type": "string", "nullable": true, "description": "Display name of the group's designated point of contact, or null if not set.", "example": "Jane Doe" } }, "required": [ "id", "name" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_PersonnelGroup_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/PersonnelGroup" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "GroupOrderBy": { "type": "string", "enum": [ "name", "members", "source", "tasksLastUpdated", "pointOfContact" ] }, "PeopleEmploymentStatus": { "type": "string", "enum": [ "CURRENTLY_EMPLOYED", "INACTIVE_EMPLOYEE", "NOT_PEOPLE", "ON_LEAVE", "PREVIOUSLY_EMPLOYED", "UPCOMING_EMPLOYEE" ], "description": "Employment status filter for people queries." }, "PeopleSourceInfo": { "description": "Source information for a person's data.\nFull Audit View only - omitted in Controlled Audit View.", "properties": { "mainSource": { "type": "string", "description": "Main source of user data.", "example": "Okta" }, "supplementarySource": { "type": "string", "nullable": true, "description": "Supplementary source, or null if none.", "example": "Google Workspace" } }, "required": [ "mainSource", "supplementarySource" ], "type": "object", "additionalProperties": false }, "PeopleTaskStatus": { "type": "string", "enum": [ "NO_SECURITY_TASKS", "OFFBOARDING_COMPLETE", "OFFBOARDING_DUE_SOON", "OFFBOARDING_OVERDUE", "PAUSED", "SECURITY_TASKS_COMPLETE", "SECURITY_TASKS_DUE_SOON", "SECURITY_TASKS_OVERDUE" ], "description": "Overall user task status." }, "PeopleTaskStatusInfo": { "description": "Overall task status information for a person.\nFull Audit View only - omitted in Controlled Audit View.", "properties": { "status": { "$ref": "#/components/schemas/PeopleTaskStatus", "description": "Overall task status.", "example": "SECURITY_TASKS_COMPLETE" }, "dueDate": { "type": "string", "nullable": true, "description": "Due date for the earliest incomplete task in ISO 8601 format, or null if none.", "example": "2024-03-15" }, "completionDate": { "type": "string", "nullable": true, "description": "Completion date when all tasks are complete in ISO 8601 format, or null if incomplete.", "example": "2024-01-20" }, "numTasksCompleted": { "type": "number", "format": "double", "nullable": true, "description": "Count of completed tasks, or null if not available.", "example": 5 }, "numTasksOverdue": { "type": "number", "format": "double", "nullable": true, "description": "Count of overdue tasks, or null if not available.", "example": 2 }, "numTasksDueSoon": { "type": "number", "format": "double", "nullable": true, "description": "Count of tasks due soon, or null if not available.", "example": 1 } }, "required": [ "status", "dueDate", "completionDate", "numTasksCompleted", "numTasksOverdue", "numTasksDueSoon" ], "type": "object", "additionalProperties": false }, "PeopleSecurityTaskStatus": { "type": "string", "enum": [ "NO_SECURITY_TASKS", "SECURITY_TASKS_COMPLETE", "SECURITY_TASKS_DUE_SOON", "SECURITY_TASKS_OVERDUE" ], "description": "Security task status for individual task categories." }, "PeopleSecurityTaskDetails": { "description": "Security task details for a specific task category.\nFull Audit View only - omitted in Controlled Audit View.", "properties": { "status": { "$ref": "#/components/schemas/PeopleSecurityTaskStatus", "description": "Task status for this category.", "example": "SECURITY_TASKS_COMPLETE" }, "dueDate": { "type": "string", "nullable": true, "description": "Due date for incomplete task in ISO 8601 format, or null if none.", "example": "2024-03-15" }, "completionDate": { "type": "string", "nullable": true, "description": "Completion date for completed task in ISO 8601 format, or null if incomplete.", "example": "2024-01-20" } }, "required": [ "status", "dueDate", "completionDate" ], "type": "object", "additionalProperties": false }, "PersonnelPerson": { "description": "Personnel person data.\n\n`id`, `name`, and `email` are required. All other fields are optional to support customizable field visibility.\n\nOmitted keys mean the column is not in the response; `null` means the column is present but empty.", "properties": { "id": { "type": "string", "description": "User ID - always present.", "example": "5f2c939a52855e725c8d5824" }, "name": { "type": "string", "description": "Display name of the person - always present.", "example": "John Doe" }, "email": { "type": "string", "description": "Email address of the person - always present.", "example": "john.doe@example.com" }, "jobTitle": { "type": "string", "nullable": true, "description": "Job title from HR system, or null if not available.", "example": "Software Engineer" }, "employmentStatus": { "allOf": [ { "$ref": "#/components/schemas/PeopleEmploymentStatus" } ], "nullable": true, "description": "Employment status, or null if not available.", "example": "CURRENTLY_EMPLOYED" }, "startDate": { "type": "string", "nullable": true, "description": "Start date in ISO 8601 format (YYYY-MM-DD), or null if not available.\nTimezone depends on source: UTC if from HR system,\ncustomer timezone if manually entered.", "example": "2021-01-15" }, "endDate": { "type": "string", "nullable": true, "description": "End date in ISO 8601 format (YYYY-MM-DD), or null if currently employed.", "example": "2021-01-15" }, "groups": { "items": { "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": "object" }, "type": "array", "description": "Groups (roles) the person belongs to. Present only when the column is in the response;\nuse an empty array when there are no groups.", "example": [ { "name": "Engineering" }, { "name": "Admin" } ] }, "source": { "allOf": [ { "$ref": "#/components/schemas/PeopleSourceInfo" } ], "nullable": true, "description": "Source of user data, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "taskStatus": { "allOf": [ { "$ref": "#/components/schemas/PeopleTaskStatusInfo" } ], "nullable": true, "description": "Overall task status information, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "lastReminded": { "type": "string", "nullable": true, "description": "Last date user was sent an onboarding reminder email in ISO 8601 format, or null if never reminded.\nFull Audit View only - omitted in Controlled Audit View.", "example": "2024-01-15" }, "policies": { "allOf": [ { "$ref": "#/components/schemas/PeopleSecurityTaskDetails" } ], "nullable": true, "description": "Policy acceptance task details, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "trainings": { "allOf": [ { "$ref": "#/components/schemas/PeopleSecurityTaskDetails" } ], "nullable": true, "description": "Security training task details, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "backgroundChecks": { "allOf": [ { "$ref": "#/components/schemas/PeopleSecurityTaskDetails" } ], "nullable": true, "description": "Background check task details, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "deviceMonitoring": { "allOf": [ { "$ref": "#/components/schemas/PeopleSecurityTaskDetails" } ], "nullable": true, "description": "Device monitoring task details, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "customOnboarding": { "allOf": [ { "$ref": "#/components/schemas/PeopleSecurityTaskDetails" } ], "nullable": true, "description": "Custom onboarding task details, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." }, "customOffboarding": { "allOf": [ { "$ref": "#/components/schemas/PeopleSecurityTaskDetails" } ], "nullable": true, "description": "Custom offboarding task details, or null if not available.\nFull Audit View only - omitted in Controlled Audit View." } }, "required": [ "id", "name", "email" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_PersonnelPerson_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/PersonnelPerson" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "PeopleOrderBy": { "type": "string", "enum": [ "name", "employmentStatus" ] }, "AccountAccessService": { "description": "An account access service (identity provider, access credential, or external application)\nconnected to the organization.\n\nThese represent credentials for integrations like Okta, Azure AD,\nGoogle Workspace, etc. that provide identity and access management\ndata for personnel, as well as external applications that provide\nreceived user accounts.", "properties": { "id": { "type": "string", "description": "Unique identifier for the service.", "example": "credential_abc123" }, "credentialDisplayName": { "type": "string", "description": "Display name of the service shown to users.", "example": "Okta - Production" }, "service": { "type": "string", "description": "The service name or integration ID.", "example": "okta" }, "subAccountId": { "type": "string", "nullable": true, "description": "Sub-account identifier for multi-account integrations, or null if not applicable.", "example": "sub_account_456" } }, "required": [ "id", "credentialDisplayName", "service", "subAccountId" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AccountAccessService_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AccountAccessService" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AccountAccessStatus": { "type": "string", "enum": [ "ACTIVE", "DEACTIVATED", "UNKNOWN" ], "description": "Account status values for account access records.\nUnified status enum that covers all service types." }, "AccountAccess": { "description": "Account access record from personnel population.\n\nThis unified interface represents account access data from all service types:\n- IDP services (Okta, Azure AD, Google Workspace, etc.)\n- First-party account services (AWS, Azure, GCP, Oracle Cloud, etc.)\n- Role grants services (GCP, Azure role grants)\n- Received/third-party applications\n\nOnly `id` and `accountName` are always present. Other fields are optional so\ndisallowed columns can be omitted (for example under controlled audit view).\nWhen an optional field is present, `null` means the column is visible but empty\n(only fields that are nullable in population data use `null`).", "properties": { "id": { "type": "string", "description": "Unique identifier for the account.", "example": "5f2c939a52855e725c8d5824" }, "accountName": { "type": "string", "description": "Account name or email address (primary identifier).", "example": "john.doe@example.com" }, "owner": { "type": "string", "nullable": true, "description": "Display name of the account owner, or null when the column is visible but unknown.", "example": "John Doe" }, "role": { "items": { "type": "string" }, "type": "array", "description": "Account roles; empty array when the column is visible but has no roles.", "example": [ "Admin" ] }, "status": { "$ref": "#/components/schemas/AccountAccessStatus", "description": "Account status when present; omitted when the column is not in the response.", "example": "ACTIVE" }, "mfa": { "type": "boolean", "nullable": true, "description": "Multi-factor authentication (MFA) status when present.\n`true` = MFA enabled, `false` = MFA not enabled, `null` = visible but unknown.", "example": true }, "createdDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Account creation date when present, or null when visible but absent.", "example": "2024-01-15T10:30:00.000Z" }, "deactivatedDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Account deactivation date when present, or null when active.", "example": "2024-06-20T08:00:00.000Z" } }, "required": [ "id", "accountName" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AccountAccess_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AccountAccess" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ComputerOsPlatform": { "type": "string", "enum": [ "darwin", "linux", "windows" ] }, "ComputerOwner": { "description": "Identifier and display name for the personnel record that owns a device.", "properties": { "id": { "type": "string", "description": "Personnel record id.", "example": "5f2c939a52855e725c8d5824" }, "name": { "type": "string", "description": "Owner display name.", "example": "Alice Example" } }, "required": [ "id", "name" ], "type": "object", "additionalProperties": false }, "ComputerComplianceOutcome": { "type": "string", "enum": [ "NA", "IN_PROGRESS", "FAIL", "PASS" ] }, "UnmonitoredReason": { "description": "Reasons the device's agent considers it unsupported (and therefore\nunmonitored). Each flag is `true` when the corresponding reason applies.\n\nOnly populated for devices reported by an agent monitoring source; MDM and\nconnector reports leave this `null`.", "properties": { "unsupportedOsVersion": { "type": "boolean", "nullable": true, "description": "The device's OS version is below the agent's minimum supported version.", "example": true }, "unsupportedOsType": { "type": "boolean", "nullable": true, "description": "The device's OS type is not supported by the agent.", "example": false }, "unsupportedAgentVersion": { "type": "boolean", "nullable": true, "description": "The installed agent version is below the minimum supported version.", "example": false } }, "type": "object", "additionalProperties": false }, "PersonnelComputer": { "description": "A monitored-computer record from the personnel population.\n\n`id` is required. All other fields are optional to support customizable field\nvisibility under Controlled Audit View (CAV).\n\nOmitted keys mean the column is not in the response; `null` means the column\nis present but empty.", "properties": { "id": { "type": "string", "description": "Unique identifier for the device.", "example": "5f2c939a52855e725c8d5824" }, "deviceName": { "type": "string", "nullable": true, "description": "Display name of the device, or null if not reported.", "example": "alice-laptop" }, "osPlatform": { "allOf": [ { "$ref": "#/components/schemas/ComputerOsPlatform" } ], "nullable": true, "description": "Operating-system platform, or null if not reported.", "example": "darwin" }, "osVersion": { "type": "string", "nullable": true, "description": "Operating-system version string, or null if not reported.", "example": "14.4.1" }, "owner": { "allOf": [ { "$ref": "#/components/schemas/ComputerOwner" } ], "nullable": true, "description": "The personnel record that owns the device, or null if unassigned." }, "monitoredBy": { "type": "string", "nullable": true, "description": "Service that monitors the device. Reflects the primary monitoring source --\nagents, MDM, or connectors (e.g. \"macOS\", \"Windows\", \"Vanta D\"). Null if\nunmonitored.", "example": "macOS" }, "passwordManager": { "$ref": "#/components/schemas/ComputerComplianceOutcome", "description": "Outcome of the password-manager compliance check (PW column).", "example": "PASS" }, "hardDriveEncrypted": { "$ref": "#/components/schemas/ComputerComplianceOutcome", "description": "Outcome of the hard-drive-encryption compliance check (HD column).", "example": "PASS" }, "antivirusInstalled": { "$ref": "#/components/schemas/ComputerComplianceOutcome", "description": "Outcome of the antivirus-installed compliance check (AV column).", "example": "PASS" }, "screenlockEnabled": { "$ref": "#/components/schemas/ComputerComplianceOutcome", "description": "Outcome of the screenlock-enabled compliance check (SL column).", "example": "PASS" }, "unmonitoredReason": { "allOf": [ { "$ref": "#/components/schemas/UnmonitoredReason" } ], "nullable": true, "description": "Reasons the device's agent considers it unsupported (and therefore\nunmonitored). Only populated for agent-reported devices; null for MDM and\nconnector sources." } }, "required": [ "id" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_PersonnelComputer_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/PersonnelComputer" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "PersonnelComputerStatusFilter": { "type": "string", "enum": [ "AV_NOT_INSTALLED", "HD_NOT_ENCRYPTED", "LAST_CHECK_OVER_14_DAYS", "PWM_NOT_INSTALLED", "SCREENLOCK_NOT_CONFIGURED" ] }, "ComputerOrderBy": { "type": "string", "enum": [ "owner", "deviceName", "monitoredBy", "osVersion" ] }, "ComputerMonitoringService": { "description": "A service that can appear in the `monitoredBy` field of a personnel\ncomputer record (and thus be used as a filter value via\n`monitoredByMatchesAny` on the parent endpoint).\n\nThe set returned by this listing reflects the customer's currently\ninstalled integrations -- it is dynamic, not a fixed enum, which is why\nthe filter parameter on the parent endpoint accepts free-form strings.", "properties": { "id": { "type": "string", "description": "Identifier to pass into the `monitoredByMatchesAny` query parameter on\n`GET /audits/{auditId}/personnel/computers`. Matches the `monitoredBy`\nfield on a `PersonnelComputer` record exactly.", "example": "jamf" }, "displayName": { "type": "string", "description": "Human-readable name for display. Sourced from the integration's\nconfigured display name (or, for connectors, the external application's\nname).", "example": "Jamf" } }, "required": [ "id", "displayName" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_ComputerMonitoringService_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/ComputerMonitoringService" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AuditOrganizationNotificationSubscription": { "description": "A single external-notification subscription row returned by the auditor\norganization notifications API. Represents one mailing-list address +\nnotification-category pairing.", "properties": { "id": { "type": "string", "description": "Subscription record identifier.", "example": "65fa1b2c3d4e5f6789012345" }, "address": { "type": "string", "description": "Email address that receives notifications for this category.", "example": "security-alerts@acme.example.com" }, "cadence": { "type": "string", "nullable": true, "description": "Cadence of summary notifications for this subscription, or null for\nnon-summary (immediate / reminder) subscriptions.", "example": "WEEKLY" }, "unsubSettingsKey": { "type": "string", "description": "Notification category the subscription belongs to (e.g.\n`SUMMARY_EMPLOYEE`, `NEW_VENDORS_DISCOVERED_EMAIL`,\n`TRUST_REPORT_ACCESS_REQUEST_EMAIL`).", "example": "SUMMARY_EMPLOYEE" }, "toggleIsSubscribed": { "type": "boolean", "description": "Whether the address is currently subscribed to receive this category's\nnotifications.", "example": true } }, "required": [ "id", "address", "cadence", "unsubSettingsKey", "toggleIsSubscribed" ], "type": "object", "additionalProperties": false }, "AuditOrganizationNotifications": { "description": "Organization notifications record returned by the auditor API.\n\nAd-hoc single-row payload per domain mirroring the shape of the\nOrganization → Notifications page. Only `id` is guaranteed; every other\nfield is optional because controlled audit views can strip any column\nfrom the response.", "properties": { "id": { "type": "string", "description": "Domain identifier of the audited organization.", "example": "5f2c939a52855e725c8d5824" }, "preferredTimeZone": { "type": "string", "nullable": true, "description": "IANA timezone identifier that determines when scheduled reminder\nnotifications are sent. `null` means the organization has no configured\npreference (\"Anytime\" in the UI).", "example": "America/New_York" }, "employeeDigestFrequency": { "type": "string", "nullable": true, "description": "Frequency at which personnel reminder digests are sent (e.g. `DAILY`,\n`WEEKLY`, or `NEVER`). `null` when no notification settings have been\nconfigured for the organization.", "example": "WEEKLY" }, "subscribedChannelTypes": { "items": { "type": "string" }, "type": "array", "description": "Channels on which the personnel reminder digest is delivered (e.g.\n`[\"EMAIL\"]` or `[\"EMAIL\", \"SLACK\"]`).", "example": [ "EMAIL" ] }, "externalNotifications": { "items": { "$ref": "#/components/schemas/AuditOrganizationNotificationSubscription" }, "type": "array", "description": "External notification subscriptions — one row per mailing-list address\nplus category pairing. Covers Compliance, Vendors, Access Reviews, and\nTrust Center categories." } }, "required": [ "id" ], "type": "object", "additionalProperties": false }, "AuditOrganizationCompanyLogo": { "description": "Company logo reference for an organization.", "properties": { "url": { "type": "string", "description": "URL to download the company logo.", "example": "https://storage.example.com/logos/acme.png" } }, "required": [ "url" ], "type": "object", "additionalProperties": false }, "AuditOrganizationInformation": { "description": "Organization information record returned by the auditor organization API.\n\n`id` and `displayName` are always present (primary fields). Other fields\nare optional to support controlled audits where only approved columns are\nreturned.", "properties": { "id": { "type": "string", "description": "Business info document identifier.", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "description": "Display name of the organization.", "example": "Acme Corp" }, "legalName": { "type": "string", "nullable": true, "description": "Legal name of the organization.", "example": "Acme Corporation Inc." }, "incorporation": { "type": "string", "nullable": true, "description": "Incorporation status. Returns \"Incorporated in the United States\"\nwhen the organization is a US company, or null otherwise.", "example": "Incorporated in the United States" }, "url": { "type": "string", "nullable": true, "description": "Organization URL.", "example": "https://acme.example.com" }, "mailingAddress": { "type": "string", "nullable": true, "description": "Mailing address of the organization.", "example": "123 Main St, San Francisco, CA 94105" }, "telephone": { "type": "string", "nullable": true, "description": "Telephone number of the organization.", "example": "+1-555-123-4567" }, "companyLogo": { "allOf": [ { "$ref": "#/components/schemas/AuditOrganizationCompanyLogo" } ], "nullable": true, "description": "Company logo reference (download URL), or null if no logo is uploaded." } }, "required": [ "id", "displayName" ], "type": "object", "additionalProperties": false }, "IssueStatusTypeForSnapshot": { "type": "string", "enum": [ "IN_PROGRESS", "NOT_STARTED", "CLOSED" ] }, "IssueSnapshotItem": { "properties": { "id": { "type": "string", "description": "The unique identifier for the snapshot of an issue.\n\nThis is distinct from the issueId, which identifies the underlying issue across snapshots.\nThe snapshot item ID is unique to this specific snapshot of the issue.", "example": "5f2c939a52855e725c8d5824" }, "title": { "type": "string", "description": "The issue title", "example": "User accounts with weak passwords" }, "description": { "type": "string", "description": "The issue description", "example": "The following user accounts have passwords that do not meet the company's password policy: [list of accounts]. Weak passwords increase the risk of unauthorized access to systems and data." }, "readableIssueId": { "type": "string", "description": "The human-readable identifier for the issue.\n\nThis field is unique per-domain, and can be used to correlate\nthis issue snapshot item to the underlying issue across different snapshots." }, "issueId": { "type": "string", "description": "The globally unique identifier for the underlying issue across snapshots.\n\nThis field can be used to correlate this snapshot item to the underlying issue across different snapshots.", "example": "5f2c939a52855e725c8d5825" }, "snapshotId": { "type": "string", "description": "The identifier for the snapshot this issue item belongs to.", "example": "5f2c939a52855e725c8d5823" }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The due date for the issue.", "example": "2023-12-31T23:59:59.000Z" }, "status": { "$ref": "#/components/schemas/IssueStatusTypeForSnapshot", "description": "The status of the issue.", "example": "CLOSED" }, "lastModifiedAt": { "type": "string", "format": "date-time", "description": "The date and time when the issue was last modified.", "example": "2024-06-15T10:30:00.000Z" }, "createdAt": { "type": "string", "format": "date-time", "description": "The date and time when the issue was created.", "example": "2024-06-01T09:00:00.000Z" }, "detectedAt": { "type": "string", "format": "date-time", "description": "The date and time when the issue was detected.", "example": "2024-05-30T14:45:00.000Z" } }, "required": [ "id", "readableIssueId", "issueId", "snapshotId" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_IssueSnapshotItem_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/IssueSnapshotItem" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "PaginatedIssueSnapshotItemsResponse": { "$ref": "#/components/schemas/PaginatedResponse_IssueSnapshotItem_" }, "IssueSnapshotItemOrderBy": { "type": "string", "enum": [ "createdAt", "lastModifiedAt", "detectedAt" ], "description": "Allowed values for the `orderBy` query parameter on issue snapshot item endpoints." }, "IssueSnapshotMetadata": { "properties": { "id": { "type": "string", "description": "The unique identifier for the issue snapshot.", "example": "5f2c939a52855e725c8d5823" }, "title": { "type": "string", "description": "The title of the snapshot", "example": "Snapshot taken on 2024-06-01T00:00:00Z" }, "description": { "type": "string", "description": "The description of the snapshot", "example": "This snapshot captures all open issues as of June 1st, 2024." }, "createdAt": { "type": "string", "format": "date-time", "description": "The date and time when the snapshot was created.", "example": "2024-06-01T00:00:00.000Z" } }, "required": [ "id" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_IssueSnapshotMetadata_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/IssueSnapshotMetadata" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "PaginatedIssueSnapshotMetadataResponse": { "$ref": "#/components/schemas/PaginatedResponse_IssueSnapshotMetadata_" }, "AuditIntegration": { "description": "Integration row returned by the auditor integrations API.