The Audits API from Vanta — 15 operation(s) for audits.
openapi: 3.0.0
info:
title: Conduct an audit Auditors Audits API
version: 1.0.0
description: The Auditor API lets audit firms conduct audits from a tool outside of Vanta. Unlock data syncing with Vanta through this API.
termsOfService: https://www.vanta.com/terms
license:
name: UNLICENSED
contact:
name: API Support
url: https://help.vanta.com/
email: support@vanta.com
servers:
- url: https://api.vanta.com/v1
tags:
- name: Audits
paths:
/audits:
get:
operationId: ListAudits
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_Audit_'
examples:
Example 1:
value:
results:
data:
- id: 65fc81a3359c8508c9af880f
customerOrganizationName: corporation.com
customerDisplayName: Corporation Company
customerOrganizationId: 65fc81a3359c8508c9af880f
auditStartDate: 2024-03-07 21:25:56+00:00
auditEndDate: 2024-03-14 21:25:56+00:00
earlyAccessStartsAt: 2024-03-07 21:25:56+00:00
framework: SOC 2 Type II
allowAuditorEmails:
- sam@auditor.com
allowAllAuditors: true
deletionDate: 2024-03-07 21:25:56+00:00
creationDate: 2024-03-07 21:25:56+00:00
modificationDate: 2024-03-07 21:25:56+00:00
completionDate: 2024-03-07 21:25:56+00:00
auditFocus: EXTERNAL
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: YXJyYXljb25uZWN0aW9uOjA=
endCursor: YXJyYXljb25uZWN0aW9uOjE=
description: Returns a paginated list of audits scoped to the audit firm.
summary: List audits
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/ListAuditsPageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
- description: Includes all audits that have changed since changedSinceDate.
in: query
name: changedSinceDate
required: false
schema:
format: date-time
type: string
- description: Includes only audits with no audit report uploaded
in: query
name: isActiveAudit
required: false
schema:
type: boolean
/audits/{auditId}/vendors:
get:
operationId: ListVendorsInAuditScope
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_Vendor_'
examples:
Example 1:
value:
results:
data:
- id: a2f7e1b9d0c3f4e5a6c7b8d8
name: Vanta
websiteUrl: https://www.vanta.com/
accountManagerName: John Doe
accountManagerEmail: john@doe.com
servicesProvided: SaaS
additionalNotes: Automate compliance and streamline security reviews with the leading trust management platform.
authDetails:
method: O_AUTH
passwordMFA: true
passwordRequiresNumber: true
passwordRequiresSymbol: true
passwordMinimumLength: 16
securityOwnerUserId: 6626afa6490ec920099773e7
businessOwnerUserId: 6626afb14c912f0a50e85619
contractStartDate: 2024-02-01 00:00:00+00:00
contractRenewalDate: 2025-02-01 00:00:00+00:00
contractTerminationDate: null
lastSecurityReviewCompletionDate: 2024-01-01 00:00:00+00:00
nextSecurityReviewDueDate: 2025-01-01 00:00:00+00:00
isVisibleToAuditors: true
isRiskAutoScored: true
category:
displayName: cloudMonitoring
riskAttributeIds:
- 6626b0298acc44f8674390da
- 6626b02ea4cd9ba80d773c20
status: MANAGED
inherentRiskLevel: HIGH
residualRiskLevel: MEDIUM
vendorHeadquarters: USA
contractAmount:
amount: 1000000
currency: USD
customFields: null
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: 6696ea0595df50d5cd6ec3b7
endCursor: 6696ece48eb1f98ff3d927c6
description: Returns a list of vendors who are in scope for this audit.
summary: List of vendors who are in scope for this audit
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
/audits/{auditId}/monitored-computers:
get:
operationId: ListMonitoredComputersInAuditScope
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_MonitoredComputer_'
examples:
Example 1:
value:
results:
data:
- id: 5f2c939a52855e725c8d5823
integrationId: vantaAgent
serialNumber: FVFGPGV2Q6L5
udid: 280FF071-1D7A-5752-BD3A-1A68937CD187
lastCheckDate: 2024-03-07 18:46:05.944000+00:00
screenlock:
outcome: FAIL
diskEncryption:
outcome: FAIL
passwordManager:
outcome: FAIL
antivirusInstallation:
outcome: FAIL
operatingSystem:
type: macOS
version: 13.2.1
owner:
id: 65e1efde08e8478f143a8ff9
emailAddress: example-person@email.com
displayName: Example Owner
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: 5f2c939a52855e725c8d5823
endCursor: 5f2c939a52855e725c8d5823
description: 'Returns a list of computers monitored by an MDM (with an integration built
by Vanta) or by the Vanta Agent. Currently this list does not include
resources from partner or customer-built integrations.'
