Drata

Drata Policies API

A policy is a document that outlines an organization’s commitment to following standards relevant to its operations. The [help docs](https://help.drata.com/en/articles/9202419-policy-center-overview) have more information.

GitHub OpenAPI
Business capability
Policy Management BC-130.20

Operations 14

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /policies List published policies · List Policies #
Ask an LLM
“Which published policies does our Drata account have?”
“Can I filter our policies by status or by who is reviewing them?”
Tell an agent
List published policies whose name contains {name}.
Show every policy where {reviewer} is a reviewer.
POST /policies Create a new policy with a draft version · Create Policy #
Ask an LLM
“How do I add a brand new security policy with its first draft?”
“Can I create a policy from a file stored externally instead of uploading one?”
Tell an agent
Create a policy named {name} owned by {owner} that renews on {renewal_date}.
Start a new policy {name} with description {description} and require employees to acknowledge it.
GET /policies/{policyId}/policy-versions List the versions of a policy · List Policy Versions #
Ask an LLM
“What versions exist for one of our policies?”
“Can I see which version of a policy is the current one?”
Tell an agent
List all versions of policy {policy}.
Show only the current version entry in the version history of policy {policy}.
POST /policies/{policyId}/policy-versions Create a new version of a policy · Create Policy Version #
Ask an LLM
“How do I publish a revised version of an existing policy?”
“Does a material change to a policy have to go through approval?”
Tell an agent
Create a new version of policy {policy} owned by {owner}, marked as a material change: {is_material}.
Add a revised version to policy {policy} with change summary {summary}.
GET /policies/{policyId} Get one published policy · Get Policy #
Ask an LLM
“What are the details of a specific published policy?”
“Can I look up a single policy by its ID?”
Tell an agent
Get policy {policy}.
Show me the details of published policy {policy}.
PUT /policies/{policyId} Edit a policy's settings · Modify Policy #
Ask an LLM
“Can I change a policy's renewal date or renewal schedule?”
“How can I link controls or assign groups to an existing policy?”
Tell an agent
Rename policy {policy} to {name}.
Set the renewal date of policy {policy} to {renewal_date}.
PUT /policies/{policyId}/owner Change who owns a policy · Assign Policy Owner #
Ask an LLM
“Can I hand ownership of a policy to another person?”
“Who can be made the owner of a policy?”
Tell an agent
Make user {user} the owner of policy {policy}.
Transfer ownership of policy {policy} to {user}.
GET /policies/{policyId}/approval-configuration Get a policy's approval workflow · Get Policy Approval Configuration #
Ask an LLM
“Which review groups have to approve this policy, and in what order?”
“What does the approval sequence for a policy look like?”
Tell an agent
Show the approval configuration for policy {policy}.
List the review tiers set up for policy {policy}.
POST /policies/{policyId}/approval-configuration Add a review group tier to a policy · Add Review Group Configuration #
Ask an LLM
“How many approval tiers can a single policy have?”
“Can I add another group of reviewers at the end of a policy's approval chain?”
Tell an agent
Add a review group {name} with users {users} to the end of policy {policy}'s approval sequence.
Append a review tier {name} to policy {policy} using consensus rule {rule} and timeline {timeline}.
PUT /policies/{policyId}/approval-configuration/{approvalConfigurationTier} Update one review tier of a policy · Update Review Group Configuration #
Ask an LLM
“Can I change the reviewers in one approval tier without touching the others?”
“What happens if I try to edit a review tier that doesn't exist?”
Tell an agent
Replace the reviewers in tier {tier} of policy {policy} with {users}.
Update review tier {tier} of policy {policy}: name {name}, consensus rule {rule}, timeline {timeline}.
DELETE /policies/{policyId}/approval-configuration/{approvalConfigurationTier} Remove a review tier from a policy · Remove Review Group Configuration #
Ask an LLM
“Can I drop one of the approval tiers from a policy?”
“Is it allowed to remove the last remaining review tier?”
Tell an agent destructive · confirm first
Remove approval tier {tier} from policy {policy}.
Delete review group tier {tier} on policy {policy} and renumber the rest.
GET /policies/{policyId}/actions See which actions I can take on a policy · List Policy Actions #
Ask an LLM
“What can I do with this policy right now, given its state?”
“Am I allowed to publish or discard this policy yet?”
Tell an agent
List the actions available to me on policy {policy}.
Check whether policy {policy} can be submitted for approval right now.
POST /policies/{policyId}/actions Submit, approve, publish or discard a policy · Perform Policy Action #
Ask an LLM
“How do I submit a policy for approval or publish it?”
“Can I request changes on a policy draft and give a reason?”
Tell an agent
Perform action {action} on policy {policy}.
Request changes on policy {policy} with reason {reason}.
GET /policies/{policyId}/policy-versions/{policyVersionId} Get one version of a policy · Get Policy Version #
Ask an LLM
“Can I read the HTML content of a specific policy version?”
“What changed in a particular version of a policy?”
Tell an agent
Get version {version} of policy {policy}.
Fetch the content of policy {policy} as it was in version {version}.

Documentation

📖
Documentation
https://developers.drata.com/openapi/reference/v2/overview/
📖
APIReference
https://developers.drata.com/openapi/reference/v2/overview/
📖
GettingStarted
https://developers.drata.com/developer-portal/v2/recipes/create-an-api-key/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/authentication/drata-authentication.yml
📖
Documentation
https://developers.drata.com/openapi/reference/v2/tag/Custom-Connections/
📖
GettingStarted
https://developers.drata.com/developer-portal/v2/recipes/custom-connections/
📖
Documentation
https://docs.safebase.io/reference/getaccounts
📖
APIReference
https://docs.safebase.io/reference/getaccounts

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/openapi/drata-policies-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/drata:drata-policies-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

drata-policies-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Drata Policies API
  description: '### What''s New in V2

    - Support for Custom Fields

    - Get and acknowledge user''s assigned policies

    - Payloads are streamlined to include only the essential information. You can expand related objects and collections using the `expand` query parameter.

    - Cursor-based pagination for greater efficiency and stability with large datasets


    ### Getting Started

    Please visit our help article to learn how to create an API key.


    ### Upgrading From Version 1

    API V2 is designed to provide a faster an more flexible way of accessing Drata. There are several differences from V1:

    - The listing endpoints now use **cursor-based pagination**. This provides faster responses and ensures that all records can be retrieved even, if they are changed during the process.


    ```javascript

    async function fetchAll() {

    // The first request doesn''t send a value for the cursor.

    let cursor = undefined;

    do {

    const query = new URLSearchParams({ cursor });

    const resp = await fetch(

    `https://public-api.drata.com/public/v2/users?${query}`,

    {

    method: ''GET'',

    headers: { Authorization: ''Bearer '' }

    }

    );

    const data = await resp.json();

    console.log(data);


    // If there''s a cursor value returned, then there are more results.

    // Pass that back as a query parameter to get the next page of data.

    cursor = data?.pagination?.cursor;

    } while (cursor)

    }

    fetchAll();

    ```

    - You''ll notice smaller responses. Most endpoints accept an `expand` query parameter that let''s you specify which related objects and collections you want to expand.'
  version: V2
  contact: {}
servers:
- url: https://public-api.drata.com/public/v2
- url: https://public-api.eu.drata.com/public/v2
- url: https://public-api.apac.drata.com/public/v2
tags:


# --- truncated at 32 KB (79 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/openapi/drata-policies-api-openapi.yml