\n\n`id` and `name` are always present. Other fields are optional to support\ncontrolled audits where only approved columns are returned.", "properties": { "id": { "type": "string", "description": "Integration identifier.", "example": "github" }, "name": { "type": "string", "description": "Display name of the integration.", "example": "GitHub" }, "tags": { "items": { "type": "string" }, "type": "array", "description": "Integration tag display names describing what data this integration provides.", "example": [ "Vulnerabilities", "Code changes" ] }, "categories": { "items": { "type": "string" }, "type": "array", "description": "Category display names describing what the integration is used for.", "example": [ "Version control systems" ] } }, "required": [ "id", "name" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AuditIntegration_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AuditIntegration" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AuditIntegrationTag": { "enum": [ "ACCESS", "COMPUTERS", "CUSTOM_RESOURCE", "DATA_LOSS_PREVENTION", "DOCUMENTS", "DOCUMENT_UPLOAD", "FRAMEWORK", "GROUPS", "INVENTORY", "NOTIFICATIONS", "PEOPLE", "POLICIES", "SECURITY_AWARENESS_TRAINING", "SECURITY_SCANNER_ALERTS", "SSO", "TASK_CREATION", "TASK_TRACKING", "TRUST_CENTER", "VENDOR_DISCOVERY", "VENDOR_PROCUREMENT", "VULNERABILITIES" ], "type": "string" }, "AuditIntegrationCategory": { "enum": [ "ATS_MERGE_ACCOUNT", "BACKGROUND_CHECK_SERVICE", "CLOUD_PROVIDER", "COMMUNICATION_PLATFORM", "CRM_MERGE_ACCOUNT", "CRM_PLATFORM", "DATASTORE_PROVIDER", "DATA_LOSS_PREVENTION", "DATA_WAREHOUSE_PROVIDER", "DOCUMENT_MANAGEMENT_TOOL", "ENDPOINT_SECURITY_TOOL", "HR_PROVIDER", "IDENTITY_PROVIDER", "INCIDENT_MANAGEMENT_TOOL", "MOBILE_DEVICE_MANAGEMENT_TOOL", "MONITORING_SERVICE", "OTHER_INTEGRATION", "SECURITY_AWARENESS_TRAINING_PROVIDER", "SECURITY_SCANNER_ALERTS", "TASK_TRACKER", "VERSION_CONTROL_SYSTEM", "VULNERABILITY_SCANNER" ], "type": "string" }, "InformationRequestApprovalStatus": { "type": "string", "enum": [ "NEEDS_EVIDENCE", "READY_FOR_AUDIT", "AUDITOR_APPROVED", "AUDITOR_FLAGGED" ], "description": "Current approval status of the information request, tracking its lifecycle through the audit process.\n\nThe status progresses through the workflow: initial state → awaiting review → approved or flagged.\nStatus can move between awaiting review and flagged states as evidence is reviewed and resubmitted." }, "InformationRequestCadence": { "type": "string", "enum": [ "ANNUALLY", "BIANNUALLY", "MONTHLY", "QUARTERLY" ], "description": "Frequency cadence for the information request, indicating how often it recurs." }, "InformationRequestType": { "type": "string", "enum": [ "POINT_IN_TIME", "POPULATION", "SAMPLE" ], "description": "Type of information request, defining what scope of evidence is needed.\n\n- POINT_IN_TIME: Evidence for a specific moment (e.g., current state of a policy)\n- POPULATION: Evidence covering all items in a category (e.g., all employees)\n- SAMPLE: Evidence for a representative sample (e.g., 10 random customer records)" }, "ResourceOwner": { "anyOf": [ { "properties": { "displayName": { "type": "string" }, "id": { "type": "string" }, "type": { "type": "string", "enum": [ "user" ], "nullable": false } }, "required": [ "displayName", "id", "type" ], "type": "object" }, { "properties": { "displayName": { "type": "string" }, "id": { "type": "string" }, "type": { "type": "string", "enum": [ "team" ], "nullable": false } }, "required": [ "displayName", "id", "type" ], "type": "object" } ], "description": "Represents either a user or a team owning a resource." }, "InformationRequest": { "description": "Information Request resource representing a single request for audit evidence from a customer.\n\nAn information request is created by an auditor and shared with the customer organization.\nThe customer then uploads evidence, which the auditor reviews and either approves or flags\nfor issues.", "properties": { "id": { "type": "string", "description": "The unique identifier for the information request within Vanta's system.\nThis is the primary identifier used in all API endpoints.\nFormat: ObjectId as a string (e.g., \"6890e473dce1da5d8406f5e7\")" }, "uniqueId": { "type": "string", "description": "External unique ID to prevent duplicates across different audit systems.\nUsed for idempotency when syncing data between external audit management\nsystems and Vanta. Unlike `id`, this value is provided by the external system." }, "additionalControlIds": { "items": { "type": "string" }, "type": "array", "description": "Additional control IDs beyond those automatically mapped from framework codes.\nAllows manual association with specific controls when automatic mapping\nis insufficient. Each ID should reference a valid control in your audit framework." }, "approvalStatus": { "$ref": "#/components/schemas/InformationRequestApprovalStatus", "description": "Current approval status tracking the request's lifecycle through evidence\nsubmission and auditor review." }, "cadence": { "allOf": [ { "$ref": "#/components/schemas/InformationRequestCadence" } ], "nullable": true, "description": "How frequently this information request recurs (e.g., annual password\npolicy reviews). Null for one-time requests." }, "frameworkCodes": { "items": { "type": "string" }, "type": "array", "description": "The framework codes this request addresses.\nLinks the request to specific compliance requirements. Can be an empty array\nif no framework codes are associated. These codes correspond to standards like SOC 2, ISO 27001, etc." }, "description": { "type": "string", "nullable": true, "description": "Detailed description explaining what evidence is needed and why.\nShould provide clear instructions to help the customer understand what\nto submit." }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The deadline by which the customer must fulfill this request.\nNull if no specific deadline is set. Format: ISO 8601 UTC timestamp." }, "evidenceCaptureDate": { "type": "string", "format": "date-time", "nullable": true, "description": "The earliest date for which evidence should be captured.\nEvidence dated before this date may not be accepted.\nNull if not restricted. Format: ISO 8601 UTC timestamp." }, "requestId": { "type": "string", "nullable": true, "description": "Non-unique external reference ID for this request.\nUnlike `uniqueId` which must be unique, `requestId` is for display/reference\npurposes only (e.g., \"REQ-123\"). Null if not provided." }, "requestType": { "$ref": "#/components/schemas/InformationRequestType", "description": "Defines the scope of evidence required." }, "title": { "type": "string", "description": "Short, descriptive title summarizing what is being requested." }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the request was created in the system.\nFormat: ISO 8601 UTC timestamp." }, "modificationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the request was last modified.\nFormat: ISO 8601 UTC timestamp." }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the request was soft-deleted. Null if the request has not\nbeen deleted. Soft deletes allow retaining history while hiding the request\nfrom normal operations.\nFormat: ISO 8601 UTC timestamp." }, "ownerAssignment": { "allOf": [ { "$ref": "#/components/schemas/ResourceOwner" } ], "nullable": true, "description": "Resource owner (user or team) assigned to this information request.\nReturns null if no resource owner is assigned." } }, "required": [ "id", "uniqueId", "additionalControlIds", "approvalStatus", "cadence", "frameworkCodes", "description", "dueDate", "evidenceCaptureDate", "requestId", "requestType", "title", "creationDate", "modificationDate", "deletionDate", "ownerAssignment" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_InformationRequest_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/InformationRequest" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "CreateInformationRequestInput": { "description": "Input for creating a new information request.\nNew requests are created in an initial state by default.", "properties": { "uniqueId": { "type": "string", "description": "External unique ID to prevent duplicate requests across audit systems.\nMust be unique within the audit. Used for idempotency." }, "title": { "type": "string", "description": "Short, descriptive title summarizing what is being requested.\nMust be at least 1 character." }, "requestType": { "$ref": "#/components/schemas/InformationRequestType", "description": "Scope of evidence required." }, "description": { "type": "string", "nullable": true, "description": "Detailed description explaining what evidence is needed.\nHelps the customer understand what to submit. Optional." }, "frameworkCodes": { "items": { "type": "string" }, "type": "array", "description": "Framework codes this request addresses.\nAn empty array if no framework codes are associated." }, "cadence": { "allOf": [ { "$ref": "#/components/schemas/InformationRequestCadence" } ], "nullable": true, "description": "How frequently this request recurs. Null or omitted for one-time requests." }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Deadline for fulfilling this request. Null or omitted if no deadline.\nFormat: ISO 8601 UTC timestamp." }, "evidenceCaptureDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Start date of the audit period. Evidence before this date may not be accepted.\nNull or omitted if not restricted.\nFormat: ISO 8601 UTC timestamp." }, "additionalControlIds": { "items": { "type": "string" }, "type": "array", "description": "Control IDs to link directly to this request, beyond those automatically\nmapped from framework codes. Each must be the `id` of an existing control in\nthe customer's organization (the identifier returned by the controls endpoints).\nThe request is rejected if any ID does not match a control.\nOmit or pass an empty array for no direct control links." } }, "required": [ "uniqueId", "title", "requestType", "frameworkCodes" ], "type": "object", "additionalProperties": false }, "PartialUpdateInformationRequest": { "description": "Input for partially updating an information request. Only provided fields\nwill be updated; omitted fields remain unchanged. At least one field must\nbe provided.", "properties": { "frameworkCodes": { "items": { "type": "string" }, "type": "array", "description": "The framework codes this request addresses.\nAn empty array if no framework codes are associated." }, "description": { "type": "string", "nullable": true, "description": "Detailed description of what evidence is needed." }, "dueDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Deadline for fulfilling this request. Null if no deadline.\nFormat: ISO 8601 UTC timestamp." }, "evidenceCaptureDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Start date of the audit period. Evidence before this date may not be accepted.\nNull if not restricted. Format: ISO 8601 UTC timestamp." }, "requestType": { "$ref": "#/components/schemas/InformationRequestType", "description": "Scope of evidence required." }, "title": { "type": "string", "description": "Short, descriptive title." }, "cadence": { "$ref": "#/components/schemas/InformationRequestCadence", "description": "How frequently this request recurs." }, "additionalControlIds": { "items": { "type": "string" }, "type": "array", "description": "Control IDs to link directly to this request, beyond those automatically\nmapped from framework codes. Replaces the existing set: pass the complete\ndesired list, an empty array to clear all direct control links, or omit to\nleave them unchanged. Each must be the `id` of an existing control in the\ncustomer's organization (the identifier returned by the controls endpoints).\nThe request is rejected if any ID does not match a control." } }, "type": "object", "additionalProperties": false }, "FlagInformationRequestEvidenceInput": { "description": "Input for flagging evidence on an information request, indicating issues\nthat need to be addressed. This changes the request's approvalStatus to\na flagged state and creates an activity log entry.\n\nThe customer will be notified and can resubmit evidence after addressing the issues.", "properties": { "auditorEmail": { "type": "string", "description": "Email of the auditor flagging the evidence.\nMust match an existing Vanta user who belongs to the audit firm making the API request." }, "reason": { "type": "string", "description": "Detailed explanation of what issues were found with the evidence.\nThis reason is visible to the customer and guides them on what to fix.\nMust be at least 1 character." } }, "required": [ "auditorEmail", "reason" ], "type": "object", "additionalProperties": false }, "AcceptInformationRequestEvidenceInput": { "description": "Input for accepting evidence on an information request, indicating that\nthe submitted evidence meets requirements. This changes the request's\napprovalStatus to an approved state and creates an activity log entry.", "properties": { "auditorEmail": { "type": "string", "description": "Email of the auditor accepting the evidence.\nMust match an existing Vanta user who belongs to the audit firm making the API request." } }, "required": [ "auditorEmail" ], "type": "object", "additionalProperties": false }, "FrameworkCodes": { "description": "Framework codes response resource", "properties": { "frameworkCodes": { "items": { "type": "string" }, "type": "array", "description": "Array of valid framework codes for the audit's framework (e.g., \"CC6.1\", \"CC6.2\").\nThese represent the different framework sections available for creating information requests." } }, "required": [ "frameworkCodes" ], "type": "object", "additionalProperties": false }, "InformationRequestSupportedEvidenceType": { "type": "string", "enum": [ "UPLOADED_DOCUMENT", "OBSERVATION", "LINK", "VANTA_DOCUMENT", "VANTA_POLICY", "VANTA_TEST", "VANTA_TEST_SNAPSHOT" ] }, "UploadedDocumentEvidence": { "description": "Evidence in the form of an uploaded document file.\nThe URL is a temporary presigned URL that expires after a certain period.", "properties": { "id": { "type": "string", "description": "The unique identifier for the uploaded document in Vanta's system." }, "filename": { "type": "string", "description": "The original filename of the uploaded document.\nUndefined if the filename was not captured during upload." }, "mimeType": { "type": "string", "description": "The MIME type of the document indicating its file format.\nCommon types: \"application/pdf\", \"image/png\", \"image/jpeg\", \"text/plain\"" }, "url": { "type": "string", "description": "A presigned URL for downloading the document.\nThis URL is temporary and expires after a limited time.\nRequest a new evidence list to get a fresh URL if expired." } }, "required": [ "id", "mimeType", "url" ], "type": "object", "additionalProperties": false }, "LinkEvidence": { "description": "Evidence in the form of a link to external documentation or resources.", "properties": { "title": { "type": "string", "description": "The title or descriptive name for the link." }, "description": { "type": "string", "description": "Optional description providing additional context about the link." }, "url": { "type": "string", "description": "The URL pointing to the external documentation or resource." } }, "required": [ "title", "url" ], "type": "object", "additionalProperties": false }, "ObservationEvidence": { "description": "Evidence in the form of a text observation or note.", "properties": { "observationDetails": { "type": "string", "description": "The text content of the observation." } }, "required": [ "observationDetails" ], "type": "object", "additionalProperties": false }, "VantaDocumentUploadedEvidence": { "description": "Represents an uploaded file in a Vanta Document.\nThe file is stored in Vanta's system and accessed via a presigned URL.", "properties": { "type": { "type": "string", "enum": [ "uploaded" ], "nullable": false, "description": "Discriminator to identify this as an uploaded file." }, "id": { "type": "string", "description": "The unique identifier for the file version in Vanta's system." }, "filename": { "type": "string", "description": "The original filename of the uploaded document.\nUndefined if the filename was not captured during upload." }, "mimeType": { "type": "string", "description": "The MIME type of the document indicating its file format.\nCommon types: \"application/pdf\", \"image/png\", \"image/jpeg\", \"text/plain\"" }, "url": { "type": "string", "description": "A presigned URL for downloading the document.\nThis URL is temporary and expires after a limited time.\nRequest a new evidence list to get a fresh URL if expired." } }, "required": [ "type", "id", "mimeType", "url" ], "type": "object", "additionalProperties": false }, "VantaDocumentLinkEvidence": { "description": "Represents an external link in a Vanta Document.\nThe link points to documentation hosted outside of Vanta's system.", "properties": { "type": { "type": "string", "enum": [ "link" ], "nullable": false, "description": "Discriminator to identify this as an external link." }, "id": { "type": "string", "description": "The unique identifier for the file version in Vanta's system." }, "url": { "type": "string", "description": "The URL pointing to the external documentation or resource." } }, "required": [ "type", "id", "url" ], "type": "object", "additionalProperties": false }, "VantaDocumentEvidence": { "description": "Evidence in the form of a Vanta Document.\nVanta Documents are managed documents with metadata like expiration dates\nand versioning. They can either be uploaded files stored in Vanta or\nlinks to external documentation.", "properties": { "title": { "type": "string", "description": "The title of the document as displayed in Vanta." }, "description": { "type": "string", "description": "Optional description providing additional context about the document." }, "expirationDate": { "type": "string", "format": "date-time", "description": "The date when the document version expires and should be renewed.\nUndefined if no expiration is set.\nFormat: ISO 8601 UTC timestamp." }, "addedBy": { "properties": { "email": { "type": "string" }, "name": { "type": "string" } }, "required": [ "email", "name" ], "type": "object", "description": "Information about the user who added this file version to the document.\nUndefined if the user information is not available." }, "documentVersionId": { "type": "string", "description": "The unique identifier of the document version submitted as evidence." }, "file": { "anyOf": [ { "$ref": "#/components/schemas/VantaDocumentUploadedEvidence" }, { "$ref": "#/components/schemas/VantaDocumentLinkEvidence" } ], "description": "The file or link associated with this document version.\nUse the `type` discriminator to determine whether it's an uploaded file\nor an external link." } }, "required": [ "title", "documentVersionId", "file" ], "type": "object", "additionalProperties": false }, "VantaPolicyEvidence": { "description": "Evidence in the form of a Vanta Policy.\nVanta Policies are compliance policies with metadata like locale,\neffective dates, and versioning. Policies are always uploaded files\nstored in Vanta's system.", "properties": { "title": { "type": "string", "description": "The title of the policy as displayed in Vanta." }, "description": { "type": "string", "description": "Optional description providing additional context about the policy." }, "expirationDate": { "type": "string", "format": "date-time", "description": "The date when the policy version expires and should be renewed.\nUndefined if no expiration is set.\nFormat: ISO 8601 UTC timestamp." }, "lastEditedBy": { "properties": { "email": { "type": "string" }, "name": { "type": "string" } }, "required": [ "email", "name" ], "type": "object", "description": "Information about the user who last edited this policy version.\nUndefined if the user information is not available." }, "policyId": { "type": "string", "description": "The policy type this evidence belongs to (e.g. \"information-security-policy-bsi\").\nPolicies prefixed with \"custom-\" are customer-defined; others are Vanta-provided templates." }, "policyVersionId": { "type": "string", "description": "The identifier of the approved policy version that was submitted as evidence.\nA new version is created each time a policy is updated and approved." }, "policyVersionFileId": { "type": "string", "description": "The identifier of the locale-specific file within the policy version.\nEach policy version may contain multiple files, one per supported language." }, "file": { "properties": { "effectiveOrCreationDate": { "type": "string", "format": "date-time", "description": "The date when this policy version became effective, or when it was created.\nFormat: ISO 8601 UTC timestamp." }, "locale": { "type": "string", "description": "The locale/language of the policy document.\nExamples: \"EN\" for English, \"ES\" for Spanish, \"FR\" for French" }, "url": { "type": "string", "description": "A presigned URL for downloading the policy document.\nThis URL is temporary and expires after a limited time.\nRequest a new evidence list to get a fresh URL if expired." }, "mimeType": { "type": "string", "description": "The MIME type of the policy document indicating its file format.\nCommon types: \"application/pdf\", \"application/msword\"" }, "filename": { "type": "string", "description": "The original filename of the uploaded policy document.\nUndefined if the filename was not captured during upload." }, "id": { "type": "string", "description": "The unique identifier for the uploaded policy file in Vanta's system." } }, "required": [ "effectiveOrCreationDate", "locale", "url", "mimeType", "id" ], "type": "object", "description": "The uploaded policy file for this version." } }, "required": [ "title", "policyId", "policyVersionId", "policyVersionFileId", "file" ], "type": "object", "additionalProperties": false }, "VantaTestRunStatus": { "type": "string", "enum": [ "NA", "IN_PROGRESS", "FAIL", "PASS", "INVALID", "DISABLED" ] }, "VantaTestFileType": { "type": "string", "enum": [ "TEST_EVIDENCE_WORKPAPER", "TEST_RAW_DATA", "OUT_OF_SCOPE_RESOURCES", "API_REQUESTS" ] }, "VantaTestEvidence": { "description": "Evidence in the form of a Vanta automated test run.\nVanta Tests are automated compliance tests with metadata like test status,\nexecution time, and file type. Tests generate evidence files that can be\nworkpapers, raw data, or API request logs.", "properties": { "title": { "type": "string", "description": "The title of the test run as displayed in Vanta." }, "testId": { "type": "string", "description": "The unique identifier for the test in Vanta's system." }, "snapshotId": { "type": "string", "description": "The unique identifier for the point-in-time capture of this test run's evidence.\nA snapshot is an immutable record of all files (workpapers, raw data, etc.)\ngenerated during a single test execution." }, "testRunStatus": { "$ref": "#/components/schemas/VantaTestRunStatus", "description": "The outcome status of the test run." }, "executedAt": { "type": "string", "format": "date-time", "description": "The date and time when the test was executed.\nFormat: ISO 8601 UTC timestamp." }, "fileType": { "$ref": "#/components/schemas/VantaTestFileType", "description": "The type of evidence file included in this evidence." }, "file": { "properties": { "mimeType": { "type": "string", "description": "The MIME type of the evidence file.\nCommon types: \"application/pdf\" for workpapers, \"text/csv\" for raw data" }, "url": { "type": "string", "description": "A presigned URL for downloading the evidence file.\nThis URL is temporary and expires after a limited time.\nRequest a new evidence list to get a fresh URL if expired." } }, "required": [ "mimeType", "url" ], "type": "object", "description": "The evidence file for this test run." } }, "required": [ "title", "testId", "snapshotId", "testRunStatus", "executedAt", "fileType", "file" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotEvidence": { "description": "Evidence in the form of a Vanta automated test run snapshot.\n\nUnlike VantaTestEvidence (which represents a single file within a test run's\nevidence packet), a snapshot represents the entire test-run bundle. Use the\ndedicated snapshot detail endpoint to retrieve the files associated with a\nsnapshot.", "properties": { "snapshotId": { "type": "string", "description": "The unique identifier for the point-in-time capture of this test run's evidence.\nA snapshot is an immutable record of all files (workpapers, raw data, etc.)\ngenerated during a single test execution." }, "testId": { "type": "string", "description": "The unique identifier for the test in Vanta's system." }, "testRunId": { "type": "string", "description": "The unique identifier for the test run this snapshot was captured from." }, "testRunTitle": { "type": "string", "description": "The title of the test run as displayed in Vanta." }, "testRunStatus": { "type": "string", "enum": [ "NA", "IN_PROGRESS", "FAIL", "PASS", "INVALID", "DISABLED" ], "description": "The outcome status of the test run." }, "testRunExecutedAt": { "type": "string", "format": "date-time", "description": "The date and time when the test was executed.\nFormat: ISO 8601 UTC timestamp." } }, "required": [ "snapshotId", "testId", "testRunId", "testRunTitle", "testRunStatus", "testRunExecutedAt" ], "type": "object", "additionalProperties": false }, "InformationRequestEvidenceUnion": { "anyOf": [ { "$ref": "#/components/schemas/UploadedDocumentEvidence" }, { "$ref": "#/components/schemas/LinkEvidence" }, { "$ref": "#/components/schemas/ObservationEvidence" }, { "$ref": "#/components/schemas/VantaDocumentEvidence" }, { "$ref": "#/components/schemas/VantaPolicyEvidence" }, { "$ref": "#/components/schemas/VantaTestEvidence" }, { "$ref": "#/components/schemas/VantaTestSnapshotEvidence" } ], "description": "Union type representing the different forms of evidence content.\nThe specific type is determined by the `evidenceType` field in InformationRequestEvidence." }, "InformationRequestEvidence": { "properties": { "id": { "type": "string", "description": "The unique identifier for the evidence within Vanta's system.\nFormat: ObjectId as a string (e.g., \"6890e473dce1da5d8406f5e7\")." }, "evidenceType": { "$ref": "#/components/schemas/InformationRequestSupportedEvidenceType", "description": "Type of evidence attached to this information request.\nDetermines the structure of the `evidence` field." }, "visibleToAuditorDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the evidence was made visible to the auditor.