Drata Events API

openapi: 3.2.0
info:
  title: Drata Events API
  version: V2
  contact: {}
  description: 'Operations tagged Events across 2 of this provider''s published API definitions: drata-api-v2-openapi.json, drata-api-v2-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://public-api.drata.com/public/v2
- url: https://public-api.eu.drata.com/public/v2
- url: https://public-api.apac.drata.com/public/v2
tags:
- name: Events
  description: Events record the activity of User and automated processes in the Drata platform.
paths:
  /events:
    get:
      description: 'Find Events matching the provided filters.


        🔒 Requires **Event Tracking: List Events** permission.'
      operationId: EventsPublicV2Controller_listEvents
      parameters:
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Events can only be sorted by create date
        schema:
          $ref: '#/components/schemas/EventSortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/EventExpandEnum'
      - name: type
        required: false
        in: query
        description: Filter data to events of this type
        schema:
          $ref: '#/components/schemas/EventTypeEnum'
      - name: source
        required: false
        in: query
        description: Filter data to events of this source
        schema:
          $ref: '#/components/schemas/EventSourceEnum'
      - name: category
        required: false
        in: query
        description: Filter data to events of this category
        schema:
          $ref: '#/components/schemas/EventCategoryEnum'
      - name: connectionId
        required: false
        in: query
        description: The connection to filter events by. A null/blank value will return events without a connection.
        schema:
          type:
          - number
          - 'null'
      - name: userId
        required: false
        in: query
        description: The user to filter events by. A null/blank value will return events without a user.
        schema:
          type:
          - number
          - 'null'
      - name: workspaceId
        required: false
        in: query
        description: The workspace to filter events to
        schema:
          type: number
      - name: createdAtStartDate
        required: false
        in: query
        description: Filters the events to those with a creation date greater than or equal to this date and time.
        schema:
          format: date-time
          type: string
      - name: createdAtEndDate
        required: false
        in: query
        description: Filters the events to those with a creation date less than or equal to this date and time
        schema:
          format: date-time
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventsResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Events
      tags:
      - Events
      x-drata-permissions:
      - event-tracking-get
      x-product-area:
      - EVENT_TRACKING
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /events/{eventId}:
    get:
      description: 'Get details for an Event.


        🔒 Requires **Event Tracking: Get Event** permission.'
      operationId: EventsPublicV2Controller_getEvent
      parameters:
      - name: eventId
        required: true
        in: path
        schema:
          type: string
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/EventExpandEnum'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Get Event
      tags:
      - Events
      x-drata-permissions:
      - event-tracking-get-event
      x-product-area:
      - EVENT_TRACKING
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /events/{eventId}/download-jobs:
    post:
      description: 'Creates an asynchronous job to generate a PDF for an Event.


        🔒 Requires **Event Tracking: Get Event** permission.'
      operationId: EventsPublicV2Controller_createEventDownloadJob
      parameters:
      - name: eventId
        required: true
        in: path
        schema:
          type: string
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventDownloadJobResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Create Event PDF Download Job
      tags:
      - Events
      x-drata-permissions:
      - event-tracking-get-event
      x-product-area:
      - EVENT_TRACKING
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /events/{eventId}/download-jobs/{jobId}:
    get:
      description: 'Retrieves the Event PDF download job.


        🔒 Requires **Event Tracking: Get Event** permission.'