summary: List monitored computers
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
- description: Filters for monitored computers matching any status declared in the filter.
in: query
name: complianceStatusFilterMatchesAny
required: false
schema:
type: array
items:
$ref: '#/components/schemas/ComputerStatusFilter'
/audits/{auditId}/evidence/{auditEvidenceId}/urls:
get:
operationId: ListAuditEvidenceUrls
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_EvidenceUrl_'
examples:
Example 1:
value:
results:
data:
- id: NjVmYzgxYTMzNTljODUwOGM5YWY4ODBm
url: https://s3.amazonaws.com/audit-evidence/2022/audit.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=secret%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20221104T140227Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=b228dbec8c1008c80c162e1210e4503dceead1e4d4751b4d9787314fd6da4d55
filename: example.jpg
isDownloadable: true
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: YXJyYXljb25uZWN0aW9uOjA=
endCursor: YXJyYXljb25uZWN0aW9uOjE=
totalCount: 1
description: 'Returns a paginated list of evidence urls for an audit. This endpoint should be called whenever an
evidence is created or has a statusUpdatedAt field that is more recent than the most recent polling event.'
summary: List audit evidence url
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: path
name: auditEvidenceId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
/audits/{auditId}/people:
get:
operationId: ListPeopleInAuditScope
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_Person_'
examples:
Example 1:
value:
results:
data:
- id: 65e1efde08e8478f143a8ff9
emailAddress: example-person@email.com
employment:
endDate: null
jobTitle: Customer success manager
startDate: 2021-01-01 00:00:00+00:00
status: CURRENT
leaveInfo: null
groupIds:
- 5f2c939a52855e725c8d5824
name:
display: Example Person
last: Person
first: Example
sources:
emailAddress:
integrationId: gsuiteadmin
resourceId: 660c701d3d344e660b032306
type: INTEGRATION
employment:
startDate:
integrationId: gusto
resourceId: 660c70783d344e660b032323
type: INTEGRATION
endDate:
integrationId: gusto
resourceId: 660c70783d344e660b032323
type: INTEGRATION
tasksSummary:
completionDate: null
dueDate: 2021-12-01 00:00:00+00:00
status: OVERDUE
details:
completeTrainings:
taskType: COMPLETE_TRAININGS
status: COMPLETE
dueDate: 2021-12-01 00:00:00+00:00
completionDate: 2021-11-01 00:00:00+00:00
disabled:
date: 2021-11-01 00:00:00+00:00
reason: Training Vanta tests have been disabled for this person
incompleteTrainings:
- name: Security training 1
- name: Security training 2
completedTrainings:
- name: Security training 3
- name: Security training 4
acceptPolicies:
taskType: ACCEPT_POLICIES
status: COMPLETE
dueDate: 2021-12-01 00:00:00+00:00
completionDate: 2021-11-01 00:00:00+00:00
disabled: null
unacceptedPolicies:
- name: Policy 1
- name: Policy 2
acceptedPolicies:
- name: Policy 3
- name: Policy 4
completeCustomTasks:
taskType: COMPLETE_CUSTOM_TASKS
status: OVERDUE
dueDate: 2021-12-01 00:00:00+00:00
completionDate: 2021-11-01 00:00:00+00:00
disabled:
date: 2021-11-01 00:00:00+00:00
reason: Custom task Vanta tests have been disabled for this person
incompleteCustomTasks:
- name: Custom task 1
- name: Custom task 2
completedCustomTasks:
- name: Custom task 3
- name: Custom task 4
completeOffboardingCustomTasks:
taskType: COMPLETE_CUSTOM_OFFBOARDING_TASKS
status: COMPLETE
dueDate: 2021-12-01 00:00:00+00:00
completionDate: 2021-11-01 00:00:00+00:00
disabled: null
incompleteCustomOffboardingTasks: []
completedCustomOffboardingTasks:
- name: Custom offboarding task 1
- name: Custom offboarding task 2
installDeviceMonitoring:
taskType: INSTALL_DEVICE_MONITORING
status: DUE_SOON
dueDate: 2021-12-01 00:00:00+00:00
completionDate: null
disabled: null
completeBackgroundChecks:
taskType: COMPLETE_BACKGROUND_CHECKS
status: COMPLETE
dueDate: 2021-12-01 00:00:00+00:00
completionDate: 2021-11-01 00:00:00+00:00
disabled: null
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: 65e1efde08e8478f143a8ff9
endCursor: 65e1efde08e8478f143a8ff9
description: Returns a list of people who are in scope for this audit.