\nNull if the customer has not yet shared this evidence with the auditor.\nEvidence must be shared before the auditor can review it.\nFormat: ISO 8601 UTC timestamp." }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the evidence was created/uploaded.\nFormat: ISO 8601 UTC timestamp." }, "modificationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the evidence was last modified.\nFormat: ISO 8601 UTC timestamp." }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the evidence was soft-deleted.\nNull if the evidence has not been deleted.\nSoft deletes retain evidence in the system for audit history while hiding\nit from normal operations.\nFormat: ISO 8601 UTC timestamp." }, "evidence": { "$ref": "#/components/schemas/InformationRequestEvidenceUnion", "description": "The evidence content. Structure varies based on evidenceType." } }, "required": [ "id", "evidenceType", "creationDate", "modificationDate", "evidence" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_InformationRequestEvidence_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/InformationRequestEvidence" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotIntegration": { "description": "Integration metadata for a test, mirroring the Vanta web app.", "properties": { "integrationId": { "type": "string" }, "displayName": { "type": "string" } }, "required": [ "integrationId", "displayName" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotSlaRemediationSettings": { "properties": { "numericValue": { "type": "number", "format": "double" }, "unit": { "type": "string", "nullable": true } }, "required": [ "numericValue", "unit" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotSlaRemediation": { "properties": { "id": { "type": "string" }, "settings": { "allOf": [ { "$ref": "#/components/schemas/VantaTestSnapshotSlaRemediationSettings" } ], "nullable": true } }, "required": [ "id", "settings" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotRawTestDataRow": { "description": "One row of raw test data attached to a snapshot.\n\nFor structured snapshots, every row carries the resource refs and the raw\nJSON for that resource. For unstructured snapshots, a single row is returned\nwith `resourceId` and `resourceType` set to `null` and `rawJson` containing\nthe entire test-run JSON blob.", "properties": { "resourceId": { "type": "string", "nullable": true, "description": "Identifier of the underlying resource the row was captured from. Null for\nunstructured snapshots, which do not partition by resource." }, "resourceType": { "type": "string", "nullable": true, "description": "Specific resource kind for the row (e.g. `AwsIamUser`). Null for\nunstructured snapshots." }, "rawJson": { "description": "Raw JSON payload as emitted by the test runner. Shape varies by\n`resourceType` for structured snapshots and matches the full test-run\nblob for unstructured snapshots." } }, "required": [ "resourceId", "resourceType", "rawJson" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotExcludedItem": { "properties": { "id": { "type": "string" }, "displayName": { "type": "string", "nullable": true } }, "required": [ "id", "displayName" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotExcludedItemGroup": { "properties": { "reason": { "type": "string" }, "entities": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotExcludedItem" }, "type": "array" } }, "required": [ "reason", "entities" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotFrameworkExclusion": { "properties": { "frameworkId": { "type": "string" }, "frameworkName": { "type": "string" }, "groupedByReason": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotExcludedItemGroup" }, "type": "array" } }, "required": [ "frameworkId", "frameworkName", "groupedByReason" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotOutOfScopeResources": { "description": "Resources excluded from the test at snapshot time, grouped by exclusion\nreason. `testLevel` contains resources the customer disabled for the\ntest; `frameworkLevel` contains resources scoped out by the framework's\nsegment configuration.", "properties": { "testLevel": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotExcludedItemGroup" }, "type": "array" }, "frameworkLevel": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotFrameworkExclusion" }, "type": "array" } }, "required": [ "testLevel", "frameworkLevel" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotApiRequest": { "description": "A single API request captured during an API introspection test run.", "properties": { "id": { "type": "string" }, "resourceType": { "type": "string" }, "resourceTypeDisplayName": { "type": "string" }, "requestMethod": { "type": "string" }, "url": { "type": "string" }, "responseCode": { "type": "number", "format": "double" }, "timestamp": { "type": "string", "format": "date-time" }, "dataTooLarge": { "type": "boolean" } }, "required": [ "id", "resourceType", "resourceTypeDisplayName", "requestMethod", "url", "responseCode", "timestamp", "dataTooLarge" ], "type": "object", "additionalProperties": false }, "VantaTestSnapshotEvidenceDetail": { "description": "Detail response for a captured automated-test snapshot evidence row.\n\nCombines the test-level metadata (description, integrations, SLA\nremediation) with a uniform raw-data array so external clients see the\nsame shape regardless of whether the snapshot was structured or\nunstructured.", "properties": { "testId": { "type": "string", "description": "The unique identifier for the test in Vanta's system." }, "testName": { "type": "string", "description": "The display name of the test." }, "description": { "type": "string", "description": "A short description of what the test checks." }, "evaluationCriteria": { "type": "string", "nullable": true, "description": "Longer-form, formatted description of the test. Null when unset." }, "integrations": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotIntegration" }, "type": "array", "description": "Integrations whose data feeds the test." }, "slaRemediation": { "allOf": [ { "$ref": "#/components/schemas/VantaTestSnapshotSlaRemediation" } ], "nullable": true, "description": "SLA remediation policy attached to the test, or null when no SLA is set." }, "rawTestData": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotRawTestDataRow" }, "type": "array", "description": "Raw test data captured at snapshot time." }, "outOfScopeResources": { "$ref": "#/components/schemas/VantaTestSnapshotOutOfScopeResources", "description": "Resources excluded from the test at snapshot time. Absent when the\nsnapshot data could not be loaded; clients should treat a missing\nfield as \"unknown\" rather than \"nothing excluded\"." }, "apiRequests": { "items": { "$ref": "#/components/schemas/VantaTestSnapshotApiRequest" }, "type": "array", "description": "API requests captured during the test run. Absent when the snapshot\ndata could not be loaded. Empty array when the test does not perform\nAPI introspection." } }, "required": [ "testId", "testName", "description", "evaluationCriteria", "integrations", "slaRemediation", "rawTestData" ], "type": "object", "additionalProperties": false }, "InformationRequestComment": { "description": "A comment on an information request enables communication between auditors\nand customers regarding evidence requirements and submissions.\n\nThese threaded discussions help clarify requests, explain or resolve questions about evidence,\nand are always visible to both parties once created.", "properties": { "id": { "type": "string", "description": "The unique identifier for the comment within Vanta's system.\nFormat: ObjectId as a string (e.g., \"6890e473dce1da5d8406f5e7\")." }, "text": { "type": "string", "description": "The comment message content.\nCan include explanations, questions, or clarifications about the information request." }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the comment was created.\nFormat: ISO 8601 UTC timestamp." }, "modificationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the comment was last edited.\nNull if the comment has never been modified.\nFormat: ISO 8601 UTC timestamp." }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the comment was soft-deleted.\nNull if the comment has not been deleted.\nSoft deletes retain the comment for audit history while hiding it from normal operations.\nFormat: ISO 8601 UTC timestamp." }, "email": { "type": "string", "nullable": true, "description": "Email address of the comment author.\nThis email uniquely identifies users between Vanta and external audit systems.\nNull when the comment author can't be matched to a Vanta user." }, "authorName": { "type": "string", "nullable": true, "description": "Human-readable display name of the comment author.\nNull if the author's name is not available (e.g., user was deleted).\nThis enables correct author attribution in integrations where users cannot\nbe reliably matched across systems by email alone." } }, "required": [ "id", "text", "creationDate", "modificationDate", "deletionDate", "email", "authorName" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_InformationRequestComment_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/InformationRequestComment" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AddInformationRequestCommentInput": { "description": "Comments enable communication between auditors and customers about\nevidence requirements and submissions. All comments are immediately\nvisible to both parties once created.", "properties": { "text": { "type": "string", "description": "The text content of the comment.\nMust be at least 1 character. Can include questions, clarifications,\nor explanations related to the information request." }, "email": { "type": "string", "description": "Email address of the comment author.\nMust match an existing Vanta user who belongs to the audit firm making the API request.\nThis email uniquely identifies the author across systems." }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the comment was created in the external audit management system.\nThis allows synchronizing comment timestamps from external systems.\nFormat: ISO 8601 UTC timestamp." } }, "required": [ "text", "email", "creationDate" ], "type": "object", "additionalProperties": false }, "UpdateInformationRequestCommentInput": { "description": "Updates an existing comment on an information request.\nOnly the original author of the comment can update it.", "properties": { "text": { "type": "string", "description": "The text content of the comment.\nMust be at least 1 character. Can include questions, clarifications,\nor explanations related to the information request." }, "email": { "type": "string", "description": "Email address of the comment author.\nMust match an existing Vanta user who belongs to the audit firm making the API request.\nThis email uniquely identifies the author across systems." } }, "required": [ "text", "email" ], "type": "object", "additionalProperties": false }, "DeleteInformationRequestCommentInput": { "description": "Deletes an existing comment on an information request.\nOnly the original author of the comment can delete it.", "properties": { "email": { "type": "string", "description": "Email address of the comment author.\nMust match an existing Vanta user who belongs to the audit firm making the API request.\nThis email uniquely identifies the author across systems." } }, "required": [ "email" ], "type": "object", "additionalProperties": false }, "InformationRequestActivityType": { "enum": [ "AUDIT_DUPLICATION_AUDIT_TRAIL", "AUDIT_INFORMATION_REQUEST_EVIDENCE_FILL", "CHANGE_STATUS", "EDIT_REQUEST", "REMOVE_EVIDENCE", "SHARE_EVIDENCE_WITH_AUDITOR", "UPLOAD_EVIDENCE" ], "type": "string" }, "EvidenceFillOutcome": { "enum": [ "SUCCESS", "PARTIAL", "FAILED" ], "type": "string" }, "InformationRequestActivityLog": { "description": "Activity log entry tracking changes and actions on an information request.\n\nThe activity log provides a complete audit trail of all operations performed\non an information request, including status changes, evidence uploads, edits,\nand evidence sharing. This enables tracking compliance activities and understanding\nthe request's history.", "properties": { "id": { "type": "string", "description": "The unique identifier for the activity log entry within Vanta's system.\nFormat: ObjectId as a string (e.g., \"6890e473dce1da5d8406f5e7\")." }, "activityType": { "$ref": "#/components/schemas/InformationRequestActivityType", "description": "Type of activity that occurred on the information request.\nDetermines which additional fields are populated." }, "timestamp": { "type": "string", "format": "date-time", "description": "Timestamp when the activity occurred.\nFormat: ISO 8601 UTC timestamp." }, "userEmail": { "type": "string", "nullable": true, "description": "Email address of the user who performed the activity.\nNull for system-generated activities (rare, such as automated status changes).\nThis email uniquely identifies users across systems." }, "oldStatus": { "type": "string", "enum": [ "READY_FOR_AUDIT", "NEEDS_EVIDENCE", "AUDITOR_APPROVED", "AUDITOR_FLAGGED", "READY_FOR_INTERNAL_REVIEW", null ], "nullable": true, "description": "Previous approval status before the status change.\nOnly populated for status change activities. Null for all other activity types." }, "newStatus": { "type": "string", "enum": [ "READY_FOR_AUDIT", "NEEDS_EVIDENCE", "AUDITOR_APPROVED", "AUDITOR_FLAGGED", "READY_FOR_INTERNAL_REVIEW", null ], "nullable": true, "description": "New approval status after the status change.\nOnly populated for status change activities. Null for all other activity types." }, "reason": { "type": "string", "nullable": true, "description": "Optional explanation for the status change.\nOnly populated for status change activities when a reason is provided\n(e.g., when flagging evidence). Null for all other cases." }, "fillOutcome": { "allOf": [ { "$ref": "#/components/schemas/EvidenceFillOutcome" } ], "nullable": true, "description": "Result of an automated evidence fill.\nOnly populated for evidence fill activities. Null for all other activity types." }, "sourceInformationRequestId": { "type": "string", "nullable": true, "description": "Identifier of the information request this one was copied from when its\naudit was duplicated.\nOnly populated for audit-duplication trail activities. Null for all other activity types.\nFormat: ObjectId as a string." }, "sourceAuditId": { "type": "string", "nullable": true, "description": "Identifier of the audit this request's audit was duplicated from.\nOnly populated for audit-duplication trail activities. Null for all other activity types.\nFormat: ObjectId as a string." } }, "required": [ "id", "activityType", "timestamp", "userEmail", "oldStatus", "newStatus", "reason", "fillOutcome", "sourceInformationRequestId", "sourceAuditId" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_InformationRequestActivityLog_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/InformationRequestActivityLog" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "DuplicateAuditRequest": { "description": "Request body for duplicating an IRL audit into a new audit engagement.", "properties": { "sourceAuditId": { "type": "string", "description": "ID of the source IRL audit to duplicate." }, "displayName": { "type": "string", "description": "Display name for the new audit engagement." }, "auditStartDate": { "type": "string", "format": "date-time", "description": "Start of the audit window for the new audit." }, "auditEndDate": { "type": "string", "format": "date-time", "description": "End of the audit window for the new audit." }, "earlyAccessStartsAt": { "type": "string", "format": "date-time", "description": "When auditors gain access to the new audit." }, "allowAuditorEmails": { "items": { "type": "string" }, "type": "array", "description": "Emails of auditors who may access the new audit. Minimum one entry required.\nEach email must match an active user in the authenticated audit firm's domain." } }, "required": [ "sourceAuditId", "displayName", "auditStartDate", "auditEndDate", "earlyAccessStartsAt", "allowAuditorEmails" ], "type": "object", "additionalProperties": false }, "AuditControlComment": { "description": "A comment on a control within an audit. These threaded discussions let\nauditors and customers collaborate on a specific control — asking questions,\ndocumenting reasoning, or recording follow-ups — directly against the control\nbeing assessed.\n\nAudit control comments are scoped to a single audit engagement and are\ndistinct from any organization-internal control comments.", "properties": { "id": { "type": "string", "description": "The unique identifier for the comment within Vanta's system.\nFormat: ObjectId as a string (e.g., \"6890e473dce1da5d8406f5e7\")." }, "text": { "type": "string", "description": "The comment message content.\nCan include explanations, questions, or clarifications about the control." }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the comment was created.\nFormat: ISO 8601 UTC timestamp." }, "modificationDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the comment was last edited.\nNull if the comment has never been modified.\nFormat: ISO 8601 UTC timestamp." }, "deletionDate": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp when the comment was soft-deleted.\nNull if the comment has not been deleted.\nSoft deletes retain the comment for audit history while hiding it from normal operations.\nFormat: ISO 8601 UTC timestamp." }, "email": { "type": "string", "nullable": true, "description": "Email address of the comment author.\nThis email uniquely identifies users between Vanta and external audit systems.\nNull when the comment author can't be matched to a Vanta user." }, "authorName": { "type": "string", "nullable": true, "description": "Human-readable display name of the comment author.\nNull if the author's name is not available (e.g., user was deleted).\nThis enables correct author attribution in integrations where users cannot\nbe reliably matched across systems by email alone." } }, "required": [ "id", "text", "creationDate", "modificationDate", "deletionDate", "email", "authorName" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_AuditControlComment_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/AuditControlComment" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "AddAuditControlCommentInput": { "description": "Comments enable auditors and customers to collaborate on a control within an\naudit. All comments are immediately visible to authorized parties once created.", "properties": { "text": { "type": "string", "description": "The text content of the comment.\nMust be at least 1 character. Can include questions, clarifications,\nor explanations related to the control." }, "email": { "type": "string", "description": "Email address of the comment author.\nMust match an existing Vanta user who belongs to the audit firm making the API request.\nThis email uniquely identifies the author across systems." }, "creationDate": { "type": "string", "format": "date-time", "description": "Timestamp when the comment was created in the external audit management system.\nThis allows synchronizing comment timestamps from external systems.\nFormat: ISO 8601 UTC timestamp." } }, "required": [ "text", "email", "creationDate" ], "type": "object", "additionalProperties": false }, "UpdateAuditControlCommentInput": { "description": "Updates an existing comment on a control.\nOnly the original author of the comment can update it.", "properties": { "text": { "type": "string", "description": "The text content of the comment.\nMust be at least 1 character. Can include questions, clarifications,\nor explanations related to the control." }, "email": { "type": "string", "description": "Email address of the comment author.\nMust match an existing Vanta user who belongs to the audit firm making the API request.\nThis email uniquely identifies the author across systems." } }, "required": [ "text", "email" ], "type": "object", "additionalProperties": false }, "DeleteAuditControlCommentInput": { "description": "Deletes an existing comment on a control.\nOnly the original author of the comment can delete it.", "properties": { "email": { "type": "string", "description": "Email address of the comment author.\nMust match an existing Vanta user who belongs to the audit firm making the API request.\nThis email uniquely identifies the author across systems." } }, "required": [ "email" ], "type": "object", "additionalProperties": false }, "CodeChange": { "description": "Code change data.\n\n`id` and `codeChange` are required. All other fields are optional to support customizable field visibility.\n\nOmitted keys mean the column is not in the response; `null` means the column is present but empty.", "properties": { "id": { "type": "string", "description": "Code change record ID - always present.", "example": "5f2c939a52855e725c8d5824" }, "codeChange": { "type": "string", "description": "Code change title (e.g. PR title) - always present.", "example": "fix-auth-bug" }, "identifier": { "type": "string", "description": "Code change identifier (e.g. PR number).", "example": "101" }, "service": { "type": "string", "description": "Version control source where the change originated.\nKnown values are listed in {@link ApiCodeChangeSource}; other strings may\nappear if a new source is onboarded before this enum is updated.", "example": "github" }, "repository": { "type": "string", "description": "Repository name.", "example": "vanta/obsidian" }, "openedAt": { "type": "string", "format": "date-time", "description": "Date the code change was opened.", "example": "2025-01-25T14:30:00.000Z" }, "closedAt": { "type": "string", "format": "date-time", "description": "Date the code change was merged/closed.", "example": "2025-03-25T14:30:00.000Z" } }, "required": [ "id", "codeChange" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_CodeChange_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/CodeChange" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ApiCodeChangeSource": { "type": "string", "enum": [ "github", "gitlab", "bitbucket", "azuredevops" ], "description": "Version control source service name for code changes." }, "DatabaseType": { "description": "A database resource category that can be used as the `resourceType`\nquery parameter on `GET /audits/{auditId}/assets/databases`.", "properties": { "id": { "type": "string", "description": "Resource category identifier — pass this value as the `resourceType`\nquery parameter on `GET /audits/{auditId}/assets/databases`.", "example": "RDSInstance" }, "displayName": { "type": "string", "description": "Human-readable display name for the database type.", "example": "RDS Instance" } }, "required": [ "id", "displayName" ], "type": "object", "additionalProperties": false }, "PaginatedResponse_DatabaseType_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/DatabaseType" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AtlasCluster": { "enum": [ "AtlasCluster" ], "type": "string" }, "AtlasClusterDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AtlasCluster" }, "provider": { "type": "string", "enum": [ "MongoDB Atlas" ], "nullable": false }, "projectId": { "type": "string" }, "backupEnabled": { "type": "boolean" }, "clusterTier": { "type": "string" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureCosmosDB": { "enum": [ "AzureCosmosDB" ], "type": "string" }, "AzureCosmosDBDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureCosmosDB" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureCosmosDBForPostgreSQL": { "enum": [ "AzureCosmosDBForPostgreSQL" ], "type": "string" }, "AzureCosmosDBForPostgreSQLDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureCosmosDBForPostgreSQL" }, "encryptionEnabled": { "type": "boolean" }, "backupRetentionPeriod": { "type": "number", "format": "double" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureDatabaseForExternalSQLVariant": { "enum": [ "AzureDatabaseForExternalSQLVariant" ], "type": "string" }, "AzureDatabaseForExternalSQLVariantDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureDatabaseForExternalSQLVariant" }, "databaseType": { "type": "string" }, "backupRetentionDays": { "type": "number", "format": "double" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureSQLDatabase": { "enum": [ "AzureSQLDatabase" ], "type": "string" }, "AzureSQLDatabaseDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureSQLDatabase" }, "encryptionEnabled": { "type": "boolean" }, "shortTermBackupRetentionDays": { "type": "number", "format": "double" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureSQLManagedInstance": { "enum": [ "AzureSQLManagedInstance" ], "type": "string" }, "AzureSQLManagedInstanceDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureSQLManagedInstance" }, "shortTermBackupRetentionDays": { "type": "number", "format": "double" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureSQLServerOnVMs": { "enum": [ "AzureSQLServerOnVMs" ], "type": "string" }, "AzureSQLServerOnVMsDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureSQLServerOnVMs" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.AzureSynapseWarehouse": { "enum": [ "AzureSynapseWarehouse" ], "type": "string" }, "AzureSynapseWarehouseDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "Azure" ], "nullable": false }, "location": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.AzureSynapseWarehouse" }, "encryptionEnabled": { "type": "boolean" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.BigQueryDataset": { "enum": [ "BigQueryDataset" ], "type": "string" }, "BigQueryDatasetDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "GCP" ], "nullable": false }, "projectId": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.BigQueryDataset" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.BigtableInstance": { "enum": [ "BigtableInstance" ], "type": "string" }, "BigtableInstanceDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "GCP" ], "nullable": false }, "projectId": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.BigtableInstance" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.CloudSQLInstance": { "enum": [ "CloudSQLInstance" ], "type": "string" }, "CloudSQLInstanceDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "GCP" ], "nullable": false }, "projectId": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.CloudSQLInstance" }, "backupsEnabled": { "type": "boolean" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.DatastoreProject": { "enum": [ "DatastoreProject" ], "type": "string" }, "DatastoreProjectDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "GCP" ], "nullable": false }, "projectId": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.DatastoreProject" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.DigitalOceanMongodbCluster": { "enum": [ "DigitalOceanMongodbCluster" ], "type": "string" }, "DigitalOceanMongodbClusterDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "DigitalOcean" ], "nullable": false }, "region": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.DigitalOceanMongodbCluster" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.DigitalOceanRedisCluster": { "enum": [ "DigitalOceanRedisCluster" ], "type": "string" }, "DigitalOceanRedisClusterDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "DigitalOcean" ], "nullable": false }, "region": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.DigitalOceanRedisCluster" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.DigitalOceanRelationalDbCluster": { "enum": [ "DigitalOceanRelationalDbCluster" ], "type": "string" }, "DigitalOceanRelationalDbClusterDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "DigitalOcean" ], "nullable": false }, "region": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.DigitalOceanRelationalDbCluster" }, "engine": { "type": "string" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.DynamoDBTable": { "enum": [ "DynamoDBTable" ], "type": "string" }, "DynamoDBTableDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "AWS" ], "nullable": false }, "region": { "type": "string" }, "account": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.DynamoDBTable" }, "tableStatus": { "type": "string" }, "continuousBackupsStatus": { "type": "string" }, "pointInTimeRecoveryStatus": { "type": "string" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.FirestoreProject": { "enum": [ "FirestoreProject" ], "type": "string" }, "FirestoreProjectDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "GCP" ], "nullable": false }, "projectId": { "type": "string", "nullable": true }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.FirestoreProject" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.OracleCloudAutonomousDatabase": { "enum": [ "OracleCloudAutonomousDatabase" ], "type": "string" }, "OracleCloudAutonomousDatabaseDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.OracleCloudAutonomousDatabase" }, "provider": { "type": "string", "enum": [ "Oracle Cloud" ], "nullable": false }, "region": { "type": "string" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.RDSInstance": { "enum": [ "RDSInstance" ], "type": "string" }, "RDSInstanceDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "AWS" ], "nullable": false }, "region": { "type": "string" }, "account": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.RDSInstance" }, "engine": { "type": "string" }, "dbInstanceStatus": { "type": "string" }, "storageEncrypted": { "type": "boolean" }, "backupRetentionPeriod": { "type": "number", "format": "double" }, "publiclyAccessible": { "type": "boolean" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.RedshiftCluster": { "enum": [ "RedshiftCluster" ], "type": "string" }, "RedshiftClusterDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "AWS" ], "nullable": false }, "region": { "type": "string" }, "account": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.RedshiftCluster" }, "encryptionEnabled": { "type": "boolean" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory.SpannerInstance": { "enum": [ "SpannerInstance" ], "type": "string" }, "SpannerInstanceDatabase": { "properties": { "id": { "type": "string", "example": "5f2c939a52855e725c8d5824" }, "displayName": { "type": "string", "example": "my-production-db" }, "externalURL": { "type": "string", "nullable": true, "example": "https://console.aws.amazon.com/rds/home?region=us-east-1#database:id=my-production-db" }, "provider": { "type": "string", "enum": [ "GCP" ], "nullable": false }, "projectId": { "type": "string" }, "resourceType": { "$ref": "#/components/schemas/ApiDatabaseResourceCategory.SpannerInstance" } }, "required": [ "id", "resourceType" ], "type": "object", "additionalProperties": false }, "Database": { "anyOf": [ { "$ref": "#/components/schemas/AtlasClusterDatabase" }, { "$ref": "#/components/schemas/AzureCosmosDBDatabase" }, { "$ref": "#/components/schemas/AzureCosmosDBForPostgreSQLDatabase" }, { "$ref": "#/components/schemas/AzureDatabaseForExternalSQLVariantDatabase" }, { "$ref": "#/components/schemas/AzureSQLDatabaseDatabase" }, { "$ref": "#/components/schemas/AzureSQLManagedInstanceDatabase" }, { "$ref": "#/components/schemas/AzureSQLServerOnVMsDatabase" }, { "$ref": "#/components/schemas/AzureSynapseWarehouseDatabase" }, { "$ref": "#/components/schemas/BigQueryDatasetDatabase" }, { "$ref": "#/components/schemas/BigtableInstanceDatabase" }, { "$ref": "#/components/schemas/CloudSQLInstanceDatabase" }, { "$ref": "#/components/schemas/DatastoreProjectDatabase" }, { "$ref": "#/components/schemas/DigitalOceanMongodbClusterDatabase" }, { "$ref": "#/components/schemas/DigitalOceanRedisClusterDatabase" }, { "$ref": "#/components/schemas/DigitalOceanRelationalDbClusterDatabase" }, { "$ref": "#/components/schemas/DynamoDBTableDatabase" }, { "$ref": "#/components/schemas/FirestoreProjectDatabase" }, { "$ref": "#/components/schemas/OracleCloudAutonomousDatabaseDatabase" }, { "$ref": "#/components/schemas/RDSInstanceDatabase" }, { "$ref": "#/components/schemas/RedshiftClusterDatabase" }, { "$ref": "#/components/schemas/SpannerInstanceDatabase" } ] }, "PaginatedResponse_Database_": { "properties": { "results": { "properties": { "data": { "items": { "$ref": "#/components/schemas/Database" }, "type": "array" }, "pageInfo": { "$ref": "#/components/schemas/PageInfo" } }, "required": [ "data", "pageInfo" ], "type": "object" } }, "required": [ "results" ], "type": "object", "additionalProperties": false }, "ApiDatabaseResourceCategory": { "description": "Allowed values for the `resourceType` query parameter on\n`GET /audits/{auditId}/assets/databases`.\n\nEach value selects one database kind to paginate. Use\n`GET /audits/{auditId}/assets/databases/types` to discover\nthe valid values dynamically.\n\nDeclared as a local enum (not a type alias) so TSOA can\nresolve it for OpenAPI generation, while staying under the\n`no-large-union-type` threshold that only targets type aliases.", "enum": [ "AtlasCluster", "AzureCosmosDB", "AzureCosmosDBForPostgreSQL", "AzureDatabaseForExternalSQLVariant", "AzureSQLDatabase", "AzureSQLManagedInstance", "AzureSQLServerOnVMs", "AzureSynapseWarehouse", "BigQueryDataset", "BigtableInstance", "CloudSQLInstance", "DatastoreProject", "DigitalOceanMongodbCluster", "DigitalOceanRedisCluster", "DigitalOceanRelationalDbCluster", "DynamoDBTable", "FirestoreProject", "OracleCloudAutonomousDatabase", "RDSInstance", "RedshiftCluster", "SpannerInstance" ], "type": "string" }, "Auditor": { "properties": { "id": { "type": "string" }, "organizationId": { "type": "string", "description": "The unique identifier for the organization." }, "email": { "type": "string", "description": "The email address of the auditor." }, "givenName": { "type": "string", "description": "The given name (first name) of the auditor." }, "familyName": { "type": "string", "description": "The family name (last name) of the auditor." } }, "required": [ "id", "organizationId", "email", "givenName", "familyName" ], "type": "object", "additionalProperties": false }, "AddAuditorInput": { "properties": { "email": { "type": "string", "description": "Email of the new user." }, "givenName": { "type": "string", "description": "First name of the new user." }, "familyName": { "type": "string", "description": "Last name of the new user." } }, "required": [ "email", "givenName", "familyName" ], "type": "object", "additionalProperties": false } }, "securitySchemes": { "oauth": { "type": "oauth2", "description": "Get an oauth token from the token url and use it as a bearer token to access the Vanta API.", "flows": { "clientCredentials": { "scopes": { "auditor-api.audit:read": "Grant read-only access to your audits", "auditor-api.audit:write": "Grant read-write access to your audits", "auditor-api.auditor:read": "Grant read-only access to your auditors", "auditor-api.auditor:write": "Grant read-write access to your auditors" }, "tokenUrl": "https://api.vanta.com/oauth/token" } } }, "bearerAuth": { "type": "http", "scheme": "bearer" } } }, "info": { "title": "Conduct an audit", "version": "1.0.0", "description": "The Auditor API lets audit firms conduct audits from a tool outside of Vanta. Unlock data syncing with Vanta through this API.\n\n**Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`.", "termsOfService": "https://www.vanta.com/terms", "license": { "name": "UNLICENSED" }, "contact": { "name": "API Support", "url": "https://help.vanta.com/", "email": "support@vanta.com" } }, "paths": { "/auditors": { "post": { "operationId": "CreateAuditor", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Auditor" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "organizationId": "8c9af880f1a335965fc850c8", "email": "testauditor@audit.com", "givenName": "Sam", "familyName": "Auditor" } } } } } } }, "description": "Create an auditor in Vanta.\n\nRate limit: 10 requests / minute.", "summary": "Create an auditor", "tags": [ "Auditors" ], "security": [ { "bearerAuth": [] } ], "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddAuditorInput" } } } }, "x-speakeasy-name-override": "create", "x-codeSamples": [ { "lang": "typescript", "label": "CreateAuditor", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.auditors.create({\n email: \"Genesis_Kunze87@yahoo.com\",\n givenName: \"\",\n familyName: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateAuditor", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.AddAuditorInput;\nimport com.vanta.vanta_auditor_api.models.operations.CreateAuditorResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n AddAuditorInput req = AddAuditorInput.builder()\n .email(\"Genesis_Kunze87@yahoo.com\")\n .givenName(\"\")\n .familyName(\"\")\n .build();\n\n CreateAuditorResponse res = sdk.auditors().create()\n .request(req)\n .call();\n\n if (res.auditor().isPresent()) {\n System.out.println(res.auditor().get());\n }\n }\n}" } ] } }, "/audits": { "get": { "operationId": "ListAudits", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Audit_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "65fc81a3359c8508c9af880f", "customerOrganizationName": "corporation.com", "customerDisplayName": "Corporation Company", "customerOrganizationId": "65fc81a3359c8508c9af880f", "auditStartDate": "2024-03-07T21:25:56.000Z", "auditEndDate": "2024-03-14T21:25:56.000Z", "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z", "framework": "SOC 2 Type II", "displayName": "Q1 2024 SOC 2 Audit", "allowAuditorEmails": [ "sam@auditor.com" ], "allowAllAuditors": true, "deletionDate": "2024-03-07T21:25:56.000Z", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "completionDate": "2024-03-07T21:25:56.000Z", "auditFocus": "EXTERNAL", "auditorRequestListMetadata": { "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z" } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" } } } } } } } } }, "description": "Returns a paginated list of audits scoped to the audit firm.\n\nTo identify IRL (Information Request List) audits, check for the presence of the\n`auditorRequestListMetadata` field. This field is only present for IRL-based audits\nand will be `undefined` for standard audits.\n\nRate limit: 250 requests / minute.", "summary": "List audits", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/ListAuditsPageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all audits that have changed since changedSinceDate.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Includes only audits with no audit report uploaded", "in": "query", "name": "isActiveAudit", "required": false, "schema": { "type": "boolean" } } ], "x-speakeasy-name-override": "list", "x-codeSamples": [ { "lang": "typescript", "label": "ListAudits", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.list({});\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAudits", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditsResponse res = sdk.audits().list()\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseAudit().isPresent()) {\n System.out.println(res.paginatedResponseAudit().get());\n }\n }\n}" } ] } }, "/audits/duplicate": { "post": { "operationId": "Duplicate", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Audit" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "customerOrganizationName": "corporation.com", "customerDisplayName": "Corporation Company", "customerOrganizationId": "65fc81a3359c8508c9af880f", "auditStartDate": "2024-03-07T21:25:56.000Z", "auditEndDate": "2024-03-14T21:25:56.000Z", "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z", "framework": "SOC 2 Type II", "displayName": "Q1 2024 SOC 2 Audit", "allowAuditorEmails": [ "sam@auditor.com" ], "allowAllAuditors": true, "deletionDate": "2024-03-07T21:25:56.000Z", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "completionDate": "2024-03-07T21:25:56.000Z", "auditFocus": "EXTERNAL", "auditorRequestListMetadata": { "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z" } } } } } } } }, "description": "Duplicates an existing IRL audit into a new audit engagement with the supplied\ndisplayName, audit dates, early access date, and auditor roster. Company, audit\ntype, and framework are copied from the source audit and cannot be changed.\n\nEach email in `allowAuditorEmails` must match an active user in the\nauthenticated audit firm's domain. Provision auditors via `POST /auditors`\nbefore referencing them here, or copy emails from `GET /audits/{sourceAuditId}`\n→ `allowAuditorEmails` when duplicating with the same roster.\n\nInformation requests are copied from the source audit. After duplication:\n\n- Requests with Vanta evidence will be pre-filled and marked as internal review.\n\n Review them before sharing with your customer.\n- Requests where evidence was not available or was uploaded externally will need\n\n evidence added manually.\n- Evidence capture dates and due dates can be modified after duplication.\n\nRate limit: 10 requests / minute.", "summary": "Duplicate an IRL audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DuplicateAuditRequest" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "Duplicate", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.duplicate({\n sourceAuditId: \"\",\n displayName: \"Orpha.Schoen\",\n auditStartDate: new Date(\"2024-01-02T08:34:53.150Z\"),\n auditEndDate: new Date(\"2024-10-06T07:06:05.931Z\"),\n earlyAccessStartsAt: new Date(\"2025-05-31T02:08:59.254Z\"),\n allowAuditorEmails: [\n \"\",\n \"\",\n \"\",\n ],\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "Duplicate", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.DuplicateAuditRequest;\nimport com.vanta.vanta_auditor_api.models.operations.DuplicateResponse;\nimport java.lang.Exception;\nimport java.time.OffsetDateTime;\nimport java.util.List;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n DuplicateAuditRequest req = DuplicateAuditRequest.builder()\n .sourceAuditId(\"\")\n .displayName(\"Orpha.Schoen\")\n .auditStartDate(OffsetDateTime.parse(\"2024-01-02T08:34:53.150Z\"))\n .auditEndDate(OffsetDateTime.parse(\"2024-10-06T07:06:05.931Z\"))\n .earlyAccessStartsAt(OffsetDateTime.parse(\"2025-05-31T02:08:59.254Z\"))\n .allowAuditorEmails(List.of(\n \"\",\n \"\",\n \"\"))\n .build();\n\n DuplicateResponse res = sdk.audits().duplicate()\n .request(req)\n .call();\n\n if (res.audit().isPresent()) {\n System.out.println(res.audit().get());\n }\n }\n}" } ] } }, "/audits/{auditId}": { "get": { "operationId": "GetAudit", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Audit" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "customerOrganizationName": "corporation.com", "customerDisplayName": "Corporation Company", "customerOrganizationId": "65fc81a3359c8508c9af880f", "auditStartDate": "2024-03-07T21:25:56.000Z", "auditEndDate": "2024-03-14T21:25:56.000Z", "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z", "framework": "SOC 2 Type II", "displayName": "Q1 2024 SOC 2 Audit", "allowAuditorEmails": [ "sam@auditor.com" ], "allowAllAuditors": true, "deletionDate": "2024-03-07T21:25:56.000Z", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "completionDate": "2024-03-07T21:25:56.000Z", "auditFocus": "EXTERNAL", "auditorRequestListMetadata": { "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z" } } } } } } } }, "description": "Returns a single audit by ID, scoped to the audit firm.\n\nTo identify IRL (Information Request List) audits, check for the presence of the\n`auditorRequestListMetadata` field. This field is only present for IRL-based audits\nand will be `undefined` for standard audits.\n\nRate limit: 250 requests / minute.", "summary": "Get audit by ID", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "GetAudit", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getAudit({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "GetAudit", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.GetAuditResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n GetAuditResponse res = sdk.audits().getAudit()\n .auditId(\"\")\n .call();\n\n if (res.audit().isPresent()) {\n System.out.println(res.audit().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/assets/code-changes": { "get": { "operationId": "ListCodeChanges", "responses": { "200": { "description": "Paginated list of code changes with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_CodeChange_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "code_change_12345", "endCursor": "code_change_12345" }, "data": [ { "id": "code_change_12345", "codeChange": "fix-auth-bug", "identifier": "101", "service": "github", "repository": "vanta/obsidian", "openedAt": "2025-01-25T14:30:00.000Z", "closedAt": "2025-03-25T14:30:00.000Z" } ] } } } } } } } }, "description": "Retrieves code changes population data for an audit.\n\nThis endpoint provides access to code change records (pull requests)\nvisible to auditors during an audit engagement.\n\nSupports filtering by:\n- `search`: Searches code change titles and repository names (case-insensitive)\n- `sourcesMatchesAny`: Filters by version control source (accepted values: github, gitlab, bitbucket, azuredevops)\n- `closedAfterDate` / `closedBeforeDate`: Filters by the closed date range\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nResults are sorted by closed date (newest first). This sort order is\nfixed and cannot be customized via query parameters.\n\nRate limit: 10 requests / minute.", "summary": "List code changes for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by code change title or repository name", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Filter code changes by version control source (accepted values: github, gitlab, bitbucket, azuredevops)", "in": "query", "name": "sourcesMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApiCodeChangeSource" } } }, { "description": "Filter code changes closed on or after this date (ISO 8601)", "in": "query", "name": "closedAfterDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter code changes closed on or before this date (ISO 8601)", "in": "query", "name": "closedBeforeDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListCodeChanges", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listCodeChanges({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListCodeChanges", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListCodeChangesRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListCodeChangesResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListCodeChangesRequest req = ListCodeChangesRequest.builder()\n .auditId(\"\")\n .build();\n\n ListCodeChangesResponse res = sdk.audits().listCodeChanges()\n .request(req)\n .call();\n\n if (res.paginatedResponseCodeChange().isPresent()) {\n System.out.println(res.paginatedResponseCodeChange().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/comments": { "get": { "operationId": "ListAuditComments", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Comment_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "65fc81a3359c8508c9af880f", "auditEvidenceId": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" } } } } } } } } }, "description": "Returns a paginated list of comments for an audit.\n\nRate limit: 250 requests / minute.", "summary": "List audit comments", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all comments that have changed since changedSinceDate.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-speakeasy-name-override": "listComments", "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditComments", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listComments({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditComments", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditCommentsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditCommentsResponse res = sdk.audits().listComments()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseComment().isPresent()) {\n System.out.println(res.paginatedResponseComment().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/controls": { "get": { "operationId": "ListAuditControls", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AuditorControl_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "a2f7e1b9d0c3f4e5a6c7b8d9", "externalId": "CRY-104", "name": "Data encryption utilized", "description": "Access reviews are performed to ensure that access is appropriate for the user's role and responsibilities.", "source": "Vanta", "domains": [ "CRYPTOGRAPHIC_PROTECTIONS" ], "owner": { "id": "65e1efde08e8478f143a8ff9", "emailAddress": "example-person@email.com", "displayName": "Example Owner" }, "framework": "soc2", "role": null, "customFields": [], "sections": [ { "framework": "SOC 2", "name": "CC 1.1", "principle": { "id": "CC 1.0", "name": "Control Environment" } } ], "creationDate": null, "modificationDate": null } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" } } } } } } } } }, "description": "Returns a paginated list of controls for an audit.\n\nRate limit: 250 requests / minute.", "summary": "List audit controls", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Filter controls whose externalId matches any of the provided values (exact, case-sensitive match).", "in": "query", "name": "externalIdMatchesAny", "required": false, "schema": { "type": "array", "items": { "type": "string" } } } ], "x-speakeasy-name-override": "listControls", "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditControls", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listControls({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditControls", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditControlsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditControlsResponse res = sdk.audits().listControls()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseAuditorControl().isPresent()) {\n System.out.println(res.paginatedResponseAuditorControl().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/controls/custom-controls": { "post": { "operationId": "CreateCustomControl", "responses": { "201": { "description": "Custom control created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Control" }, "examples": { "Example 1": { "value": { "id": "a2f7e1b9d0c3f4e5a6c7b8d9", "externalId": "CRY-104", "name": "Data encryption utilized", "description": "Access reviews are performed to ensure that access is appropriate for the user's role and responsibilities.", "source": "Vanta", "domains": [ "CRYPTOGRAPHIC_PROTECTIONS" ], "owner": { "id": "65e1efde08e8478f143a8ff9", "emailAddress": "example-person@email.com", "displayName": "Example Owner" }, "role": "CONTROLLER", "customFields": [ { "label": "Additional context", "value": "This control is critical for GDPR compliance" } ], "creationDate": null, "modificationDate": null } } } } } } }, "description": "Create a custom control for an audit.\n\nRate limit: 10 requests / minute.", "summary": "Create a custom control for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCustomControlInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "CreateCustomControl", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.createCustomControl({\n auditId: \"\",\n createCustomControlInput: {\n externalId: \"\",\n name: null,\n description: \"yet plus utter queasily what juvenile wound\",\n effectiveDate: new Date(\"2024-11-10T13:58:54.564Z\"),\n category: \"CLOUD_SECURITY\",\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateCustomControl", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.ControlDomain;\nimport com.vanta.vanta_auditor_api.models.components.CreateCustomControlInput;\nimport com.vanta.vanta_auditor_api.models.operations.CreateCustomControlResponse;\nimport java.lang.Exception;\nimport java.time.OffsetDateTime;\nimport java.util.Optional;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n CreateCustomControlResponse res = sdk.audits().createCustomControl()\n .auditId(\"\")\n .createCustomControlInput(CreateCustomControlInput.builder()\n .externalId(\"\")\n .name(Optional.empty())\n .description(\"yet plus utter queasily what juvenile wound\")\n .effectiveDate(OffsetDateTime.parse(\"2024-11-10T13:58:54.564Z\"))\n .category(ControlDomain.CLOUD_SECURITY)\n .build())\n .call();\n\n if (res.control().isPresent()) {\n System.out.println(res.control().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/controls/{controlId}/comments": { "get": { "operationId": "ListCommentsForControl", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AuditControlComment_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "Njg5MGU0NzNkY2UxZGE1Z", "endCursor": "Njg5MGU0NzNkY2UxZGE1Z" } } } } } } } } }, "description": "Retrieves a paginated list of comments on a control within an IRL audit,\nenabling auditors to view collaboration history on the control.