Drata

Drata Vendor Security Reviews API

Vendor Security Reviews track the status of security reviews for Vendors. You can create a security review, upload questionnaires, and track the progress of the review. The [help docs](https://help.drata.com/en/articles/9676307-start-and-manage-security-reviews-for-your-vendors) have more information.

GitHub OpenAPI
Business capability
Supplier Risk Management BC-510.30

Operations 11

GET /vendors/{vendorId}/security-reviews List Vendor Security Reviews #
POST /vendors/{vendorId}/security-reviews Create Vendor Security Review #
POST /vendors/{vendorId}/security-reviews/with-file Create Vendor Security Review with File #
GET /vendor-security-reviews List Vendor Security Reviews Across Vendors #
GET /vendors/{vendorId}/security-reviews/{securityReviewId} Get Vendor Security Review 🧪 #
PUT /vendors/{vendorId}/security-reviews/{securityReviewId} Update Vendor Security Review 🧪 #
POST /vendors/{vendorId}/security-questionnaires Upload Security Questionnaire #
GET /vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires List Security Review Questionnaires 🧪 #
POST /vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires Upload Security Questionnaire #
GET /vendors/{vendorId}/security-reviews/{securityReviewId}/actions List Security Review Actions 🧪 #
POST /vendors/{vendorId}/security-reviews/{securityReviewId}/actions Perform Security Review Action 🧪 #

Documentation

📖
Documentation
https://developers.drata.com/openapi/reference/v2/overview/
📖
APIReference
https://developers.drata.com/openapi/reference/v2/overview/
📖
GettingStarted
https://developers.drata.com/developer-portal/v2/recipes/create-an-api-key/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/authentication/drata-authentication.yml
📖
Documentation
https://developers.drata.com/openapi/reference/v2/tag/Custom-Connections/
📖
GettingStarted
https://developers.drata.com/developer-portal/v2/recipes/custom-connections/
📖
Documentation
https://docs.safebase.io/reference/getaccounts
📖
APIReference
https://docs.safebase.io/reference/getaccounts

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/openapi/drata-vendor-security-reviews-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/drata-vendor-security-reviews-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

drata-vendor-security-reviews-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Drata Vendor Security Reviews API
  version: V2
  contact: {}
  description: 'Operations tagged Vendor Security Reviews across 2 of this provider''s published API definitions: drata-api-v2-openapi.json, drata-api-v2-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://public-api.drata.com/public/v2
- url: https://public-api.eu.drata.com/public/v2
- url: https://public-api.apac.drata.com/public/v2
tags:
- name: Vendor Security Reviews
  description: Vendor Security Reviews track the status of security reviews for Vendors. You can create a security review, upload questionnaires, and track the progress of the review. The [help docs](https://help.drata.com/en/articles/9676307-start-and-manage-security-reviews-for-your-vendors) have more information.
paths:
  /vendors/{vendorId}/security-reviews:
    get:
      description: 'Get a paginated list of all Security Reviews for a given Vendor.


        🔒 Requires **Vendors: List Vendors** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_listVendorSecurityReviews
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: status[]
        required: false
        in: query
        description: Filter by security review status
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewStatusEnum'
      - name: type[]
        required: false
        in: query
        description: Filter by security review type
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewTypeEnum'
      - name: decision[]
        required: false
        in: query
        description: Filter by security review decision
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewDecisionEnum'
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewExpandEnum'
      - name: createdAtFrom
        required: false
        in: query
        description: Filter to Security Reviews created on or after this value (inclusive).
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: createdAtTo
        required: false
        in: query
        description: Filter to Security Reviews created on or before this value (inclusive).
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: updatedAtFrom
        required: false
        in: query
        description: Filter to Security Reviews last updated on or after this value (inclusive)
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: updatedAtTo
        required: false
        in: query
        description: Filter to Security Reviews last updated on or before this value (inclusive).
        schema:
          format: date
          example: '2020-07-06'
          type: string
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityReviewsResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Vendor Security Reviews
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-get
      x-product-area:
      - VENDOR_PUBLIC_API
    post:
      description: 'Create a new Security Review for a given Vendor.


        🔒 Requires **Vendors: Create Security Review** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_createVendorSecurityReview
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VendorSecurityReviewCreateRequestPublicV2Dto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityReviewResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Create Vendor Security Review
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-post-security-review
      x-product-area:
      - VENDOR_PUBLIC_API
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /vendors/{vendorId}/security-reviews/with-file:
    post:
      description: 'Create a new Security Review for a given Vendor with file upload in a single atomic operation.


        🔒 Requires **Vendors: Create Security Review** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_createVendorSecurityReviewWithFile
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VendorSecurityReviewWithFileCreateRequestPublicV2Dto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityReviewResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Create Vendor Security Review with File
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-post-security-review
      x-product-area:
      - VENDOR_PUBLIC_API
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /vendor-security-reviews:
    get:
      description: 'Get a paginated list of Security Reviews across all Vendors in the account, subject to the caller''s vendor access. Supports the same filters as the per-vendor list plus optional `vendorIds[]` narrowing. When the caller has restricted vendor access, results are limited to the intersection of the vendors they are permitted to see and the (optional) `vendorIds[]` filter.