      operationId: EventsPublicV2Controller_getEventDownloadJobStatus
      parameters:
      - name: eventId
        required: true
        in: path
        schema:
          type: string
      - name: jobId
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventDownloadJobResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Get Event PDF Export
      tags:
      - Events
      x-drata-permissions:
      - event-tracking-get-event
      x-product-area:
      - EVENT_TRACKING
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
components:
  schemas:
    ExceptionResponsePublicV2Dto:
      type: object
      properties:
        name:
          type: string
        statusCode:
          type: number
        message:
          type: string
        code:
          type: number
        debugInfo:
          type: object
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
          required:
          - name
          - message
      required:
      - name
      - statusCode
      - message
      - code
    UserCompactResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: 1
          description: User ID
        email:
          type: string
          example: email@example.com
          description: User email
        firstName:
          type:
          - string
          - 'null'
          example: Sally
          description: User first name
        lastName:
          type:
          - string
          - 'null'
          example: Smith
          description: User last name
        createdAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User created at
        updatedAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User last updated at
      required:
      - id
      - email
      - firstName
      - lastName
      - createdAt
      - updatedAt
    PaginationTotalCountResponsePublicV2Dto:
      type: object
      properties:
        cursor:
          type:
          - string
          - 'null'
          description: When this is not null, it indicates there is additional data. Pass this value in to the `cursor` parameter to fetch the next page of data.
        totalCount:
          type:
          - number
          - 'null'
          description: Total count of all matching items (not limited by page size). Only included when `includeTotalCount=true` is passed on the first page (no cursor).
      required:
      - cursor
    EventResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: string
          example: aaaaaaaa-bbbb-0000-cccc-dddddddddddd
          description: Event UUID
        type:
          description: The type of event
          allOf:
          - $ref: '#/components/schemas/EventTypeEnum'
        category:
          description: The category of event
          allOf:
          - $ref: '#/components/schemas/EventCategoryEnum'
        source:
          description: The source of the event (APP or AUTOPILOT)
          allOf:
          - $ref: '#/components/schemas/EventSourceEnum'
        description:
          type: string
          example: Wile E. Coyote updated the company info.
          description: The description of the event
        metadata:
          type: object
          properties:
            dto:
              type:
              - object
              - 'null'
              additionalProperties: true
            targetEntity:
              type:
              - object
              - 'null'
              additionalProperties: true
            targetEntities:
              type: array
              items:
                type:
                - object
                - 'null'
                additionalProperties: true
            fileKey:
              type:
              - string
              - 'null'
            sourceData:
              type:
              - object
              - 'null'
              additionalProperties: true
            taskType:
              type:
              - number
              - 'null'
            request:
              type:
              - object
              - 'null'
              additionalProperties: true
            response:
              type:
              - object
              - 'null'
              additionalProperties: true
          description: The event metadata in JSON, only returned when `expand[]=metadata` is passed.
        status:
          description: The result of the test if the event type is an Autopilot test, otherwise null
          allOf:
          - $ref: '#/components/schemas/CheckResultStatusEnum'
        createdAt:
          type: string
          format: date-time
          description: Report created date timestamp
        userId:
          type:
          - number
          - 'null'
          description: The id of the user related to the event
        user:
          description: The user related to the event, only returned when `expand[]=user` is passed.
          allOf:
          - $ref: '#/components/schemas/UserCompactResponsePublicV2Dto'
        connectionId:
          type:
          - number
          - 'null'
          description: The id of the connection associated to the event
        connection:
          description: The associated connection if this event has one, only returned when `expand[]=connection` is passed.
          allOf:
          - $ref: '#/components/schemas/ConnectionCompactResponsePublicV2Dto'
        requestDescription:
          type:
          - string
          - 'null'
          example: Data was fetched from https://xyz.com/api/v1/data
          description: The human readable explanation of the workings of the associated AP test
        testName:
          type:
          - string
          - 'null'
          description: The name of the monitoring test associated with this event, only returned when `expand[]=testName` is passed.
        testId:
          type:
          - string
          - 'null'
          description: The identifier of the monitoring test associated with this event. This value may be duplicated across workspaces. Only returned when `expand[]=testId` is passed.
        issues:
          type: array
          items:
            type: object
            additionalProperties: true
          description: The issues associated to this event, if any, only returned when `expand[]=issues` or `expand[]=metadata` is passed.