\n\nThis endpoint always includes soft-deleted records (where `deletionDate !== null`).\nClients should check the `deletionDate` field to identify and handle deleted records\nappropriately in their systems.\n\nThis endpoint supports delta synchronization via the `changedSinceDate` parameter,\nallowing efficient polling for changes without retrieving the entire dataset.\n\nReturns 404 when the control is not part of the audit.\n\nPagination usage:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage` to see if more data exists\n3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request\n4. Repeat until `hasNextPage` is false\n\nDelta sync usage:\n1. Store the timestamp of your last sync\n2. Pass that timestamp as `changedSinceDate`\n3. Only comments created, modified, or deleted since that timestamp are returned\n4. Process updates, including soft-deletes (deletionDate !== null)\n5. Update your last sync timestamp to the current time\n\nRate limit: 50 requests / minute.", "summary": "List comments for a control within an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "controlId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of comments to return per page.", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from a previous response. Provide to fetch the next page of comments.", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all comments that have changed since changedSinceDate.\nConsiders creationDate, modificationDate, and deletionDate timestamps when determining changes.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListCommentsForControl", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listCommentsForControl({\n auditId: \"\",\n controlId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListCommentsForControl", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListCommentsForControlRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListCommentsForControlResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListCommentsForControlRequest req = ListCommentsForControlRequest.builder()\n .auditId(\"\")\n .controlId(\"\")\n .build();\n\n ListCommentsForControlResponse res = sdk.audits().listCommentsForControl()\n .request(req)\n .call();\n\n if (res.paginatedResponseAuditControlComment().isPresent()) {\n System.out.println(res.paginatedResponseAuditControlComment().get());\n }\n }\n}" } ] }, "post": { "operationId": "CreateCommentForControl", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditControlComment" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } } } } } } }, "description": "Creates a new comment on a control within an IRL audit. The comment author\nmust be an auditor in the audit firm making the request. The comment will be\nassociated with the control and visible to all authorized users.\n\nReturns 404 when the control is not part of the audit.\n\nRate limit: 50 requests / minute.", "summary": "Create a comment for a control within an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "controlId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddAuditControlCommentInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "CreateCommentForControl", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.createCommentForControl({\n auditId: \"\",\n controlId: \"\",\n addAuditControlCommentInput: {\n text: \"\",\n email: \"Justice.Konopelski@hotmail.com\",\n creationDate: new Date(\"2024-04-23T18:18:35.232Z\"),\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateCommentForControl", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.AddAuditControlCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.CreateCommentForControlResponse;\nimport java.lang.Exception;\nimport java.time.OffsetDateTime;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n CreateCommentForControlResponse res = sdk.audits().createCommentForControl()\n .auditId(\"\")\n .controlId(\"\")\n .addAuditControlCommentInput(AddAuditControlCommentInput.builder()\n .text(\"\")\n .email(\"Justice.Konopelski@hotmail.com\")\n .creationDate(OffsetDateTime.parse(\"2024-04-23T18:18:35.232Z\"))\n .build())\n .call();\n\n if (res.auditControlComment().isPresent()) {\n System.out.println(res.auditControlComment().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/controls/{controlId}/comments/{commentId}": { "patch": { "operationId": "UpdateCommentForControl", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditControlComment" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } } } } } } }, "description": "Updates an existing comment on a control. Only the original author\nof the comment can update it. The author is identified by their email address,\nwhich must match the email of the user who created the comment.\n\nRate limit: 10 requests / minute.", "summary": "Update a comment for a control within an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "controlId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "commentId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateAuditControlCommentInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "UpdateCommentForControl", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.updateCommentForControl({\n auditId: \"\",\n controlId: \"\",\n commentId: \"\",\n updateAuditControlCommentInput: {\n text: \"\",\n email: \"Leonardo71@hotmail.com\",\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "UpdateCommentForControl", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.UpdateAuditControlCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.UpdateCommentForControlResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n UpdateCommentForControlResponse res = sdk.audits().updateCommentForControl()\n .auditId(\"\")\n .controlId(\"\")\n .commentId(\"\")\n .updateAuditControlCommentInput(UpdateAuditControlCommentInput.builder()\n .text(\"\")\n .email(\"Leonardo71@hotmail.com\")\n .build())\n .call();\n\n if (res.auditControlComment().isPresent()) {\n System.out.println(res.auditControlComment().get());\n }\n }\n}" } ] }, "delete": { "operationId": "DeleteCommentForControl", "responses": { "204": { "description": "No content" } }, "description": "Deletes an existing comment on a control. Only the original author\nof the comment can delete it. The author is identified by their email address,\nwhich must match the email of the user who created the comment.\n\nRate limit: 10 requests / minute.", "summary": "Delete a comment for a control within an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "controlId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "commentId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteAuditControlCommentInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "DeleteCommentForControl", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n await vanta.audits.deleteCommentForControl({\n auditId: \"\",\n controlId: \"\",\n commentId: \"\",\n deleteAuditControlCommentInput: {\n email: \"Lorenzo.Ondricka@yahoo.com\",\n },\n });\n\n\n}\n\nrun();" }, { "lang": "java", "label": "DeleteCommentForControl", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.DeleteAuditControlCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.DeleteCommentForControlResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n DeleteCommentForControlResponse res = sdk.audits().deleteCommentForControl()\n .auditId(\"\")\n .controlId(\"\")\n .commentId(\"\")\n .deleteAuditControlCommentInput(DeleteAuditControlCommentInput.builder()\n .email(\"Lorenzo.Ondricka@yahoo.com\")\n .build())\n .call();\n\n // handle response\n }\n}" } ] } }, "/audits/{auditId}/controls/{controlId}/information-requests": { "get": { "operationId": "ListInformationRequestsForControl", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_InformationRequest_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "Njg5MGU0NzNkY2UxZGE1Z", "endCursor": "Njg5MGU0NzNkY2UxZGE1Z" } } } } } } } } }, "description": "Returns a paginated list of active information requests linked to a specific\ncontrol within an IRL audit. An information request is linked to a control\neither via its framework codes (`criteriaIds`) or via a direct association\n(`additionalControlIds`).\n\nSoft-deleted information requests are not included in the response. To\nsynchronize deletions, use `GET /audits/{auditId}/information-requests`,\nwhich supports `changedSinceDate` and includes soft-deleted records.\n\nReturns 404 when the control is not part of the audit. Returns an empty page\nwhen the control is part of the audit but has no active IRLs linked to it.\n\nPagination usage:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage` to see if more data exists\n3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request\n4. Repeat until `hasNextPage` is false\n\nRate limit: 50 requests / minute.", "summary": "List information requests linked to a control within an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "controlId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of information requests to return per page.", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from a previous response. Provide to fetch the next page of results.", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListInformationRequestsForControl", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listInformationRequestsForControl({\n auditId: \"\",\n controlId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListInformationRequestsForControl", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListInformationRequestsForControlResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListInformationRequestsForControlResponse res = sdk.audits().listInformationRequestsForControl()\n .auditId(\"\")\n .controlId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseInformationRequest().isPresent()) {\n System.out.println(res.paginatedResponseInformationRequest().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/evidence": { "get": { "operationId": "ListAuditEvidence", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Evidence_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "65fc81a3359c8508c9af880f", "externalId": "cG9saWN5OmFjY2Vzcy1jb250cm9sLXBvbGljeQo=", "status": "Ready for audit", "statusUpdatedDate": "2024-03-07T21:25:56.000Z", "name": "Access Control Policy", "deletionDate": "2024-03-07T21:25:56.000Z", "creationDate": "2024-03-07T21:25:56.000Z", "testStatus": "The test was passing during this period", "evidenceType": "Policy", "evidenceId": "access-control-policy", "relatedControls": [ { "name": "CRY-104", "sectionNames": [ "Article 13" ] } ], "description": "example description of test" } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" } } } } } } } } }, "description": "Returns a paginated list of evidence for an audit.\n\nRate limit: 250 requests / minute.", "summary": "List audit evidence", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all audit evidence that have changed since changedSinceDate.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-speakeasy-name-override": "listEvidence", "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditEvidence", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listEvidence({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditEvidence", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditEvidenceResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditEvidenceResponse res = sdk.audits().listEvidence()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseEvidence().isPresent()) {\n System.out.println(res.paginatedResponseEvidence().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/evidence/custom-evidence-requests": { "post": { "operationId": "CreateCustomEvidenceRequest", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CustomEvidenceRequest" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "controlIds": [ "1.1.2.a" ], "title": "Access Control Policy", "description": "Description for Access Control Policy", "cadence": "P6M", "reminderWindow": "P6M", "isRestricted": true } } } } } } }, "description": "Create a custom evidence request for an audit.\n\nRate limit: 10 requests / minute.", "summary": "Create a custom evidence request for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCustomEvidenceRequestInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "CreateCustomEvidenceRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.createCustomEvidenceRequest({\n auditId: \"\",\n createCustomEvidenceRequestInput: {\n controlIds: [\n \"\",\n \"\",\n ],\n title: \"\",\n description: \"pure bludgeon deliberately question although\",\n cadence: \"P1D\",\n reminderWindow: \"P0D\",\n isRestricted: false,\n auditorEmail: \"\",\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateCustomEvidenceRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.CreateCustomEvidenceRequestInput;\nimport com.vanta.vanta_auditor_api.models.components.RecurrenceDuration;\nimport com.vanta.vanta_auditor_api.models.operations.CreateCustomEvidenceRequestResponse;\nimport java.lang.Exception;\nimport java.util.List;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n CreateCustomEvidenceRequestResponse res = sdk.audits().createCustomEvidenceRequest()\n .auditId(\"\")\n .createCustomEvidenceRequestInput(CreateCustomEvidenceRequestInput.builder()\n .controlIds(List.of(\n \"\",\n \"\"))\n .title(\"\")\n .description(\"pure bludgeon deliberately question although\")\n .cadence(RecurrenceDuration.P1_D)\n .reminderWindow(RecurrenceDuration.P0_D)\n .isRestricted(false)\n .auditorEmail(\"\")\n .build())\n .call();\n\n if (res.customEvidenceRequest().isPresent()) {\n System.out.println(res.customEvidenceRequest().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/evidence/{auditEvidenceId}": { "patch": { "operationId": "UpdateAuditEvidence", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Evidence" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "externalId": "cG9saWN5OmFjY2Vzcy1jb250cm9sLXBvbGljeQo=", "status": "Ready for audit", "statusUpdatedDate": "2024-03-07T21:25:56.000Z", "name": "Access Control Policy", "deletionDate": "2024-03-07T21:25:56.000Z", "creationDate": "2024-03-07T21:25:56.000Z", "testStatus": "The test was passing during this period", "evidenceType": "Policy", "evidenceId": "access-control-policy", "relatedControls": [ { "name": "CRY-104", "sectionNames": [ "Article 13" ] } ], "description": "example description of test" } } } } } } }, "description": "Update audit evidence.\n\nRate limit: 10 requests / minute.", "summary": "Update audit evidence", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "auditEvidenceId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditEvidenceUpdateInput" } } } }, "x-speakeasy-name-override": "updateEvidence", "x-codeSamples": [ { "lang": "typescript", "label": "UpdateAuditEvidence", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.updateEvidence({\n auditId: \"\",\n auditEvidenceId: \"\",\n auditEvidenceUpdateInput: {},\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "UpdateAuditEvidence", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.AuditEvidenceUpdateInput;\nimport com.vanta.vanta_auditor_api.models.operations.UpdateAuditEvidenceResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n UpdateAuditEvidenceResponse res = sdk.audits().updateEvidence()\n .auditId(\"\")\n .auditEvidenceId(\"\")\n .auditEvidenceUpdateInput(AuditEvidenceUpdateInput.builder()\n .build())\n .call();\n\n if (res.evidence().isPresent()) {\n System.out.println(res.evidence().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/evidence/{auditEvidenceId}/comments": { "post": { "operationId": "CreateCommentForAuditEvidence", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Comment" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "auditEvidenceId": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } } } } } } }, "description": "Create a comment in Vanta for a piece of evidence.\n\nRate limit: 10 requests / minute.", "summary": "Create a comment for audit evidence", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "auditEvidenceId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddCommentInput" } } } }, "x-speakeasy-name-override": "createCommentForEvidence", "x-codeSamples": [ { "lang": "typescript", "label": "CreateCommentForAuditEvidence", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.createCommentForEvidence({\n auditId: \"\",\n auditEvidenceId: \"\",\n addCommentInput: {\n text: \"\",\n email: \"Carmen.Bogan@yahoo.com\",\n creationDate: new Date(\"2024-05-28T11:04:29.369Z\"),\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateCommentForAuditEvidence", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.AddCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.CreateCommentForAuditEvidenceResponse;\nimport java.lang.Exception;\nimport java.time.OffsetDateTime;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n CreateCommentForAuditEvidenceResponse res = sdk.audits().createCommentForEvidence()\n .auditId(\"\")\n .auditEvidenceId(\"\")\n .addCommentInput(AddCommentInput.builder()\n .text(\"\")\n .email(\"Carmen.Bogan@yahoo.com\")\n .creationDate(OffsetDateTime.parse(\"2024-05-28T11:04:29.369Z\"))\n .build())\n .call();\n\n if (res.comment().isPresent()) {\n System.out.println(res.comment().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/evidence/{auditEvidenceId}/urls": { "get": { "operationId": "ListAuditEvidenceUrls", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_EvidenceUrl_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "NjVmYzgxYTMzNTljODUwOGM5YWY4ODBm", "url": "https://s3.amazonaws.com/audit-evidence/2022/audit.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=secret%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20221104T140227Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=b228dbec8c1008c80c162e1210e4503dceead1e4d4751b4d9787314fd6da4d55", "filename": "example.jpg", "isDownloadable": true, "mimeType": "image/jpeg" } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" }, "totalCount": 1 } } } } } } } }, "description": "Returns a paginated list of evidence urls for an audit. This endpoint should be called whenever an\nevidence is created or has a statusUpdatedAt field that is more recent than the most recent polling event.\n\nEvidence must be in one of the following states to retrieve URLs: \"Ready for audit\", \"Accepted\", \"Flagged\", or \"NA\".\n\nRate limit: 600 requests / minute.", "summary": "List audit evidence url", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "auditEvidenceId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } } ], "x-speakeasy-name-override": "getEvidenceUrls", "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditEvidenceUrls", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getEvidenceUrls({\n auditId: \"\",\n auditEvidenceId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditEvidenceUrls", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditEvidenceUrlsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditEvidenceUrlsResponse res = sdk.audits().getEvidenceUrls()\n .auditId(\"\")\n .auditEvidenceId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseEvidenceUrl().isPresent()) {\n System.out.println(res.paginatedResponseEvidenceUrl().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/framework-codes": { "get": { "operationId": "GetFrameworkCodes", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FrameworkCodes" }, "examples": { "Example 1": { "value": { "frameworkCodes": [ "CC1.1", "CC1.2", "CC1.3", "CC2.1", "CC2.2", "CC3.1", "CC3.2", "CC4.1", "CC4.2", "CC5.1", "CC5.2", "CC6.1", "CC6.2", "CC7.1", "CC7.2", "CC8.1", "CC8.2" ] } } } } } } }, "description": "Retrieves all valid framework codes for the specified audit. This endpoint helps users discover which framework codes are available for creating and updating information requests for this audit.\n\nUse this endpoint to:\n- Discover available framework codes before creating information requests\n- Validate framework codes against the audit's framework\n- Get context about what framework codes are available for the audit type\n\nRate limit: 10 requests / minute.", "summary": "Get framework codes for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "GetFrameworkCodes", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getFrameworkCodes({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "GetFrameworkCodes", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.GetFrameworkCodesResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n GetFrameworkCodesResponse res = sdk.audits().getFrameworkCodes()\n .auditId(\"\")\n .call();\n\n if (res.frameworkCodes().isPresent()) {\n System.out.println(res.frameworkCodes().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests": { "get": { "operationId": "ListInformationRequests", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_InformationRequest_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "Njg5MGU0NzNkY2UxZGE1Z", "endCursor": "Njg5MGU0NzNkY2UxZGE1Z" } } } } } } } } }, "description": "Retrieves a paginated list of all information requests for an audit, enabling\nexternal audit management systems to display and track evidence requests.\n\nThis endpoint always includes soft-deleted records (where `deletionDate !== null`).\nClients should check the `deletionDate` field to identify and handle deleted records\nappropriately in their systems.\n\nThis endpoint supports delta synchronization via the `changedSinceDate` parameter,\nallowing efficient polling for changes without retrieving the entire dataset.\n\nPagination usage:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage` to see if more data exists\n3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request\n4. Repeat until `hasNextPage` is false\n\nDelta sync usage:\n1. Store the timestamp of your last sync\n2. Pass that timestamp as `changedSinceDate`\n3. Only requests created, modified, or deleted since that timestamp are returned\n4. Process updates and soft-deletes by checking the `deletionDate` field\n5. Update your last sync timestamp to the current time\n\nRate limit: 50 requests / minute.", "summary": "List information requests for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of information requests to return per page.", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from a previous response. Provide to fetch the next page of results.", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all information requests that have changed since changedSinceDate.\nConsiders creationDate, modificationDate, and deletionDate timestamps when determining changes.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListInformationRequests", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listInformationRequests({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListInformationRequests", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListInformationRequestsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListInformationRequestsResponse res = sdk.audits().listInformationRequests()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseInformationRequest().isPresent()) {\n System.out.println(res.paginatedResponseInformationRequest().get());\n }\n }\n}" } ] }, "post": { "operationId": "CreateInformationRequest", "responses": { "201": { "description": "Information request created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequest" }, "examples": { "Example 1": { "value": { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } } } } } } }, "description": "Creates a new information request for an audit during audit setup or as requirements evolve.\n\nAfter creating all information requests, use POST /audits/{auditId}/share-information-request-list\nto make them visible to the customer organization. Until shared, requests remain in draft state\nvisible only to auditors.\n\nNew requests are created in an initial state indicating evidence is needed. The status\nprogresses through the workflow: initial state → awaiting review → approved or flagged.\n\nRate limit: 600 requests / minute.", "summary": "Create a new information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateInformationRequestInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "CreateInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.createInformationRequest({\n auditId: \"\",\n createInformationRequestInput: {\n uniqueId: \"\",\n title: \"\",\n requestType: \"SAMPLE\",\n frameworkCodes: [],\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.CreateInformationRequestInput;\nimport com.vanta.vanta_auditor_api.models.components.InformationRequestType;\nimport com.vanta.vanta_auditor_api.models.operations.CreateInformationRequestResponse;\nimport java.lang.Exception;\nimport java.util.List;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n CreateInformationRequestResponse res = sdk.audits().createInformationRequest()\n .auditId(\"\")\n .createInformationRequestInput(CreateInformationRequestInput.builder()\n .uniqueId(\"\")\n .title(\"\")\n .requestType(InformationRequestType.SAMPLE)\n .frameworkCodes(List.of())\n .build())\n .call();\n\n if (res.informationRequest().isPresent()) {\n System.out.println(res.informationRequest().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}": { "get": { "operationId": "GetInformationRequest", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequest" }, "examples": { "Example 1": { "value": { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } } } } } } }, "description": "Retrieves a single information request by its ID for an audit, allowing external\naudit management systems to fetch the latest state of a specific request without\npaginating through the full list.\n\nSoft-deleted records (where `deletionDate !== null`) are included in the response.\nClients should check `deletionDate` to determine whether the request has been deleted.