        🔒 Requires **Vendors: List Vendors** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_listVendorSecurityReviewsAcrossVendors
      parameters:
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: status[]
        required: false
        in: query
        description: Filter by security review status
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewStatusEnum'
      - name: type[]
        required: false
        in: query
        description: Filter by security review type
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewTypeEnum'
      - name: decision[]
        required: false
        in: query
        description: Filter by security review decision
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewDecisionEnum'
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewsAcrossVendorsExpandEnum'
      - name: createdAtFrom
        required: false
        in: query
        description: Filter to Security Reviews created on or after this value (inclusive).
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: createdAtTo
        required: false
        in: query
        description: Filter to Security Reviews created on or before this value (inclusive).
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: updatedAtFrom
        required: false
        in: query
        description: Filter to Security Reviews last updated on or after this value (inclusive)
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: updatedAtTo
        required: false
        in: query
        description: Filter to Security Reviews last updated on or before this value (inclusive).
        schema:
          format: date
          example: '2020-07-06'
          type: string
      - name: vendorIds[]
        required: false
        in: query
        description: Filter to Security Reviews for these Vendor IDs. When the caller has restricted vendor access, the effective set is the intersection of this parameter and their permitted vendors.
        schema:
          uniqueItems: true
          example:
          - 1
          - 2
          - 3
          type: array
          items:
            type: number
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityReviewsResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Vendor Security Reviews Across Vendors
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-get
      x-product-area:
      - VENDOR_PUBLIC_API
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /vendors/{vendorId}/security-reviews/{securityReviewId}:
    get:
      description: 'Get a specific Security Review for a given Vendor. For SOC_REPORT reviews the response includes a `socReview` field with the SOC form data.


        🧪 **Note:** This endpoint is in beta and may change.


        🔒 Requires **Vendors: List Vendors** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_getVendorSecurityReview
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      - name: securityReviewId
        required: true
        in: path
        schema:
          type: number
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/VendorSecurityReviewExpandEnum'
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityReviewResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Get Vendor Security Review 🧪
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-get
      x-product-area:
      - VENDOR_PUBLIC_API
    put:
      description: 'Update a Vendor Security Review. The `title` field applies to all security review types. The `socForm` field is only processed when securityReviewType is SOC_REPORT.


        🧪 **Note:** This endpoint is in beta and may change.


        🔒 Requires **Vendors: Update Security Review** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_updateVendorSecurityReview
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      - name: securityReviewId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VendorSecurityReviewUpdateRequestPublicV2Dto'
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityReviewResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Update Vendor Security Review 🧪
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-put-security-review
      x-product-area:
      - VENDOR_PUBLIC_API
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /vendors/{vendorId}/security-questionnaires:
    post:
      operationId: VendorSecurityReviewsPublicV2Controller_sendSecurityQuestionnaire
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/VendorSecurityReviewQuestionnaireCreateRequestPublicV2Dto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityQuestionnaireResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Upload Security Questionnaire
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-post-upload-questionnaires
      x-product-area:
      - VENDOR_PUBLIC_API
      description: '🔒 Requires **Vendors: Upload Security Questionnaire** permission.'
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires:
    get:
      description: 'List the questionnaires that belong to a Vendor Security Review. Cursor-paginated. Archived or soft-deleted questionnaires are excluded from the response.


        🧪 **Note:** This endpoint is in beta and may change.


        🔒 Requires **Vendors: List Vendor Questionnaire** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_listVendorSecurityReviewSecurityQuestionnaires
      parameters:
      - name: vendorId
        required: true
        in: path
        description: The numeric ID of the vendor.
        schema:
          type: number
      - name: securityReviewId
        required: true
        in: path
        description: The numeric ID of the security review.
        schema:
          type: number
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityQuestionnairesResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Security Review Questionnaires 🧪
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-get-questionnaires
      x-product-area:
      - VENDOR_PUBLIC_API
    post:
      description: 'Upload a Security Questionnaire to a Vendor for a specific Security Review.


        🔒 Requires **Vendors: Upload Security Questionnaire** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_sendSecurityQuestionnaireForSecurityReview
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      - name: securityReviewId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/VendorSecurityReviewQuestionnaireCreateRequestPublicV2Dto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorSecurityQuestionnaireResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Upload Security Questionnaire
      tags:
      - Vendor Security Reviews
      x-drata-permissions:
      - vendors-post-upload-questionnaires
      x-product-area:
      - VENDOR_PUBLIC_API
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /vendors/{vendorId}/security-reviews/{securityReviewId}/actions:
    get:
      description: 'List available actions for a security review based on its current state (e.g. Finalize, Reopen). Supported for all security review types (SECURITY, SOC_REPORT, UPLOAD_REPORT). SOC_REPORT reviews additionally require the linked vendor report review to pass readiness validation before Finalize is offered.


        🧪 **Note:** This endpoint is in beta and may change.


        🔒 Requires **Vendors: List Security Review Actions** permission.'
      operationId: VendorSecurityReviewsPublicV2Controller_listSecurityReviewActions
      parameters:
      - name: vendorId
        required: true
        in: path
        schema:
          type: number
      - name: securityReviewId
        required: true
        in: path
        schema:
          type: number
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityReviewActionsResponsePublicV2Dto'
        '401':
          description: I

# --- truncated at 32 KB (76 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/openapi/drata-vendor-security-reviews-api-openapi.yml