      required:
      - id
      - type
      - category
      - source
      - description
      - status
      - createdAt
      - userId
      - connectionId
      - requestDescription
    EventSourceEnum:
      type: string
      enum:
      - APP
      - AUTOPILOT
      - PUBLIC_API
      - VENDOR_QUESTIONNAIRE
      - SCHEDULED
      - WORKFLOW
      - DRATA_POLICY
    CheckResultStatusEnum:
      type: string
      enum:
      - READY
      - PASSED
      - FAILED
      - ERROR
      - PREAUDIT
    SortDirectionEnum:
      type: string
      enum:
      - ASC
      - DESC
    EventCategoryEnum:
      type: string
      enum:
      - AUTOPILOT
      - AGENT
      - POLICY
      - PERSONNEL
      - REPORT
      - VENDOR
      - ASSET
      - COMPANY
      - ASSESSMENT
      - AUDIT
      - MONITOR
      - USER
      - CONNECTION
      - GRC
      - MDM
      - QUESTIONNAIRE
      - DEVICE
      - TRUST_PAGES
      - TRUST_CENTER_PRIVATE_ACCESS
      - RISK
      - COMPANY_NOTIFICATION
      - CUSTOM_FRAMEWORKS
      - MULTIPLE_PRODUCT_SUPPORT
      - PUBLIC_API_KEY
      - SERVICE_PROVIDER
      - TASK
      - AUTOPILOT_RECIPE_SCHEDULE
      - RESYNC
      - EVIDENCE
      - AUTOPILOT_RECIPE
      - ACCESS_REVIEW
      - DOCUMENT_SCANNED
      - CLOUD_STORAGE
      - VENDOR_PROFILE
      - CODEBASE
      - EXCEPTION_MANAGEMENT
      - WORKFLOWS
      - CUSTOM_CONNECTION
      - TRUST_CENTER_REPORTS
      - OUTBOUND_WEBHOOKS
      - SAFEBASE_MIGRATION
      - TRUST_ACCESS_REQUEST
      - SAFEBASE_ONBOARDING
    EventDownloadJobResponsePublicV2Dto:
      type: object
      properties:
        jobId:
          type: string
          example: aaaaaaaa-bbbb-0000-cccc-dddddddddddd
          description: The unique job ID for tracking the Event PDF download generation
        status:
          description: The current status of the event PDF download job
          example: Pending
          allOf:
          - $ref: '#/components/schemas/EvidenceJobStatusEnum'
        result:
          type:
          - string
          - 'null'
          description: The signed URL to download the event PDF (only available when status is `COMPLETED`). URL expires after 10 minutes from generation.
          example: https://s3.amazonaws.com/event-pdf.pdf?Signature=ABC123
        createdAt:
          type: string
          format: date-time
          description: Timestamp when the job was created
          example: '2025-07-01T16:45:55.246Z'
        completedAt:
          type:
          - string
          - 'null'
          format: date-time
          description: Timestamp when the job was completed (only available when status is `COMPLETED` or `FAILED`)