\n\nRate limit: 50 requests / minute.", "summary": "Get an information request by ID", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "GetInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getInformationRequest({\n auditId: \"\",\n requestId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "GetInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.GetInformationRequestResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n GetInformationRequestResponse res = sdk.audits().getInformationRequest()\n .auditId(\"\")\n .requestId(\"\")\n .call();\n\n if (res.informationRequest().isPresent()) {\n System.out.println(res.informationRequest().get());\n }\n }\n}" } ] }, "patch": { "operationId": "UpdateInformationRequest", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequest" }, "examples": { "Example 1": { "value": { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } } } } } } }, "description": "Updates an existing information request for an audit, allowing modification of request\ndetails as audit requirements evolve. Supports partial updates where only specified\nfields are changed; omitted fields remain unchanged.\n\nCommon use cases:\n- Updating due dates as audit timelines shift\n- Refining descriptions to clarify requirements\n- Adjusting request type\n\nNote: The `modificationDate` is automatically updated to the current timestamp\nwhen any field is changed.\n\nRate limit: 50 requests / minute.", "summary": "Update an information request for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PartialUpdateInformationRequest" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "UpdateInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.updateInformationRequest({\n auditId: \"\",\n requestId: \"\",\n partialUpdateInformationRequest: {},\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "UpdateInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.PartialUpdateInformationRequest;\nimport com.vanta.vanta_auditor_api.models.operations.UpdateInformationRequestResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n UpdateInformationRequestResponse res = sdk.audits().updateInformationRequest()\n .auditId(\"\")\n .requestId(\"\")\n .partialUpdateInformationRequest(PartialUpdateInformationRequest.builder()\n .build())\n .call();\n\n if (res.informationRequest().isPresent()) {\n System.out.println(res.informationRequest().get());\n }\n }\n}" } ] }, "delete": { "operationId": "DeleteInformationRequest", "responses": { "204": { "description": "No content" } }, "description": "Deletes an information request for an audit. This performs a soft delete, marking\nthe request as deleted (setting `deletionDate`) while preserving it in the system\nfor audit history and compliance tracking.\n\nSoft deletion allows:\n- Maintaining complete audit trail of all requests ever created\n- Retrieving deleted requests via `changedSinceDate` for synchronization\n\nAfter deletion:\n- The request will not appear in normal list responses (without `changedSinceDate`)\n- The request's `deletionDate` field will be populated\n\nRate limit: 10 requests / minute.", "summary": "Delete an information request for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "DeleteInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n await vanta.audits.deleteInformationRequest({\n auditId: \"\",\n requestId: \"\",\n });\n\n\n}\n\nrun();" }, { "lang": "java", "label": "DeleteInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.DeleteInformationRequestResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n DeleteInformationRequestResponse res = sdk.audits().deleteInformationRequest()\n .auditId(\"\")\n .requestId(\"\")\n .call();\n\n // handle response\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/accept-evidence": { "post": { "operationId": "AcceptInformationRequestEvidence", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequest" }, "examples": { "Example 1": { "value": { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } } } } } } }, "description": "Accepts evidence for an information request, confirming that all submitted evidence\nmeets audit requirements. This action changes the request's approvalStatus to\nan approved state and creates an activity log entry.\n\nAcceptance workflow:\n1. Auditor reviews submitted evidence\n2. If evidence is satisfactory, auditor calls this endpoint\n3. Request status changes to approved state and is considered complete for this audit cycle\n\nUse this endpoint when:\n- All required evidence has been submitted\n- Evidence quality meets audit standards\n- Evidence addresses all specified framework codes\n- No additional information is needed\n\nRate limit: 50 requests / minute.", "summary": "Accept evidence for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AcceptInformationRequestEvidenceInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "AcceptInformationRequestEvidence", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.acceptInformationRequestEvidence({\n auditId: \"\",\n requestId: \"\",\n acceptInformationRequestEvidenceInput: {\n auditorEmail: \"\",\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "AcceptInformationRequestEvidence", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.AcceptInformationRequestEvidenceInput;\nimport com.vanta.vanta_auditor_api.models.operations.AcceptInformationRequestEvidenceResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n AcceptInformationRequestEvidenceResponse res = sdk.audits().acceptInformationRequestEvidence()\n .auditId(\"\")\n .requestId(\"\")\n .acceptInformationRequestEvidenceInput(AcceptInformationRequestEvidenceInput.builder()\n .auditorEmail(\"\")\n .build())\n .call();\n\n if (res.informationRequest().isPresent()) {\n System.out.println(res.informationRequest().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/activity": { "get": { "operationId": "ListInformationRequestActivity", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_InformationRequestActivityLog_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "6650a7d13680f3b61a0cd3c1", "activityType": "CHANGE_STATUS", "timestamp": "2024-05-05T12:00:00.000Z", "userEmail": "user@example.com", "oldStatus": "NEEDS_EVIDENCE", "newStatus": "READY_FOR_AUDIT", "reason": "Status updated after review", "fillOutcome": null, "sourceInformationRequestId": null, "sourceAuditId": null } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "NjY1MGE3ZDEzNjgwZjNiNjFhMGNkM2Mx", "endCursor": "NjY1MGE3ZDEzNjgwZjNiNjFhMGNkM2Mx" } } } } } } } } }, "description": "Retrieves a paginated list of activity logs for an information request, providing\na complete audit trail of all changes and actions.\n\nThis endpoint supports delta synchronization via the `changedSinceDate` parameter,\nallowing efficient polling for changes without retrieving the entire dataset.\n\nPagination usage:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage` to see if more data exists\n3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request\n4. Repeat until `hasNextPage` is false\n\nDelta sync usage:\n1. Store the timestamp of your last sync\n2. Pass that timestamp as `changedSinceDate`\n3. Only activity created since that timestamp is returned\n4. Process updates to track all changes to the information request\n5. Update your last sync timestamp to the current time\n\nRate limit: 50 requests / minute.", "summary": "List information request activity", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of activity entries to return per page.", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from a previous response. Provide to fetch the next page of activity logs.", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes activity logs that have changed since changedSinceDate.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListInformationRequestActivity", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listInformationRequestActivity({\n auditId: \"\",\n requestId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListInformationRequestActivity", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListInformationRequestActivityRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListInformationRequestActivityResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListInformationRequestActivityRequest req = ListInformationRequestActivityRequest.builder()\n .auditId(\"\")\n .requestId(\"\")\n .build();\n\n ListInformationRequestActivityResponse res = sdk.audits().listInformationRequestActivity()\n .request(req)\n .call();\n\n if (res.paginatedResponseInformationRequestActivityLog().isPresent()) {\n System.out.println(res.paginatedResponseInformationRequestActivityLog().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/comments": { "get": { "operationId": "ListCommentsForInformationRequest", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_InformationRequestComment_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "Njg5MGU0NzNkY2UxZGE1Z", "endCursor": "Njg5MGU0NzNkY2UxZGE1Z" } } } } } } } } }, "description": "Retrieves a paginated list of comments for an information request, enabling\nauditors to view communication history and collaborate with customers.\n\nThis endpoint always includes soft-deleted records (where `deletionDate !== null`).\nClients should check the `deletionDate` field to identify and handle deleted records\nappropriately in their systems.\n\nThis endpoint supports delta synchronization via the `changedSinceDate` parameter,\nallowing efficient polling for changes without retrieving the entire dataset.\n\nPagination usage:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage` to see if more data exists\n3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request\n4. Repeat until `hasNextPage` is false\n\nDelta sync usage:\n1. Store the timestamp of your last sync\n2. Pass that timestamp as `changedSinceDate`\n3. Only comments created, modified, or deleted since that timestamp are returned\n4. Process updates, including soft-deletes (deletionDate !== null)\n5. Update your last sync timestamp to the current time\n\nRate limit: 50 requests / minute.", "summary": "List comments for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of comments to return per page.", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from a previous response. Provide to fetch the next page of comments.", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all comments that have changed since changedSinceDate.\nConsiders creationDate, modificationDate, and deletionDate timestamps when determining changes.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListCommentsForInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listCommentsForInformationRequest({\n auditId: \"\",\n requestId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListCommentsForInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListCommentsForInformationRequestRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListCommentsForInformationRequestResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListCommentsForInformationRequestRequest req = ListCommentsForInformationRequestRequest.builder()\n .auditId(\"\")\n .requestId(\"\")\n .build();\n\n ListCommentsForInformationRequestResponse res = sdk.audits().listCommentsForInformationRequest()\n .request(req)\n .call();\n\n if (res.paginatedResponseInformationRequestComment().isPresent()) {\n System.out.println(res.paginatedResponseInformationRequestComment().get());\n }\n }\n}" } ] }, "post": { "operationId": "CreateCommentForInformationRequest", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequestComment" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } } } } } } }, "description": "Creates a new comment for an information request. The comment author must be an auditor\nin the audit firm making the request. The comment will be associated with the information\nrequest and visible to all authorized users.\n\nRate limit: 50 requests / minute.", "summary": "Create a comment for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AddInformationRequestCommentInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "CreateCommentForInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.createCommentForInformationRequest({\n auditId: \"\",\n requestId: \"\",\n addInformationRequestCommentInput: {\n text: \"\",\n email: \"Daryl.Bartell38@gmail.com\",\n creationDate: new Date(\"2024-06-25T05:04:31.105Z\"),\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "CreateCommentForInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.AddInformationRequestCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.CreateCommentForInformationRequestResponse;\nimport java.lang.Exception;\nimport java.time.OffsetDateTime;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n CreateCommentForInformationRequestResponse res = sdk.audits().createCommentForInformationRequest()\n .auditId(\"\")\n .requestId(\"\")\n .addInformationRequestCommentInput(AddInformationRequestCommentInput.builder()\n .text(\"\")\n .email(\"Daryl.Bartell38@gmail.com\")\n .creationDate(OffsetDateTime.parse(\"2024-06-25T05:04:31.105Z\"))\n .build())\n .call();\n\n if (res.informationRequestComment().isPresent()) {\n System.out.println(res.informationRequestComment().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/comments/{commentId}": { "patch": { "operationId": "UpdateCommentForInformationRequest", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequestComment" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "text": "Some comment", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "deletionDate": "2024-03-07T21:25:56.000Z", "email": "vlad@vantaroo.com", "authorName": "Vlad Vantaroo" } } } } } } }, "description": "Updates an existing comment for an information request. Only the original author\nof the comment can update it. The author is identified by their email address,\nwhich must match the email of the user who created the comment.\n\nRate limit: 10 requests / minute.", "summary": "Update a comment for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "commentId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateInformationRequestCommentInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "UpdateCommentForInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.updateCommentForInformationRequest({\n auditId: \"\",\n requestId: \"\",\n commentId: \"\",\n updateInformationRequestCommentInput: {\n text: \"\",\n email: \"Gerald_Gusikowski36@yahoo.com\",\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "UpdateCommentForInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.UpdateInformationRequestCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.UpdateCommentForInformationRequestResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n UpdateCommentForInformationRequestResponse res = sdk.audits().updateCommentForInformationRequest()\n .auditId(\"\")\n .requestId(\"\")\n .commentId(\"\")\n .updateInformationRequestCommentInput(UpdateInformationRequestCommentInput.builder()\n .text(\"\")\n .email(\"Gerald_Gusikowski36@yahoo.com\")\n .build())\n .call();\n\n if (res.informationRequestComment().isPresent()) {\n System.out.println(res.informationRequestComment().get());\n }\n }\n}" } ] }, "delete": { "operationId": "DeleteCommentForInformationRequest", "responses": { "204": { "description": "No content" } }, "description": "Deletes an existing comment for an information request. Only the original author\nof the comment can delete it. The author is identified by their email address,\nwhich must match the email of the user who created the comment.\n\nRate limit: 10 requests / minute.", "summary": "Delete a comment for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "commentId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteInformationRequestCommentInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "DeleteCommentForInformationRequest", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n await vanta.audits.deleteCommentForInformationRequest({\n auditId: \"\",\n requestId: \"\",\n commentId: \"\",\n deleteInformationRequestCommentInput: {\n email: \"Ole.Adams@gmail.com\",\n },\n });\n\n\n}\n\nrun();" }, { "lang": "java", "label": "DeleteCommentForInformationRequest", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.DeleteInformationRequestCommentInput;\nimport com.vanta.vanta_auditor_api.models.operations.DeleteCommentForInformationRequestResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n DeleteCommentForInformationRequestResponse res = sdk.audits().deleteCommentForInformationRequest()\n .auditId(\"\")\n .requestId(\"\")\n .commentId(\"\")\n .deleteInformationRequestCommentInput(DeleteInformationRequestCommentInput.builder()\n .email(\"Ole.Adams@gmail.com\")\n .build())\n .call();\n\n // handle response\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/evidence": { "get": { "operationId": "ListInformationRequestEvidence", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_InformationRequestEvidence_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "6890e473dce1da5d8406f5e8", "evidenceType": "UPLOADED_DOCUMENT", "visibleToAuditorDate": "2025-10-16T12:00:00.000Z", "creationDate": "2025-10-15T10:30:00.000Z", "modificationDate": "2025-10-16T12:00:00.000Z", "deletionDate": null, "evidence": { "id": "6890e473dce1da5d8406f5ea", "filename": "security-policy.pdf", "mimeType": "application/pdf", "url": "https://example.com/presigned-url" } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4", "endCursor": "Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4" } } } } } } } } }, "description": "Retrieves a paginated list of all evidence attached to an information request,\nenabling auditors to review evidence submitted by customers.\n\nThis endpoint always includes soft-deleted records (where `deletionDate !== null`).\nClients should check the `deletionDate` field to identify and handle deleted records\nappropriately in their systems.\n\nThis endpoint supports delta synchronization via the `changedSinceDate` parameter,\nallowing efficient polling for changes without retrieving the entire dataset.\n\nPagination usage:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage` to see if more data exists\n3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request\n4. Repeat until `hasNextPage` is false\n\nDelta sync usage:\n1. Store the timestamp of your last sync\n2. Pass that timestamp as `changedSinceDate`\n3. Only evidence created, modified, shared, or deleted since that timestamp is returned\n4. Process updates, including soft-deletes (deletionDate !== null)\n5. Update your last sync timestamp to the current time\n\nRate limit: 50 requests / minute.", "summary": "List evidence for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of evidence entries to return per page.", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from a previous response. Provide to fetch the next page of evidence.", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Includes all evidence that have changed since changedSinceDate. Considers creationDate,\nmodificationDate, deletionDate, and visibleToAuditorDate timestamps when determining changes.", "in": "query", "name": "changedSinceDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Limits results to the provided evidence types. Must include at least one of:\nUPLOADED_DOCUMENT, OBSERVATION, LINK, VANTA_DOCUMENT, VANTA_POLICY, VANTA_TEST,\nVANTA_TEST_SNAPSHOT.", "in": "query", "name": "evidenceTypeMatchesAny", "required": false, "schema": { "default": [], "type": "array", "items": { "$ref": "#/components/schemas/InformationRequestSupportedEvidenceType" } } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListInformationRequestEvidence", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listInformationRequestEvidence({\n auditId: \"\",\n requestId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListInformationRequestEvidence", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListInformationRequestEvidenceRequest req = ListInformationRequestEvidenceRequest.builder()\n .auditId(\"\")\n .requestId(\"\")\n .build();\n\n ListInformationRequestEvidenceResponse res = sdk.audits().listInformationRequestEvidence()\n .request(req)\n .call();\n\n if (res.paginatedResponseInformationRequestEvidence().isPresent()) {\n System.out.println(res.paginatedResponseInformationRequestEvidence().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/evidence/{evidenceId}/test-snapshot": { "get": { "operationId": "GetInformationRequestTestSnapshotEvidenceDetail", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VantaTestSnapshotEvidenceDetail" }, "examples": { "Example 1": { "value": { "testId": "test.okta.account-creation", "testName": "Okta user provisioning test", "description": "Verify Okta user accounts are created via SSO.", "evaluationCriteria": "Confirms that all human user accounts in Okta were provisioned via the SSO workflow.", "integrations": [ { "integrationId": "okta", "displayName": "Okta" } ], "slaRemediation": { "id": "sla-30d", "settings": { "numericValue": 30, "unit": "DAYS" } }, "rawTestData": [ { "resourceId": "6890e473dce1da5d8406f700", "resourceType": "OktaUser", "rawJson": { "id": "6890e473dce1da5d8406f700", "status": "ACTIVE" } } ], "outOfScopeResources": { "testLevel": [ { "reason": "Disabled by customer", "entities": [ { "id": "6890e473dce1da5d8406f701", "displayName": "service-account@example.com" } ] } ], "frameworkLevel": [] }, "apiRequests": [ { "id": "6890e473dce1da5d8406f702", "resourceType": "OktaUser", "resourceTypeDisplayName": "Okta User", "requestMethod": "GET", "url": "https://dev-123456.okta.com/api/v1/users", "responseCode": 200, "timestamp": "2025-01-15T10:30:00.000Z", "dataTooLarge": false } ] } } } } } } }, "description": "Retrieves the rich detail for a single VANTA_TEST_SNAPSHOT evidence row\nattached to an information request. The response includes test-level\nmetadata (description, integrations, SLA), the raw test data captured\nat snapshot time, and the resources that were excluded from the test\n(out-of-scope resources).\n\nFor structured snapshots, the `rawTestData` array contains one row per\nresource the test ran against; each row carries `resourceId`,\n`resourceType`, and the raw JSON for that resource.\n\nFor unstructured snapshots, the `rawTestData` array contains a single\nrow with `resourceId` and `resourceType` set to `null` and `rawJson`\ncontaining the entire test-run JSON blob.\n\nThe `outOfScopeResources` field lists resources excluded at the test\nlevel (customer-disabled) and the framework level (segment\nconfiguration). Empty exclusion groups are filtered out.\n\nThe `apiRequests` array contains the HTTP requests captured during API\nintrospection tests. Empty when the test does not perform API\nintrospection.\n\nRate limit: 10 requests / minute.", "summary": "Get test snapshot detail for an evidence row", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "evidenceId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "GetInformationRequestTestSnapshotEvidenceDetail", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getInformationRequestTestSnapshotEvidenceDetail({\n auditId: \"\",\n requestId: \"\",\n evidenceId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "GetInformationRequestTestSnapshotEvidenceDetail", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.GetInformationRequestTestSnapshotEvidenceDetailResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n GetInformationRequestTestSnapshotEvidenceDetailResponse res = sdk.audits().getInformationRequestTestSnapshotEvidenceDetail()\n .auditId(\"\")\n .requestId(\"\")\n .evidenceId(\"\")\n .call();\n\n if (res.vantaTestSnapshotEvidenceDetail().isPresent()) {\n System.out.println(res.vantaTestSnapshotEvidenceDetail().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/information-requests/{requestId}/flag-evidence": { "post": { "operationId": "FlagInformationRequestEvidence", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InformationRequest" }, "examples": { "Example 1": { "value": { "id": "6890e473dce1da5d8406f5e7", "uniqueId": "1466132", "additionalControlIds": [], "approvalStatus": "NEEDS_EVIDENCE", "cadence": "ANNUALLY", "frameworkCodes": [ "SOC2_CC6.1" ], "description": "Provide the data deletion evidence for a sample of terminated customers", "dueDate": "2025-10-28T00:00:00.000Z", "evidenceCaptureDate": "2025-10-28T00:00:00.000Z", "requestId": null, "requestType": "SAMPLE", "title": "Terminated Customer Deletion Evidence", "creationDate": "2025-08-01T12:34:56.000Z", "modificationDate": "2025-08-02T08:00:00.000Z", "deletionDate": null, "ownerAssignment": { "type": "user", "id": "507f1f77bcf86cd799439011", "displayName": "John Doe" } } } } } } } }, "description": "Flags evidence for an information request when it doesn't meet audit requirements,\nmarking issues that need to be addressed before approval. This action changes the\nrequest's approvalStatus to a flagged state and creates an activity log entry.\n\nFlagging workflow:\n1. Auditor reviews submitted evidence\n2. If issues are found, auditor calls this endpoint with detailed reason\n3. Request status changes to flagged state\n4. Customer is notified and can see the reason in activity logs\n5. Customer addresses issues and updates evidence\n6. When ready, customer changes status back to awaiting review\n7. Auditor reviews again and either flags again or accepts\n\nThe `reason` field should clearly explain what's missing or incorrect so the\ncustomer knows exactly what to fix. This reason is visible to the customer\nand appears in the activity log.\n\nRate limit: 50 requests / minute.", "summary": "Flag evidence for an information request", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "requestId", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FlagInformationRequestEvidenceInput" } } } }, "x-codeSamples": [ { "lang": "typescript", "label": "FlagInformationRequestEvidence", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.flagInformationRequestEvidence({\n auditId: \"\",\n requestId: \"\",\n flagInformationRequestEvidenceInput: {\n auditorEmail: \"\",\n reason: \"\",\n },\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "FlagInformationRequestEvidence", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.components.FlagInformationRequestEvidenceInput;\nimport com.vanta.vanta_auditor_api.models.operations.FlagInformationRequestEvidenceResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n FlagInformationRequestEvidenceResponse res = sdk.audits().flagInformationRequestEvidence()\n .auditId(\"\")\n .requestId(\"\")\n .flagInformationRequestEvidenceInput(FlagInformationRequestEvidenceInput.builder()\n .auditorEmail(\"\")\n .reason(\"\")\n .build())\n .call();\n\n if (res.informationRequest().isPresent()) {\n System.out.println(res.informationRequest().