summary: List of people who are in scope for this audit
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
- description: Filter individuals by those whose tasksSummary status is any of the provided values.
in: query
name: tasksSummaryStatusMatchesAny
required: false
schema:
type: array
items:
$ref: '#/components/schemas/TasksSummaryStatus'
- description: 'Requires taskStatusMatchesAny. Includes all people for whom any of the provided taskType values in taskTypeMatchesAny
is any of the provided taskStatus values in taskStatusMatchesAny.'
in: query
name: taskTypeMatchesAny
required: false
schema:
type: array
items:
$ref: '#/components/schemas/TaskType'
- description: 'Requires taskTypeMatchesAny. Includes all people for whom any of the provided taskType values in taskTypeMatchesAny
is any of the provided taskStatus values in taskStatusMatchesAny.'
in: query
name: taskStatusMatchesAny
required: false
schema:
type: array
items:
$ref: '#/components/schemas/TaskStatus'
/audits/{auditId}/vulnerability-remediations:
get:
operationId: ListVulnerabilityRemediationsInAuditScope
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_VulnerabilityRemediation_'
examples:
Example 1:
value:
results:
pageInfo:
hasNextPage: true
hasPreviousPage: false
startCursor: YXJyYXljb25uZWN0aW9uOjA=
endCursor: YXJyYXljb25uZWN0aW9uOjE=
data:
- id: a2f7e1b9d0c3f4e5a6c7b8d9
vulnerabilityId: a2f7e1b9d0c3f4e5a6c7b8d8
vulnerableAssetId: a2f7e1b9d0c3f4e5a6c7b8d7
severity: critical
detectedDate: 2021-01-01 00:00:00+00:00
slaDeadlineDate: 2021-03-01 00:00:00+00:00
remediationDate: 2021-02-01 00:00:00+00:00
description: List all vulnerability remediations based on selected filters that are in scope for this audit.
summary: List vulnerability remediations that are in scope for this audit
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
- description: Filter vulnerability remediations based on a specific scanner integration.
in: query
name: integrationId
required: false
schema:
type: string
- description: 'Filter vulnerability remediations by severity.
Possible values: CRITICAL, HIGH, MEDIUM, LOW.'
in: query
name: severity
required: false
schema:
$ref: '#/components/schemas/ExternalFindingSeverity'
- description: Filter vulnerability remediations by remediation status.
in: query
name: isRemediatedOnTime
required: false
schema:
type: boolean
- description: Filter vulnerability remediations that occurred after a specific timestamp.
in: query
name: remediatedAfterDate
required: false
schema:
format: date-time
type: string
- description: Filter vulnerability remediations that occurred before a specific timestamp.
in: query
name: remediatedBeforeDate
required: false
schema:
format: date-time
type: string
/audits/{auditId}/evidence:
get:
operationId: ListAuditEvidence
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_Evidence_'
examples:
Example 1:
value:
results:
data:
- id: 65fc81a3359c8508c9af880f
externalId: cG9saWN5OmFjY2Vzcy1jb250cm9sLXBvbGljeQo=
status: Ready for audit
statusUpdatedDate: 2024-03-07 21:25:56+00:00
name: Access Control Policy
deletionDate: 2024-03-07 21:25:56+00:00
creationDate: 2024-03-07 21:25:56+00:00
testStatus: The test was passing during this period
evidenceType: Policy
evidenceId: access-control-policy
relatedControls:
- name: CRY-104
sectionNames:
- Article 13
description: example description of test
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: YXJyYXljb25uZWN0aW9uOjA=
endCursor: YXJyYXljb25uZWN0aW9uOjE=
description: Returns a paginated list of evidence for an audit.
summary: List audit evidence
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
- description: Includes all audit evidence that have changed since changedSinceDate.
in: query
name: changedSinceDate
required: false
schema:
format: date-time
type: string
/audits/{auditId}/comments:
get:
operationId: ListAuditComments
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_Comment_'
examples:
Example 1:
value:
results:
data:
- id: 65fc81a3359c8508c9af880f
auditEvidenceId: 65fc81a3359c8508c9af880f
text: Some comment
creationDate: 2024-03-07 21:25:56+00:00
modificationDate: 2024-03-07 21:25:56+00:00
deletionDate: 2024-03-07 21:25:56+00:00
email: vlad@vantaroo.com
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: YXJyYXljb25uZWN0aW9uOjA=
endCursor: YXJyYXljb25uZWN0aW9uOjE=
description: Returns a paginated list of comments for an audit.