          example: '2025-07-01T16:45:55.246Z'
        errorMessage:
          type: string
          description: Error message (only available when status is `FAILED`)
          example: 'Failed to generate event PDF: insufficient permissions'
      required:
      - jobId
      - status
      - result
      - createdAt
      - completedAt
    SortTypeLimitedEnum:
      type: string
      enum:
      - createdAt
      - updatedAt
    EventTypeEnum:
      type: string
      enum:
      - COMPANY_DATA_UPDATED
      - COMPANY_LOGO_UPDATED
      - COMPANY_KEY_PERSONNEL_UPDATED
      - COMPANY_ROLES_UPDATED
      - COMPANY_SECURITY_DATA_UPDATED
      - COMPANY_DOCUMENT_UPLOADED
      - COMPANY_DOCUMENT_DOWNLOADED
      - COMPANY_DOCUMENT_DELETED
      - COMPANY_HUMAN_RESOURCES_DATA_UPDATED
      - EMPLOYMENT_STATUS_UPDATED
      - REMINDER_EMAIL_SENT
      - POLICIES_DOWNLOAD_ALL
      - POLICY_DOWNLOADED
      - POLICY_VERSION_UPLOADED
      - POLICY_VERSION_ADDED
      - POLICY_VERSION_UPDATED
      - POLICY_OWNER_APPROVED
      - USER_POLICY_ACCEPTED
      - REPORTS_DOWNLOAD_ALL
      - REPORT_DOWNLOADED
      - REPORT_CREATED
      - REPORT_UPDATED
      - REPORT_DELETED
      - VENDORS_DOWNLOAD_ALL
      - VENDOR_CREATED
      - VENDOR_UPDATED
      - VENDOR_DELETED
      - VENDOR_DOCUMENT_UPLOADED
      - VENDOR_DOCUMENT_DELETED
      - VENDOR_DOCUMENT_DOWNLOADED
      - AUTOPILOT_FREQUENCY_UPDATED
      - TERMS_AGREED
      - AUTOPILOT_USER_CREATED
      - AUTOPILOT_USER_UPDATED
      - AUTOPILOT_PERSONNEL_SEPARATED
      - AUTOPILOT_COMPLIANCE_CHECK_UPDATED
      - AGENT_USER_DATA_UPDATED
      - USER_DOCUMENT_UPLOADED
      - USER_DOCUMENT_DELETED
      - USER_DOCUMENT_DOWNLOADED
      - BACKGROUND_CHECK_STARTED
      - PROVIDER_CONNECTION_CREATED
      - PROVIDER_CONNECTION_REMOVED
      - USER_IDENTITY_VERSION_CONTROL_LINK_UPDATED
      - USER_IDENTITY_VERSION_CONTROL_TOGGLE_UPDATED
      - USER_IDENTITY_VERSION_CONTROL_SERVICE_ACCOUNT_UPDATED
      - USER_IDENTITY_PERSONNEL_SYNCED
      - USER_IDENTITY_VERSION_CONTROL_SYNCED
      - USER_IDENTITY_VERSION_CONTROL_USER_UPDATED
      - USER_IDENTITY_VERSION_CONTROL_USER_CREATED
      - USER_IDENTITY_VERSION_CONTROL_USER_DISCONNECTED
      - AP_IDENTITY_PROVIDER_MFA_ENABLED
      - AP_IDENTITY_PROVIDER_UNKNOWN_EMAIL
      - AP_INTERNAL_POLICY_INCIDENT_RESPONSE
      - AP_INTERNAL_POLICY_INCIDENT_RESPONSE_FOLLOW_UPS
      - AP_INTERNAL_POLICY_INCIDENT_RESPONSE_LESSONS_LEARNED
      - AP_INTERNAL_POLICY_INCIDENT_RESPONSE_TEAM
      - AP_INTERNAL_POLICY_DATA_CLASSIFICATION