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/integrations": { "get": { "operationId": "ListIntegrations", "responses": { "200": { "description": "Paginated list of integrations with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AuditIntegration_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "github", "endCursor": "github" }, "data": [ { "id": "github", "name": "GitHub", "tags": [ "Vulnerabilities", "Code changes" ], "categories": [ "Version control systems" ] } ] } } } } } } } }, "description": "Retrieves integration population data for an audit.\n\nThis endpoint provides access to integration records visible to auditors\nduring an audit engagement. Integrations represent connected services\n(e.g., GitHub, AWS, Slack) that provide data for the audit.\n\nSupports filtering by:\n- `search`: Searches integration names (case-insensitive)\n- `tagsMatchesAny`: Filters by integration tag (ACCESS, COMPUTERS, etc.)\n- `categoriesMatchesAny`: Filters by category (CLOUD_PROVIDER, HR_PROVIDER, etc.)\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nResults are sorted by integration display name (ascending). This sort order\nis fixed and cannot be customized via query parameters.\n\nRate limit: 10 requests / minute.", "summary": "List integrations for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by integration name", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Filter integrations by tag values", "in": "query", "name": "tagsMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AuditIntegrationTag" } } }, { "description": "Filter integrations by category values", "in": "query", "name": "categoriesMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AuditIntegrationCategory" } } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListIntegrations", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listIntegrations({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListIntegrations", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListIntegrationsRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListIntegrationsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListIntegrationsRequest req = ListIntegrationsRequest.builder()\n .auditId(\"\")\n .build();\n\n ListIntegrationsResponse res = sdk.audits().listIntegrations()\n .request(req)\n .call();\n\n if (res.paginatedResponseAuditIntegration().isPresent()) {\n System.out.println(res.paginatedResponseAuditIntegration().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/issues/items": { "get": { "operationId": "ListAuditIssues", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedIssueSnapshotItemsResponse" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": null, "endCursor": null }, "data": [ { "id": "5f2c939a52855e725c8d5824", "title": "User accounts with weak passwords", "readableIssueId": "ISS-1234", "issueId": "5f2c939a52855e725c8d5825", "description": "The following user accounts have passwords that do not meet the company's password policy: [list of accounts]. Weak passwords increase the risk of unauthorized access to systems and data.", "snapshotId": "5f2c939a52855e725c8d5823", "dueDate": "2023-12-31T23:59:59.000Z", "status": "CLOSED", "lastModifiedAt": "2024-06-15T10:30:00.000Z", "createdAt": "2024-06-01T09:00:00.000Z", "detectedAt": "2024-05-30T14:45:00.000Z" } ] } } } } } } } }, "description": "Retrieves a list of all issues that have been shared with an audit.\n\nThe issues returned are immutable, point-in-time snapshots; there may be duplicates of issues that have been snapshotted at different times.\nThe GET /audits/{auditId}/issues/snapshots endpoint can be used to retrieve metadata about the snapshots that issues belong to.\nIssues represent compliance findings from a variety of sources that need to be tracked and remediated.\n\nSupports filtering by:\n- `search`: full text search across issue title and description\n- `snapshotId`: filtering to a specific snapshot or snapshots, which represent point-in-time captures of issues. Use the GET /audits/{auditId}/issues/snapshots endpoint to retrieve snapshot IDs and metadata.\n- `createdAfterDate` / `createdBeforeDate`: filter to issues created within a date range (inclusive)\n- `detectedAfterDate` / `detectedBeforeDate`: filter to issues detected within a date range (inclusive)\n\nResults are sorted by issue creation date in descending order (newest first) by default.\nUse `orderBy` and `orderDirection` to customize sorting.\nSort parameters must remain consistent across paginated requests.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List snapshotted issues for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by issue title and description", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Filter issues to specific snapshots by snapshot ID", "in": "query", "name": "snapshotIdMatchesAny", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "description": "Filter to issues created on or after this date (ISO 8601)", "in": "query", "name": "createdAfterDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter to issues created on or before this date (ISO 8601)", "in": "query", "name": "createdBeforeDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter to issues detected on or after this date (ISO 8601)", "in": "query", "name": "detectedAfterDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter to issues detected on or before this date (ISO 8601)", "in": "query", "name": "detectedBeforeDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Field to sort results by. Allowed: \"createdAt\", \"lastModifiedAt\", \"detectedAt\". Default: \"createdAt\"", "in": "query", "name": "orderBy", "required": false, "schema": { "$ref": "#/components/schemas/IssueSnapshotItemOrderBy" } }, { "description": "Sort direction: \"asc\" or \"desc\". Default: \"desc\"", "in": "query", "name": "orderDirection", "required": false, "schema": { "$ref": "#/components/schemas/OrderDirection" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditIssues", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listAuditIssues({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditIssues", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditIssuesRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditIssuesResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditIssuesRequest req = ListAuditIssuesRequest.builder()\n .auditId(\"\")\n .build();\n\n ListAuditIssuesResponse res = sdk.audits().listAuditIssues()\n .request(req)\n .call();\n\n if (res.paginatedIssueSnapshotItemsResponse().isPresent()) {\n System.out.println(res.paginatedIssueSnapshotItemsResponse().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/issues/snapshots": { "get": { "operationId": "ListAuditSnapshots", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedIssueSnapshotMetadataResponse" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": null, "endCursor": null }, "data": [ { "id": "5f2c939a52855e725c8d5823", "title": "Snapshot taken on 2024-06-01T00:00:00Z", "description": "This snapshot captures all open issues as of June 1st, 2024.", "createdAt": "2024-06-01T00:00:00.000Z" } ] } } } } } } } }, "description": "Retrieves a list of snapshots that have been shared with an audit.\n\nThe snapshots returned contain metadata about point-in-time captures of issues for an audit.\nThis data can be used to filter down the list of issues to specific snapshots when querying the GET /audits/{auditId}/issues/items endpoint.\n\nSupports filtering by:\n- `search`: full text search across snapshot title and description\n\nResults are sorted by snapshot creation date in descending order (newest first).\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List snapshotted issues for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by snapshot title and description", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditSnapshots", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listAuditSnapshots({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditSnapshots", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditSnapshotsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditSnapshotsResponse res = sdk.audits().listAuditSnapshots()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedIssueSnapshotMetadataResponse().isPresent()) {\n System.out.println(res.paginatedIssueSnapshotMetadataResponse().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/managed-vendors": { "get": { "operationId": "ListVendors", "responses": { "200": { "description": "Paginated list of vendors with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AuditVendor_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "5f2c939a52855e725c8d5824", "endCursor": "5f2c939a52855e725c8d5824" }, "data": [ { "id": "5f2c939a52855e725c8d5824", "name": "Acme Corp", "vendorCategory": "SaaS", "inherentRisk": "HIGH", "status": "ACTIVE", "findings": 3, "lastReviewedCompleted": "2025-01-15T10:00:00.000Z", "nextSecurityReviewDueDate": "2025-07-15T10:00:00.000Z", "residualRisk": "HIGH", "dataAgreements": { "complete": 1, "total": 2 } } ] } } } } } } } }, "description": "Retrieves vendor population data for an audit.\n\nThis endpoint provides access to vendor records visible to auditors\nduring an audit engagement.\n\nSupports filtering by:\n- `search`: Searches vendor names (case-insensitive)\n- `vendorStatusesMatchesAny`: Filters by vendor status (ACTIVE, ARCHIVED, IN_PROCUREMENT)\n- `inherentRiskMatchesAny`: Filters by inherent risk level\n\nResults are sorted by name (ascending) by default.\nUse `orderBy` and `orderDirection` to customize sorting.\nSort parameters must remain consistent across paginated requests.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List vendors for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by vendor name", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Filter vendors by status values", "in": "query", "name": "vendorStatusesMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AuditVendorStatus" } } }, { "description": "Filter vendors by inherent risk level values", "in": "query", "name": "inherentRiskMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/AuditVendorRiskLevel" } } }, { "description": "Field to sort results by. Allowed: \"name\", \"inherentRisk\". Default: \"name\"", "in": "query", "name": "orderBy", "required": false, "schema": { "$ref": "#/components/schemas/VendorOrderBy" } }, { "description": "Sort direction: \"asc\" or \"desc\". Default: \"asc\"", "in": "query", "name": "orderDirection", "required": false, "schema": { "$ref": "#/components/schemas/OrderDirection" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListVendors", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listVendors({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListVendors", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListVendorsRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListVendorsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListVendorsRequest req = ListVendorsRequest.builder()\n .auditId(\"\")\n .build();\n\n ListVendorsResponse res = sdk.audits().listVendors()\n .request(req)\n .call();\n\n if (res.paginatedResponseAuditVendor().isPresent()) {\n System.out.println(res.paginatedResponseAuditVendor().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/monitored-computers": { "get": { "operationId": "ListMonitoredComputersInAuditScope", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_MonitoredComputer_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "5f2c939a52855e725c8d5823", "integrationId": "vantaAgent", "serialNumber": "FVFGPGV2Q6L5", "udid": "280FF071-1D7A-5752-BD3A-1A68937CD187", "lastCheckDate": "2024-03-07T18:46:05.944Z", "screenlock": { "outcome": "FAIL" }, "diskEncryption": { "outcome": "FAIL" }, "passwordManager": { "outcome": "FAIL" }, "antivirusInstallation": { "outcome": "FAIL" }, "operatingSystem": { "type": "macOS", "version": "13.2.1" }, "owner": { "id": "65e1efde08e8478f143a8ff9", "emailAddress": "example-person@email.com", "displayName": "Example Owner" } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "5f2c939a52855e725c8d5823", "endCursor": "5f2c939a52855e725c8d5823" } } } } } } } } }, "description": "Returns a list of computers monitored by an MDM (with an integration built\nby Vanta) or by Vanta Device Monitor. Currently this list does not include\nresources from partner or customer-built integrations.\n\nEnd of life — this endpoint works for classic audits only; it does not support\ncontrolled audit view. It remains available for existing classic audits but will be removed once\nclassic audits are fully phased out, so do not build new integrations on it.\n\nRate limit: 10 requests / minute.", "summary": "List monitored computers", "tags": [ "Audits" ], "deprecated": true, "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Filters for monitored computers matching any status declared in the filter.", "in": "query", "name": "complianceStatusFilterMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ComputerStatusFilter" } } } ] } }, "/audits/{auditId}/organization/information": { "get": { "operationId": "GetOrganizationInformation", "responses": { "200": { "description": "Organization information record", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditOrganizationInformation" }, "examples": { "Example 1": { "value": { "id": "5f2c939a52855e725c8d5824", "displayName": "Acme Corp", "legalName": "Acme Corporation Inc.", "incorporation": "Incorporated in the United States", "url": "https://acme.example.com", "mailingAddress": "123 Main St, San Francisco, CA 94105", "telephone": "+1-555-123-4567", "companyLogo": { "url": "https://storage.example.com/logos/acme.png" } } } } } } } }, "description": "Retrieves organization information for an audit.\n\nThis endpoint returns a single record containing the organization's\nbusiness information visible to auditors during an audit engagement.\n\nSorting and pagination are not applicable.\n\nRate limit: 10 requests / minute.", "summary": "Get organization information for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "GetOrganizationInformation", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getOrganizationInformation({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "GetOrganizationInformation", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.GetOrganizationInformationResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n GetOrganizationInformationResponse res = sdk.audits().getOrganizationInformation()\n .auditId(\"\")\n .call();\n\n if (res.auditOrganizationInformation().isPresent()) {\n System.out.println(res.auditOrganizationInformation().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/organization/notifications": { "get": { "operationId": "GetOrganizationNotifications", "responses": { "200": { "description": "Organization notifications record", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditOrganizationNotifications" }, "examples": { "Example 1": { "value": { "id": "5f2c939a52855e725c8d5824", "preferredTimeZone": "America/New_York", "employeeDigestFrequency": "WEEKLY", "subscribedChannelTypes": [ "EMAIL" ], "externalNotifications": [ { "id": "65fa1b2c3d4e5f6789012345", "address": "hr-alerts@acme.example.com", "cadence": "WEEKLY", "unsubSettingsKey": "SUMMARY_EMPLOYEE", "toggleIsSubscribed": true }, { "id": "65fa1b2c3d4e5f6789012346", "address": "security@acme.example.com", "cadence": null, "unsubSettingsKey": "TRUST_REPORT_ACCESS_REQUEST_EMAIL", "toggleIsSubscribed": true } ] } } } } } } }, "description": "Retrieves organization notification settings for an audit.\n\nThis endpoint returns a single record containing the auditee\norganization's notification configuration — schedule, personnel\nreminder settings, and external notification subscriptions\n(Compliance, Vendors, Access Reviews, Trust Center).\n\nThe response is a single aggregate object per domain. Sorting and\npagination are not applicable. Under a controlled audit view\n(TRIMMED_DOWN), only CAV-approved fields are included.\n\nRate limit: 10 requests / minute.", "summary": "Get organization notification settings for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "GetOrganizationNotifications", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.getOrganizationNotifications({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "GetOrganizationNotifications", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.GetOrganizationNotificationsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n GetOrganizationNotificationsResponse res = sdk.audits().getOrganizationNotifications()\n .auditId(\"\")\n .call();\n\n if (res.auditOrganizationNotifications().isPresent()) {\n System.out.println(res.auditOrganizationNotifications().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/people": { "get": { "operationId": "ListPeopleInAuditScope", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Person_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "65e1efde08e8478f143a8ff9", "userId": "65e1efde08e8478f143a9001", "emailAddress": "example-person@email.com", "employment": { "endDate": null, "jobTitle": "Customer success manager", "startDate": "2021-01-01T00:00:00.000Z", "status": "CURRENT" }, "leaveInfo": null, "groupIds": [ "5f2c939a52855e725c8d5824" ], "name": { "display": "Example Person", "last": "Person", "first": "Example" }, "sources": { "emailAddress": { "integrationId": "gsuiteadmin", "resourceId": "660c701d3d344e660b032306", "type": "INTEGRATION" }, "employment": { "startDate": { "integrationId": "gusto", "resourceId": "660c70783d344e660b032323", "type": "INTEGRATION" }, "endDate": { "integrationId": "gusto", "resourceId": "660c70783d344e660b032323", "type": "INTEGRATION" } } }, "tasksSummary": { "completionDate": null, "dueDate": "2021-12-01T00:00:00.000Z", "status": "OVERDUE", "details": { "completeTrainings": { "taskType": "COMPLETE_TRAININGS", "status": "COMPLETE", "dueDate": "2021-12-01T00:00:00.000Z", "completionDate": "2021-11-01T00:00:00.000Z", "disabled": { "date": "2021-11-01T00:00:00.000Z", "reason": "Training Vanta tests have been disabled for this person" }, "incompleteTrainings": [ { "name": "Security training 1" }, { "name": "Security training 2" } ], "completedTrainings": [ { "name": "Security training 3" }, { "name": "Security training 4" } ] }, "acceptPolicies": { "taskType": "ACCEPT_POLICIES", "status": "COMPLETE", "dueDate": "2021-12-01T00:00:00.000Z", "completionDate": "2021-11-01T00:00:00.000Z", "disabled": null, "unacceptedPolicies": [ { "name": "Policy 1" }, { "name": "Policy 2" } ], "acceptedPolicies": [ { "name": "Policy 3" }, { "name": "Policy 4" } ] }, "completeCustomTasks": { "taskType": "COMPLETE_CUSTOM_TASKS", "status": "OVERDUE", "dueDate": "2021-12-01T00:00:00.000Z", "completionDate": "2021-11-01T00:00:00.000Z", "disabled": { "date": "2021-11-01T00:00:00.000Z", "reason": "Custom task Vanta tests have been disabled for this person" }, "incompleteCustomTasks": [ { "name": "Custom task 1" }, { "name": "Custom task 2" } ], "completedCustomTasks": [ { "name": "Custom task 3" }, { "name": "Custom task 4" } ] }, "completeOffboardingCustomTasks": { "taskType": "COMPLETE_CUSTOM_OFFBOARDING_TASKS", "status": "COMPLETE", "dueDate": "2021-12-01T00:00:00.000Z", "completionDate": "2021-11-01T00:00:00.000Z", "disabled": null, "incompleteCustomOffboardingTasks": [], "completedCustomOffboardingTasks": [ { "name": "Custom offboarding task 1" }, { "name": "Custom offboarding task 2" } ] }, "installDeviceMonitoring": { "taskType": "INSTALL_DEVICE_MONITORING", "status": "DUE_SOON", "dueDate": "2021-12-01T00:00:00.000Z", "completionDate": null, "disabled": null }, "completeBackgroundChecks": { "taskType": "COMPLETE_BACKGROUND_CHECKS", "status": "COMPLETE", "dueDate": "2021-12-01T00:00:00.000Z", "completionDate": "2021-11-01T00:00:00.000Z", "disabled": null } } } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "65e1efde08e8478f143a8ff9", "endCursor": "65e1efde08e8478f143a8ff9" } } } } } } } } }, "description": "Returns a list of people who are in scope for this audit.\n\nEnd of life — this endpoint works for classic audits only; it does not support\ncontrolled audit view. It remains available for existing classic audits but will be removed once\nclassic audits are fully phased out, so do not build new integrations on it.\n\nRate limit: 10 requests / minute.", "summary": "List of people who are in scope for this audit", "tags": [ "Audits" ], "deprecated": true, "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Filter individuals by those whose tasksSummary status is any of the provided values.", "in": "query", "name": "tasksSummaryStatusMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/TasksSummaryStatus" } } }, { "description": "Requires taskStatusMatchesAny. Includes all people for whom any of the provided taskType values in taskTypeMatchesAny\nis any of the provided taskStatus values in taskStatusMatchesAny.", "in": "query", "name": "taskTypeMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/TaskType" } } }, { "description": "Requires taskTypeMatchesAny. Includes all people for whom any of the provided taskType values in taskTypeMatchesAny\nis any of the provided taskStatus values in taskStatusMatchesAny.", "in": "query", "name": "taskStatusMatchesAny", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/TaskStatus" } } } ] } }, "/audits/{auditId}/personnel/account-access/services": { "get": { "operationId": "ListAccountAccessServices", "responses": { "200": { "description": "Paginated list of connected account access services", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AccountAccessService_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": null, "endCursor": null }, "data": [ { "id": "68d17609e79bc56dbe798eac", "credentialDisplayName": "Okta - Production", "subAccountId": null, "service": "okta" } ] } } } } } } } }, "description": "Retrieves connected account access services for an audit.\n\nReturns the list of identity providers and access integrations (such as\nOkta, Azure AD, Google Workspace, AWS IAM) that are connected to the\norganization and provide account access data for personnel.\n\nThese integrations are used to verify user access and identity management\nduring an audit engagement.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nResults are returned in connection order. Sort order is not guaranteed\nand cannot be customized via query parameters.\n\nRate limit: 10 requests / minute.", "summary": "List account access services for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListAccountAccessServices", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listAccountAccessServices({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAccountAccessServices", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAccountAccessServicesResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAccountAccessServicesResponse res = sdk.audits().listAccountAccessServices()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseAccountAccessService().isPresent()) {\n System.out.println(res.paginatedResponseAccountAccessService().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/personnel/account-access/{serviceId}": { "get": { "operationId": "ListPersonnelAccountAccess", "responses": { "200": { "description": "Paginated list of account access records with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AccountAccess_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": null, "endCursor": null }, "data": [ { "id": "5f2c939a52855e725c8d5824", "accountName": "john.doe@example.com", "owner": "John Doe", "role": [ "Admin" ], "status": "ACTIVE", "mfa": true, "createdDate": "2024-01-15T10:30:00.000Z", "deactivatedDate": null } ] } } } } } } } }, "description": "Retrieves account access population data for an audit.\n\nThis endpoint provides access to account access records visible to auditors\nduring an audit engagement. Account access data comes from various sources:\n\n- **IDP Services** (Identity Providers): Okta, Azure AD, Google Workspace, OneLogin, PingOne\n\n - Returns user accounts from identity providers\n - Supports filtering by search and status\n\n- **Role Grants Services**: GCP, Azure (when role grants are enabled)\n\n - Returns accounts with role-based access grants\n - Supports filtering by search and status\n\n- **First-Party Account Services**: AWS, Oracle Cloud, Azure (when not using role grants), etc.\n\n - Returns cloud provider account access records\n - Supports filtering by search and status\n\n- **Received Account Services**: External applications (Jira, GitHub, Slack, etc.)\n\n - Returns user accounts from third-party integrations\n - Supports filtering by search and status\n\n\nSupports filtering by:\n- `search`: Searches account names/emails (case-insensitive)\n- `status`: Filters by account status\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nThe default sort order depends on the service type:\n- Identity provider services (e.g. Okta, Azure AD): sorted by email, ascending\n- Cloud provider services (e.g. AWS, GCP): sorted by account name, ascending\n- Role grant services: sorted by account name, ascending\n- Third-party application services (e.g. GitHub, Jira): sorted by account name, ascending\n\nSort order cannot be customized via query parameters.\n\nRate limit: 10 requests / minute.", "summary": "List account access records for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "The service ID from the /services endpoint", "in": "path", "name": "serviceId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by account name or email", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Filter by account status", "in": "query", "name": "status", "required": false, "schema": { "$ref": "#/components/schemas/AccountAccessStatus" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListPersonnelAccountAccess", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listPersonnelAccountAccess({\n auditId: \"\",\n serviceId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListPersonnelAccountAccess", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListPersonnelAccountAccessRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListPersonnelAccountAccessResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListPersonnelAccountAccessRequest req = ListPersonnelAccountAccessRequest.builder()\n .auditId(\"\")\n .serviceId(\"\")\n .build();\n\n ListPersonnelAccountAccessResponse res = sdk.audits().listPersonnelAccountAccess()\n .request(req)\n .call();\n\n if (res.paginatedResponseAccountAccess().isPresent()) {\n System.out.println(res.paginatedResponseAccountAccess().