summary: List audit comments
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
- description: Includes all comments that have changed since changedSinceDate.
in: query
name: changedSinceDate
required: false
schema:
format: date-time
type: string
/audits/{auditId}/controls:
get:
operationId: ListAuditControls
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedResponse_AuditorControl_'
examples:
Example 1:
value:
results:
data:
- id: a2f7e1b9d0c3f4e5a6c7b8d9
externalId: CRY-104
name: Data encryption utilized
description: Access reviews are performed to ensure that access is appropriate for the user's role and responsibilities.
source: Vanta
domains:
- CRYPTOGRAPHIC_PROTECTIONS
owner:
id: 65e1efde08e8478f143a8ff9
emailAddress: example-person@email.com
displayName: Example Owner
framework: soc2
role: null
customFields: []
sections:
- framework: HITRUST
name: IPP
pageInfo:
hasNextPage: false
hasPreviousPage: false
startCursor: YXJyYXljb25uZWN0aW9uOjA=
endCursor: YXJyYXljb25uZWN0aW9uOjE=
description: Returns a paginated list of controls for an audit.
summary: List audit controls
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: query
name: pageSize
required: false
schema:
$ref: '#/components/schemas/PageSize'
- in: query
name: pageCursor
required: false
schema:
$ref: '#/components/schemas/PageCursor'
/audits/{auditId}/evidence/{auditEvidenceId}/comments:
post:
operationId: CreateCommentForAuditEvidence
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/Comment'
examples:
Example 1:
value:
id: 65fc81a3359c8508c9af880f
auditEvidenceId: 65fc81a3359c8508c9af880f
text: Some comment
creationDate: 2024-03-07 21:25:56+00:00
modificationDate: 2024-03-07 21:25:56+00:00
deletionDate: 2024-03-07 21:25:56+00:00
email: vlad@vantaroo.com
description: Create a comment in Vanta for a piece of evidence.
summary: Create a comment for audit evidence
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: path
name: auditEvidenceId
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/AddCommentInput'
/audits/{auditId}/evidence/{auditEvidenceId}:
patch:
operationId: UpdateAuditEvidence
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/Evidence'
examples:
Example 1:
value:
id: 65fc81a3359c8508c9af880f
externalId: cG9saWN5OmFjY2Vzcy1jb250cm9sLXBvbGljeQo=
status: Ready for audit
statusUpdatedDate: 2024-03-07 21:25:56+00:00
name: Access Control Policy
deletionDate: 2024-03-07 21:25:56+00:00
creationDate: 2024-03-07 21:25:56+00:00
testStatus: The test was passing during this period
evidenceType: Policy
evidenceId: access-control-policy
relatedControls:
- name: CRY-104
sectionNames:
- Article 13
description: example description of test
description: Update audit evidence.
summary: Update audit evidence
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
- in: path
name: auditEvidenceId
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/AuditEvidenceUpdateInput'
/audits/{auditId}/evidence/custom-evidence-requests:
post:
operationId: CreateCustomEvidenceRequest
responses:
'200':
description: Ok
content:
application/json:
schema:
$ref: '#/components/schemas/CustomEvidenceRequest'
examples:
Example 1:
value:
id: 65fc81a3359c8508c9af880f
controlIds:
- 1.1.2.a
title: Access Control Policy
description: Description for Access Control Policy
cadence: P6M
reminderWindow: P6M
isRestricted: true
description: Create a custom evidence request for an audit.
summary: Create a custom evidence request for an audit
tags:
- Audits
security:
- bearerAuth: []
parameters:
- in: path
name: auditId
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateCustomEvidenceRequestInput'
/audits/{auditId}/controls/custom-controls:
post:
operationId: CreateCustomControl
responses:
'201':
description: Custom control created
content:
application/json:
schema:
$ref: '#/components/schemas/Control'
examples:
Example 1:
value:
id: a2f7e1b9d0c3f4e5a6c7b8d9
externalId: CRY-104
name: Data encryption utilized
description: Access reviews are performed to ensure that access is appropriate for the user's role and responsibilities.
source: Vanta
domains:
- CRYPTOGRAPHIC_PROTECTIONS
owner:
id: 65e1efde08e8478f143a8ff9
emailAddress: example-person@email.com
displayName: Example Owner
role: CONTROLLER
customFields:
- label: Additional context
value: This control is critical for GDPR compliance
description: Create a custom control for an audit.
summary: Create a custom
# --- truncated at 32 KB (111 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/vanta/refs/heads/main/openapi/vanta-audits-api-openapi.yml