      - AP_INTERNAL_POLICY_SDLC
      - AP_INTERNAL_POLICY_ACCEPTABLE_USE
      - AP_INTERNAL_POLICY_ACCESS_CONTROL
      - AP_INTERNAL_POLICY_INFORMATION_SECURITY
      - AP_INTERNAL_POLICY_CODE_OF_CONDUCT
      - AP_INTERNAL_POLICY_DATA_PROTECTION
      - AP_INTERNAL_POLICY_PASSWORD
      - AP_INTERNAL_POLICY_BACKUPS
      - AP_INTERNAL_POLICY_PHYSICAL_SECURITY
      - AP_INTERNAL_POLICY_RISK_ASSESSMENT
      - AP_INTERNAL_POLICY_DISASTER_RECOVERY
      - AP_INTERNAL_POLICY_ENCRYPTION
      - AP_INTERNAL_POLICY_SYSTEM_ACCESS_CONTROL
      - AP_INTERNAL_POLICY_RESPONSIBLE_DISCLOSURE
      - AP_INTERNAL_POLICY_EMPLOYEE_CONFIDENTIALITY
      - AP_INTERNAL_POLICY_EMPLOYEE_ACCESS_TO_CUSTOMER_DATA
      - AP_INTERNAL_POLICY_RISK_REMEDIATION
      - AP_INTERNAL_POLICY_VULNERABILITY_MANAGEMENT
      - AP_INTERNAL_DOCUMENT_ORGANIZATIONAL_CHART
      - AP_COMPANY_POLICIES_APPROVED
      - AP_COMPANY_POLICIES_CREATED
      - AP_COMPANY_BOD_UNIQUE
      - AP_INTERNAL_REPORT_RISK_ASSESSMENT
      - AP_INTERNAL_REPORT_RISK_REMEDIATION
      - AP_INTERNAL_REPORT_VULNERABILITY
      - AP_INTERNAL_REPORT_PENETRATION
      - AP_INTERNAL_REPORT_DISASTER_RECOVERY
      - AP_INTERNAL_REPORT_BACKUP_AND_COMPLETENESS
      - AP_INTERNAL_REPORT_ARCHITECTURAL_DIAGRAM
      - AP_INTERNAL_REPORT_NETWORK_DIAGRAM
      - AP_INTERNAL_URL_SUPPORT
      - AP_INTERNAL_URL_PRIVACY_POLICY
      - AP_INTERNAL_URL_TERMS_OF_SERVICE
      - AP_EMPLOYEES_POLICIES_APPROVED
      - AP_EMPLOYEES_ACCEPTABLE_USE_POLICY
      - AP_EMPLOYEES_CODE_OF_CONDUCT_POLICY
      - AP_EMPLOYEES_DATA_PROTECTION_POLICY
      - AP_AGENT_PASSWORD_MANAGER
      - AP_AGENT_ANTI_VIRUS_APPLICATION
      - AP_AGENT_AUTO_UPDATES_ENABLED
      - AP_CONTRACTORS_CODE_OF_CONDUCT_POLICY
      - AP_CONTRACTORS_ACCEPTABLE_USE_POLICY
      - AP_COMPANY_INFRASTRUCTURE_MFA_ENABLED
      - AP_COMPANY_INFRASTRUCTURE_SSL_ENABLED
      - AP_COMPANY_WEBSITE_SSL_ENFORCED
      - AP_COMPANY_WEBSITE_SSL_CERT_NOT_EXPIRED
      - AP_COMPANY_WEBSITE_SSL_CERT_STRONG_CIPHERS
      - AP_COMPANY_WEBSITE_SSL_HAS_KNOWN_ISSUES
      - AP_COMPANY_PRIORITIZE_SECURITY_ISSUES
      - AP_VERSION_CONTROL_ENABLED
      - AP_VERSION_CONTROL_MFA_ENABLED
      - AP_VERSION_CONTROL_CODE_REVIEW_PROCESS
      - AP_INFRASTRUCTURE_AUTHORIZATION_DETAILS
      - AP_INFRASTRUCTURE_PUBLIC_SSH_DENIED
      - AP_INFRASTRUCTURE_DATA_ENCRYPTED
      - AP_INFRASTRUCTURE_DATA_MULTI_AZ
      - AP_INFRASTRUCTURE_STORAGE_ENCRYPTED
      - AP_INFRASTRUCTURE_DATA_MONITOR_CPU
      - AP_INFRASTRUCTURE_DATA_MONITOR_READ_IO
      - AP_INFRASTRUCTURE_DATA_MONITOR_WRITE_IO
      - AP_INFRASTRUCTURE_DATA_MONITOR_FREE_STORAGE