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/personnel/groups": { "get": { "operationId": "ListPersonnelGroups", "responses": { "200": { "description": "Paginated list of groups with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_PersonnelGroup_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "5f2c939a52855e725c8d5824", "endCursor": "5f2c939a52855e725c8d5824" }, "data": [ { "id": "5f2c939a52855e725c8d5824", "name": "Engineering", "members": 42, "source": "Okta", "tasks": [ { "name": "Security Training" }, { "name": "Policy Acceptance" } ], "tasksLastUpdated": "2024-06-15T10:30:00.000Z", "pointOfContact": "Jane Doe" } ] } } } } } } } }, "description": "Retrieves groups population data for an audit.\n\nThis endpoint provides access to the group records visible to auditors\nduring an audit engagement. Groups represent organizational units that\ncontain people, either imported from an identity provider (IDP) or\ncreated manually in Vanta.\n\nOnly Controlled Audit View (CAV) audits are supported. Full Audit\nView audits are rejected with 403.\n\nSupports filtering by:\n- `search`: Searches group names (case-insensitive)\n- `sourcesMatchesAny`: Filters by IDP source service names\n\nResults are sorted by name (ascending) by default.\nUse `orderBy` and `orderDirection` to customize sorting.\nSort parameters must remain consistent across paginated requests.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List groups for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by group name", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Filter groups by IDP source service names", "in": "query", "name": "sourcesMatchesAny", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "description": "Field to sort results by. Allowed: \"name\", \"members\", \"source\", \"tasksLastUpdated\", \"pointOfContact\". Default: \"name\"", "in": "query", "name": "orderBy", "required": false, "schema": { "$ref": "#/components/schemas/GroupOrderBy" } }, { "description": "Sort direction: \"asc\" or \"desc\". Default: \"asc\"", "in": "query", "name": "orderDirection", "required": false, "schema": { "$ref": "#/components/schemas/OrderDirection" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListPersonnelGroups", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listPersonnelGroups({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListPersonnelGroups", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListPersonnelGroupsRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListPersonnelGroupsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListPersonnelGroupsRequest req = ListPersonnelGroupsRequest.builder()\n .auditId(\"\")\n .build();\n\n ListPersonnelGroupsResponse res = sdk.audits().listPersonnelGroups()\n .request(req)\n .call();\n\n if (res.paginatedResponsePersonnelGroup().isPresent()) {\n System.out.println(res.paginatedResponsePersonnelGroup().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/personnel/people": { "get": { "operationId": "ListPersonnelPeople", "responses": { "200": { "description": "Paginated list of people with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_PersonnelPerson_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "person_12345", "endCursor": "person_12345" }, "data": [ { "id": "person_12345", "name": "John Doe", "email": "john.doe@example.com", "jobTitle": "Software Engineer", "employmentStatus": "CURRENTLY_EMPLOYED", "startDate": "2021-01-15", "endDate": null, "groups": [ { "name": "Engineering" }, { "name": "Admin" } ], "source": { "mainSource": "Okta", "supplementarySource": "Google Workspace" }, "taskStatus": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20", "numTasksCompleted": null, "numTasksOverdue": null, "numTasksDueSoon": null }, "lastReminded": "2024-01-15", "policies": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20" }, "trainings": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20" }, "backgroundChecks": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20" }, "deviceMonitoring": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20" }, "customOnboarding": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20" }, "customOffboarding": { "status": "SECURITY_TASKS_COMPLETE", "dueDate": "2024-03-15", "completionDate": "2024-01-20" } } ] } } } } } } } }, "description": "Retrieves people population data for an audit.\n\nThis endpoint provides access to the people records visible to auditors\nduring an audit engagement. Only Controlled Audit View (CAV) audits\nare supported. Full Audit View audits are rejected with 403.\n\nSupports filtering by:\n- `search`: Searches names and email addresses\n- `status`: Filters by employment status\n- `groupsMatchesAny`: Filter people by group/role IDs\n\nResults are sorted by name (ascending) by default.\nUse `orderBy` and `orderDirection` to customize sorting.\nSort parameters must remain consistent across paginated requests.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List people for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by name or email", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Employment status filter", "in": "query", "name": "status", "required": false, "schema": { "$ref": "#/components/schemas/PeopleEmploymentStatus" } }, { "description": "Filter people by group IDs", "in": "query", "name": "groupsMatchesAny", "required": false, "schema": { "type": "array", "items": { "type": "string" } } }, { "description": "Field to sort results by. Allowed: \"name\", \"employmentStatus\". Default: \"name\"", "in": "query", "name": "orderBy", "required": false, "schema": { "$ref": "#/components/schemas/PeopleOrderBy" } }, { "description": "Sort direction: \"asc\" or \"desc\". Default: \"asc\"", "in": "query", "name": "orderDirection", "required": false, "schema": { "$ref": "#/components/schemas/OrderDirection" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListPersonnelPeople", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listPersonnelPeople({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListPersonnelPeople", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListPersonnelPeopleRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListPersonnelPeopleResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListPersonnelPeopleRequest req = ListPersonnelPeopleRequest.builder()\n .auditId(\"\")\n .build();\n\n ListPersonnelPeopleResponse res = sdk.audits().listPersonnelPeople()\n .request(req)\n .call();\n\n if (res.paginatedResponsePersonnelPerson().isPresent()) {\n System.out.println(res.paginatedResponsePersonnelPerson().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/risks/snapshots": { "get": { "operationId": "ListRiskSnapshots", "responses": { "200": { "description": "Paginated list of risk snapshots with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_RiskSnapshot_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "507f1f77bcf86cd799439011", "endCursor": "507f1f77bcf86cd799439011" }, "data": [ { "id": "507f1f77bcf86cd799439011", "createdAt": "2024-08-15T14:30:00.000Z" } ] } } } } } } } }, "description": "Returns a paginated list of risk assessment snapshots available for an audit.\n\nRisk snapshots capture the state of an organization's risk register at a\npoint in time. Each snapshot has an `id` that can be used with the\n`/audits/{auditId}/risks` endpoint to retrieve the individual risk\nscenarios within that snapshot.\n\nResults are sorted by creation date (newest first). This sort order is\nfixed and cannot be customized via query parameters. Only snapshots\nthat are shared with auditors are included.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List risk snapshots for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListRiskSnapshots", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listRiskSnapshots({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListRiskSnapshots", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListRiskSnapshotsResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListRiskSnapshotsResponse res = sdk.audits().listRiskSnapshots()\n .auditId(\"\")\n .pageSize(10)\n .call();\n\n if (res.paginatedResponseRiskSnapshot().isPresent()) {\n System.out.println(res.paginatedResponseRiskSnapshot().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/risks/{snapshotId}": { "get": { "operationId": "ListAuditRisks", "responses": { "200": { "description": "Paginated list of risks with pagination metadata", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AuditRisk_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "5f2c939a52855e725c8d5824", "endCursor": "5f2c939a52855e725c8d5824" }, "data": [ { "id": "5f2c939a52855e725c8d5824", "riskId": "RISK-001", "riskScenario": "Unauthorized access to production database", "likelihood": 4, "impact": 5, "inherentRisk": 20, "treatment": "MITIGATE", "treatmentStatus": "IN_PROGRESS", "residualRisk": 6, "reviewStatus": "APPROVED", "owner": { "displayName": "Jane Doe" }, "categories": [ "Cryptography", "Privacy" ], "ciaCategories": [ "CONFIDENTIALITY", "INTEGRITY" ], "linkedControlIds": [ "control-1", "control-2" ], "identified": "2023-01-15T10:00:00.000Z" } ] } } } } } } } }, "description": "Retrieves risk population data for an audit.\n\nThis endpoint provides access to the risk records visible to auditors\nduring an audit engagement. Risk data is scoped to a specific risk\nassessment snapshot identified by the `snapshotId` parameter.\n\nOnly Controlled Audit View (CAV) audits are supported. Full Audit\nView audits are rejected with 403.\n\nSupports filtering by:\n- `search`: Searches risk scenario descriptions (case-insensitive)\n\nResults are sorted by identified date (newest first) by default.\nUse `orderBy` and `orderDirection` to customize sorting.\nSort parameters must remain consistent across paginated requests.\n\nUses cursor-based pagination. To paginate:\n1. Make initial request with desired `pageSize`\n2. Check `results.pageInfo.hasNextPage`\n3. Use `results.pageInfo.endCursor` as `pageCursor` for next request\n\nRate limit: 10 requests / minute.", "summary": "List risks for an audit", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "description": "The audit ID", "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "The risk assessment snapshot ID", "in": "path", "name": "snapshotId", "required": true, "schema": { "type": "string" } }, { "description": "Maximum number of results per page (1-100, default 10)", "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "description": "Pagination cursor from previous response", "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Search term for filtering by risk scenario description", "in": "query", "name": "search", "required": false, "schema": { "type": "string" } }, { "description": "Field to sort results by. Allowed: \"riskId\", \"riskScenario\", \"inherentRisk\", \"treatment\", \"residualRisk\", \"reviewStatus\", \"owner\", \"categories\", \"ciaCategories\", \"identified\". Default: \"identified\"", "in": "query", "name": "orderBy", "required": false, "schema": { "$ref": "#/components/schemas/RiskOrderBy" } }, { "description": "Sort direction: \"asc\" or \"desc\". Default: \"desc\"", "in": "query", "name": "orderDirection", "required": false, "schema": { "$ref": "#/components/schemas/OrderDirection" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ListAuditRisks", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.listAuditRisks({\n auditId: \"\",\n snapshotId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ListAuditRisks", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditRisksRequest;\nimport com.vanta.vanta_auditor_api.models.operations.ListAuditRisksResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ListAuditRisksRequest req = ListAuditRisksRequest.builder()\n .auditId(\"\")\n .snapshotId(\"\")\n .build();\n\n ListAuditRisksResponse res = sdk.audits().listAuditRisks()\n .request(req)\n .call();\n\n if (res.paginatedResponseAuditRisk().isPresent()) {\n System.out.println(res.paginatedResponseAuditRisk().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/share-information-request-list": { "post": { "operationId": "ShareInformationRequestList", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Audit" }, "examples": { "Example 1": { "value": { "id": "65fc81a3359c8508c9af880f", "customerOrganizationName": "corporation.com", "customerDisplayName": "Corporation Company", "customerOrganizationId": "65fc81a3359c8508c9af880f", "auditStartDate": "2024-03-07T21:25:56.000Z", "auditEndDate": "2024-03-14T21:25:56.000Z", "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z", "framework": "SOC 2 Type II", "displayName": "Q1 2024 SOC 2 Audit", "allowAuditorEmails": [ "sam@auditor.com" ], "allowAllAuditors": true, "deletionDate": "2024-03-07T21:25:56.000Z", "creationDate": "2024-03-07T21:25:56.000Z", "modificationDate": "2024-03-07T21:25:56.000Z", "completionDate": "2024-03-07T21:25:56.000Z", "auditFocus": "EXTERNAL", "auditorRequestListMetadata": { "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z" } } } } } } } }, "description": "Shares the current information request list for an audit with the customer organization,\nmaking it visible in their portal. This action allows the customer to see all information\nrequests that have been created for their audit. Only IRL audits are supported.\n\nRate limit: 10 requests / minute.", "summary": "Share information request list with customer", "tags": [ "Audits" ], "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } } ], "x-codeSamples": [ { "lang": "typescript", "label": "ShareInformationRequestList", "source": "import { Vanta } from \"vanta-auditor-api-sdk\";\n\nconst vanta = new Vanta({\n bearerAuth: process.env[\"VANTA_BEARER_AUTH\"] ?? \"\",\n});\n\nasync function run() {\n const result = await vanta.audits.shareInformationRequestList({\n auditId: \"\",\n });\n\n console.log(result);\n}\n\nrun();" }, { "lang": "java", "label": "ShareInformationRequestList", "source": "package hello.world;\n\nimport com.vanta.vanta_auditor_api.Vanta;\nimport com.vanta.vanta_auditor_api.models.operations.ShareInformationRequestListResponse;\nimport java.lang.Exception;\n\npublic class Application {\n\n public static void main(String[] args) throws Exception {\n\n Vanta sdk = Vanta.builder()\n .bearerAuth(System.getenv().getOrDefault(\"BEARER_AUTH\", \"\"))\n .build();\n\n ShareInformationRequestListResponse res = sdk.audits().shareInformationRequestList()\n .auditId(\"\")\n .call();\n\n if (res.audit().isPresent()) {\n System.out.println(res.audit().get());\n }\n }\n}" } ] } }, "/audits/{auditId}/vendors": { "get": { "operationId": "ListVendorsInAuditScope", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Vendor_" }, "examples": { "Example 1": { "value": { "results": { "data": [ { "id": "a2f7e1b9d0c3f4e5a6c7b8d8", "name": "Vanta", "websiteUrl": "https://www.vanta.com/", "accountManagerName": "John Doe", "accountManagerEmail": "john@doe.com", "servicesProvided": "SaaS", "additionalNotes": "Automate compliance and streamline security reviews with the leading trust management platform.", "authDetails": { "method": "O_AUTH", "passwordMFA": true, "passwordRequiresNumber": true, "passwordRequiresSymbol": true, "passwordMinimumLength": 16 }, "securityOwnerUserId": "6626afa6490ec920099773e7", "businessOwnerUserId": "6626afb14c912f0a50e85619", "contractStartDate": "2024-02-01T00:00:00.000Z", "contractRenewalDate": "2025-02-01T00:00:00.000Z", "contractTerminationDate": null, "lastSecurityReviewCompletionDate": "2024-01-01T00:00:00.000Z", "nextSecurityReviewDueDate": "2025-01-01T00:00:00.000Z", "isVisibleToAuditors": true, "isRiskAutoScored": true, "category": { "displayName": "cloudMonitoring" }, "riskAttributeIds": [ "6626b0298acc44f8674390da", "6626b02ea4cd9ba80d773c20" ], "status": "MANAGED", "inherentRiskLevel": "HIGH", "residualRiskLevel": "MEDIUM", "vendorHeadquarters": "USA", "contractAmount": { "amount": 1000000, "currency": "USD" }, "customFields": null, "latestDecision": { "status": "APPROVED", "lastUpdatedAt": "2024-01-01T00:00:00.000Z" }, "linkedTaskTrackerTaskProcurementRequest": { "service": "jira", "url": "https://random-company.atlassian.net/browse/PROJ-123" } } ], "pageInfo": { "hasNextPage": false, "hasPreviousPage": false, "startCursor": "6696ea0595df50d5cd6ec3b7", "endCursor": "6696ece48eb1f98ff3d927c6" } } } } } } } } }, "description": "Returns a list of vendors who are in scope for this audit.\n\nEnd of life — this endpoint works for classic audits only; it does not support\ncontrolled audit view. It remains available for existing classic audits but will be removed once\nclassic audits are fully phased out, so do not build new integrations on it.\n\nRate limit: 10 requests / minute.", "summary": "List of vendors who are in scope for this audit", "tags": [ "Audits" ], "deprecated": true, "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } } ] } }, "/audits/{auditId}/vulnerabilities": { "get": { "operationId": "ListVulnerabilities", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_AuditorApiVulnerability_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" }, "data": [ { "id": "a2f7e1b9d0c3f4e5a6c7b8d9", "name": "CVE-2021-12345", "description": "MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.", "integrationId": "Inspector", "packageIdentifier": "package", "vulnerabilityType": "COMMON", "targetId": "targetId", "firstDetectedDate": "2021-01-01T00:00:00.000Z", "sourceDetectedDate": "2021-01-01T00:00:00.000Z", "lastDetectedDate": "2021-01-01T00:00:00.000Z", "severity": "CRITICAL", "cvssSeverityScore": 9.8, "scannerScore": 100, "isFixable": true, "remediateByDate": "2021-01-01T00:00:00.000Z", "relatedVulns": [ "CVE-2021-12345" ], "relatedUrls": [ "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-12345" ], "externalURL": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-12345", "scanSource": "Not provided", "deactivateMetadata": { "deactivatedBy": "b2f7e1b9d0c3f4e5a6c7b123", "deactivatedOnDate": "2021-01-01T00:00:00.000Z", "deactivationReason": "fix is too hard to carry out", "deactivatedUntilDate": null, "isVulnDeactivatedIndefinitely": true } } ] } } } } } } } }, "description": "List all vulnerabilities based on selected filters.\n\nEnd of life — this endpoint works for classic audits only; it does not support\ncontrolled audit view. It remains available for existing classic audits but will be removed once\nclassic audits are fully phased out, so do not build new integrations on it.\n\nRate limit: 10 requests / minute.", "summary": "List vulnerabilities within the scope of a given audit", "tags": [ "Audits" ], "deprecated": true, "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Filter vulnerabilities by search query", "in": "query", "name": "query", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Filter vulnerabilities by deactivation status.", "in": "query", "name": "isDeactivated", "required": false, "schema": { "type": "boolean" } }, { "description": "Filter vulnerabilities based on a specific external ID.", "in": "query", "name": "externalVulnerabilityId", "required": false, "schema": { "type": "string" } }, { "description": "Filter vulnerabilities that have an available fix.", "in": "query", "name": "isFixAvailable", "required": false, "schema": { "type": "boolean" } }, { "description": "Filter vulnerabilities that are from a specific package.", "in": "query", "name": "packageIdentifier", "required": false, "schema": { "type": "string" } }, { "description": "Filter vulnerabilities with a fix due after a specific timestamp", "in": "query", "name": "slaDeadlineAfterDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter vulnerabilities with a fix due before a specific timestamp", "in": "query", "name": "slaDeadlineBeforeDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter vulnerabilities by severity.\nPossible values: CRITICAL, HIGH, MEDIUM, LOW.", "in": "query", "name": "severity", "required": false, "schema": { "$ref": "#/components/schemas/ExternalFindingSeverity" } }, { "description": "Filter vulnerabilities by the vulnerability scanner that detected them.", "in": "query", "name": "integrationId", "required": false, "schema": { "type": "string" } }, { "description": "Filter vulnerabilities without an SLA due date.", "in": "query", "name": "includeVulnerabilitiesWithoutSlas", "required": false, "schema": { "type": "boolean" } }, { "description": "Filter vulnerabilities by a specific asset ID.", "in": "query", "name": "vulnerableAssetId", "required": false, "schema": { "type": "string" } } ] } }, "/audits/{auditId}/vulnerability-remediations": { "get": { "operationId": "ListVulnerabilityRemediationsInAuditScope", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_VulnerabilityRemediation_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" }, "data": [ { "id": "a2f7e1b9d0c3f4e5a6c7b8d9", "vulnerabilityId": "a2f7e1b9d0c3f4e5a6c7b8d8", "vulnerableAssetId": "a2f7e1b9d0c3f4e5a6c7b8d7", "severity": "critical", "detectedDate": "2021-01-01T00:00:00.000Z", "slaDeadlineDate": "2021-03-01T00:00:00.000Z", "remediationDate": "2021-02-01T00:00:00.000Z" } ] } } } } } } } }, "description": "List all vulnerability remediations based on selected filters that are in scope for this audit.\n\nEnd of life — this endpoint works for classic audits only; it does not support\ncontrolled audit view. It remains available for existing classic audits but will be removed once\nclassic audits are fully phased out, so do not build new integrations on it.\n\nRate limit: 10 requests / minute.", "summary": "List vulnerability remediations that are in scope for this audit", "tags": [ "Audits" ], "deprecated": true, "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Filter vulnerability remediations based on a specific scanner integration.", "in": "query", "name": "integrationId", "required": false, "schema": { "type": "string" } }, { "description": "Filter vulnerability remediations by severity.\nPossible values: CRITICAL, HIGH, MEDIUM, LOW.", "in": "query", "name": "severity", "required": false, "schema": { "$ref": "#/components/schemas/ExternalFindingSeverity" } }, { "description": "Filter vulnerability remediations by remediation status.", "in": "query", "name": "isRemediatedOnTime", "required": false, "schema": { "type": "boolean" } }, { "description": "Filter vulnerability remediations that occurred after a specific timestamp.", "in": "query", "name": "remediatedAfterDate", "required": false, "schema": { "format": "date-time", "type": "string" } }, { "description": "Filter vulnerability remediations that occurred before a specific timestamp.", "in": "query", "name": "remediatedBeforeDate", "required": false, "schema": { "format": "date-time", "type": "string" } } ] } }, "/audits/{auditId}/vulnerable-assets": { "get": { "operationId": "GetVulnerableAssets", "responses": { "200": { "description": "Ok", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_VulnerableAsset_" }, "examples": { "Example 1": { "value": { "results": { "pageInfo": { "hasNextPage": true, "hasPreviousPage": false, "startCursor": "YXJyYXljb25uZWN0aW9uOjA=", "endCursor": "YXJyYXljb25uZWN0aW9uOjE=" }, "data": [ { "id": "a2f7e1b9d0c3f4e5a6c7b8d9", "name": "CVE-2021-12345", "assetType": "SERVER", "hasBeenScanned": true, "imageScanTag": "apac-production:latest", "scanners": [ { "resourceId": "6733c25f852819d3b8d97a86", "integrationId": "qualys", "imageDigest": "sha256:123456", "imagePushedAtDate": "2021-01-01T00:00:00.000Z", "imageTags": [ "candidate-1234567890" ], "assetTags": [ { "key": "company-name", "value": "vanta-llama" } ], "parentAccountOrOrganization": "12345678-abcd-cdef-ab12-abcd1234bbbb", "biosUuid": "123456", "ipv4s": [ "12.12.123.123" ], "ipv6s": null, "macAddresses": [ "1234AB987FED" ], "hostnames": [ "purple-llama" ], "fqdns": [ "purple-llama" ], "operatingSystems": [ "Windows11" ], "targetId": "12345678-abcd-cdef-ab12-abcd1234bbbc" } ] } ] } } } } } } } }, "description": "List assets that Vanta monitors that are associated with vulnerabilities.\n\nEnd of life — this endpoint works for classic audits only; it does not support\ncontrolled audit view. It remains available for existing classic audits but will be removed once\nclassic audits are fully phased out, so do not build new integrations on it.\n\nRate limit: 10 requests / minute.", "summary": "List assets associated with vulnerabilities", "tags": [ "Audits" ], "deprecated": true, "security": [ { "bearerAuth": [] } ], "parameters": [ { "in": "path", "name": "auditId", "required": true, "schema": { "type": "string" } }, { "description": "Filter vulnerable assets by search query.", "in": "query", "name": "query", "required": false, "schema": { "type": "string" } }, { "in": "query", "name": "pageSize", "required": false, "schema": { "$ref": "#/components/schemas/PageSize" } }, { "in": "query", "name": "pageCursor", "required": false, "schema": { "$ref": "#/components/schemas/PageCursor" } }, { "description": "Filter vulnerable assets by specific vulnerability scanner.", "in": "query", "name": "integrationId", "required": false, "schema": { "type": "string" } }, { "description": "Filter vulnerable assets by asset type.\nPossible values: CODE_REPOSITORY, CONTAINER_REPOSITORY, CONTAINER_REPOSITORY_IMAGE, MANIFEST_FILE, SERVER, SERVERLESS_FUNCTION, WORKSTATION.", "in": "query", "name": "assetType", "required": false, "schema": { "$ref": "#/components/schemas/VulnerableAssetType" } }, { "description": "Filter vulnerable assets by...", "in": "query", "name": "assetExternalAccountId", "required": false, "schema": { "type": "string" } } ] } } }, "servers": [ { "url": "https://api.vanta.com/v1", "description": "Vanta (Commercial)" }, { "url": "https://api.vanta-gov.com/v1", "description": "Vanta Gov (FedRAMP)" } ] }