      - AP_INFRASTRUCTURE_INSTANCE_MONITOR_CPU
      - AP_INFRASTRUCTURE_DISALLOWS_TRAFFIC
      - AP_INFRASTRUCTURE_HAS_WAF
      - AP_INFRASTRUCTURE_HAS_BALANCERS
      - AP_INFRASTRUCTURE_QUEUE_MONITOR_MESSAGE_AGE
      - AP_INFRASTRUCTURE_CLOUD_DATA_FREE_STORAGE
      - AP_INFRASTRUCTURE_CREDENTIAL_REPORT
      - USER_IDENTITY_INFRASTRUCTURE_LINK_UPDATED
      - USER_IDENTITY_INFRASTRUCTURE_TOGGLE_UPDATED
      - USER_IDENTITY_INFRASTRUCTURE_SERVICE_ACCOUNT_UPDATED
      - USER_IDENTITY_INFRASTRUCTURE_SYNCED
      - USER_IDENTITY_INFRASTRUCTURE_USER_UPDATED
      - USER_IDENTITY_INFRASTRUCTURE_USER_CREATED
      - USER_IDENTITY_INFRASTRUCTURE_USER_DISCONNECTED
      - AGENT_UNREGISTERED
      - ASSETS_DOWNLOAD_ALL
      - BACKGROUND_CHECK_MANUAL
      - BACKGROUND_CHECK_DELETED
      - AP_INFRASTRUCTURE_STORAGE_RESTRICTED
      - AP_INFRASTRUCTURE_STORAGE_VERSIONING
      - AP_INFRASTRUCTURE_DATA_BACKUPS
      - AP_INTERNAL_INFRASTRUCTURE_IDENTITIES_REMOVED
      - AP_INTERNAL_INFRASTRUCTURE_IDENTITIES_UNIQUE
      - AP_INFRASTRUCTURE_STORAGE_WAF
      - AP_INTERNAL_VERSION_CONTROL_IDENTITIES_UNIQUE
      - AP_INTERNAL_VERSION_CONTROL_IDENTITIES_REMOVED
      - AP_INTERNAL_INFRASTRUCTURE_LINKED
      - AP_INTERNAL_VERSION_CONTROL_IDENTITIES_ONLY_AUTHORIZED_ACCESS
      - AP_INTERNAL_POLICY_PASSWORD_MANAGER_REQUIRED
      - AP_INTERNAL_POLICY_SECURITY_AWARENESS
      - AP_INTERNAL_POLICY_SECURITY_ENCRYPTION
      - AP_INTERNAL_URL_EXTERNAL_JOBS
      - AP_EMPLOYEES_SECURITY_COMPLIANCE
      - AP_EMPLOYEES_BACKGROUND_CHECK_COMPLIANCE
      - AP_EMPLOYEES_LOCK_SCREEN_COMPLIANCE
      - AP_EMPLOYEES_HARD_DRIVE_ENCRYPTED_COMPLIANCE
      - AP_VERSION_CONTROL_WRITE_ACCESS_TO_REPOSITORY
      - AP_VERSION_CONTROL_WRITE_ACCESS_TO_PRODUCTION_CODE
      - AP_CONTRACTORS_BACKGROUND_CHECK_COMPLIANCE
      - AP_COMPANY_SECURITY_COMMITTEE
      - AP_INTERNAL_DOCUMENT_PERFORMANCE_EVALUATION
      - AP_INTERNAL_DOCUMENT_EMPLOYEE_AGREEMENT
      - AP_INTERNAL_DOCUMENT_ENGINEERING_JOB_DESCRIPTION
      - AP_INTERNAL_DOCUMENT_MSA
      - AP_INTERNAL_POLICY_DATA_RETENTION
      - AP_INTERNAL_POLICY_CUSTOMER_DATA_RETENTION
      - AP_INTERNAL_POLICY_CLEAN_DESK
      - AP_INTERNAL_POLICY_SENSITIVE_DATA_DISPOSAL
      - COMPANY_SECURITY_REPORT_SETTING_UPDATED
      - COMPANY_SECURITY_REPORT_SHAREABLE_UPDATED
      - COMPANY_SECURITY_REPORT_SHARE_TOKEN_UPDATED
      - MONITOR_EXCLUSION_CREATED
      - MONITOR_EXCLUSION_UPDATED
      - MONITOR_EXCLUSION_DELETED
      - AP_INFRASTRUCTURE_ROOT_ACCOUNT_UNUSED
      - POLICY_ADDED
      - POLICY_VERSION_DELETED
      - COMPANY_ARCHIVED_DOWNLOADED
      - PROVIDER_CONNECTION_UPDATED
      - ARCHIVE_CONTROL
      - UNARCHIVE_CONTROL
      - EXTERNAL_EVIDENCE_DELETED
      - REPORT_ASSOCIATED_TO_CONTROL
      - REPORT_UNASSOCIATED_TO_CONTROL
      - UPLOAD_EXTERNAL_EVIDENCE
      - POLICY_ASSOCIATED_TO_CONTROL
      - POLICY_UNASSOCIATED_TO_CONTROL
      - REQUIREMENT_ASSOCIATED_TO_CONTROL
      - REQUIREMENT_UNASSOCIATED_TO_CONTROL
      - BACKGROUND_CHECK_COMPLETED
      - MDM_USER_DATA_UPDATED
      - CREATE_CONTROL
      - MANUAL_ASSET_CREATED
      - MANUAL_ASSET_UPDATED
      - MANUAL_ASSET_DELETED
      - ASSET_NOTES_UPDATED
      - COMPANY_WORKSTATION_CONFIGURATION_UPDATED
      - COMPANY_LINKS_DOWNLOADED
      - COMPANY_PACKAGE_DOWNLOADED
      - CONNECTIONS_AUDIT_PACKAGE_DOWNLOADED
      - HUMAN_RESOURCES_AUDIT_PACKAGE_DOWNLOADED
      - INFRASTRUCTURE_ACCESS_AUDIT_PACKAGE_DOWNLOADED
      - VERSION_CONTROL_AUDIT_PACKAGE_DOWNLOADED
      - EDIT_CONTROL_INFO
      - FORCE_SYNC_ON_A_PERSON
      - FORCE_SYNC_ON_ALL
      - CONTROL_OWNER_ADDED
      - CONTROL_OWNER_DELETED
      - POLICY_REVERT_TO_LATEST_TEMPLATE
      - POLICY_REVERT_TO_LATEST_VERSION
      - CONTROL_EVIDENCE_PACKAGE_GENERATED
      - AUDITOR_TOGGLE_READ_ONLY
      - FRAMEWORK_AUDIT_DETAILS_EDITED
      - VENDOR_MANUAL_UPLOAD
      - QUESTIONNAIRE_ARCHIVE_DOWNLOADED
      - VENDOR_QUESTIONNAIRE_RESPONSE_SAVED
      - VENDOR_QUESTIONNAIRE_EMAIL_SENT
      - GROUPS_IDENTITY_CREATED
      - GROUPS_IDENTITY_DELETED
      - GROUPS_PERSONNEL_IDENTITY_ADDED
      - GROUPS_PERSONNEL_IDENTITY_REMOVED
      - GROUPS_IDENTITY_UPDATED
      - BACKGROUND_LINKED_TO_PERSONNEL
      - BACKGROUND_UNLINKED_FROM_PERSONNEL
      - SECURITY_AWARENESS_TRAINING_RESET
      - POLICY_ASSIGNED_ALL
      - POLICY_ASSIGNED_NONE
      - POLICY_ASSIGNED_GROUPS
      - GROUPS_PERSONNEL_DELETED
      - GROUPS_PERSONNEL_ADDED
      - GROUPS_DELETED
      - POLICY_BECAME_ORPHAN
      - AP_CONTRACTORS_POLICIES_APPROVED
      - AP_CONTRACTORS_DATA_PROTECTION_POLICY
      - COMPANY_HIPAA_TRAINING_DATA_UPDATED
      - CONTROL_NOTE_ADDED
      - CONTROL_NOTE_DELETED
      - CONTROL_NOTE_EDITED
      - AUDITOR_ADDED
      - AUDITOR_REMOVED
      - AUDITOR_HAS_ENTERED_TO_TENANT_DETAILS
      - AUDITOR_DOES_A_READ_ONLY
      - ACCOUNT_INFORMATION_PACKAGE_CREATION
      - HIPAA_TRAINING_RESET
      - SECURITY_AWARENESS_TRAINING_UPDATED
      - AP_SECURITY_AWARENESS_TRAINING
      - DEVICE_UNLINKED
      - DEVICE_LINKED
      - DEVICE_DOCUMENT_DELETED
      - DEVICE_SWITCHED
      - DEVICE_DOCUMENT_D

# --- truncated at 32 KB (68 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/openapi/drata-events-api-openapi.yml