Audits

Duplicate an IRL audit

Duplicates an existing IRL audit into a new audit engagement with the supplied displayName, audit dates, early access date, and auditor roster. Company, audit type, and framework are copied from the source audit and cannot be changed.

Each email in allowAuditorEmails must match an active user in the authenticated audit firm’s domain. Provision auditors via POST /auditors before referencing them here, or copy emails from GET /audits/{sourceAuditId} → allowAuditorEmails when duplicating with the same roster.

Information requests are copied from the source audit. After duplication:

Requests with Vanta evidence will be pre-filled and marked as internal review.

Review them before sharing with your customer.
Requests where evidence was not available or was uploaded externally will need

evidence added manually.
Evidence capture dates and due dates can be modified after duplication.

Rate limit: 10 requests / minute.

POST

audits

duplicate

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.duplicate({
    sourceAuditId: "<id>",
    displayName: "Orpha.Schoen",
    auditStartDate: new Date("2024-01-02T08:34:53.150Z"),
    auditEndDate: new Date("2024-10-06T07:06:05.931Z"),
    earlyAccessStartsAt: new Date("2025-05-31T02:08:59.254Z"),
    allowAuditorEmails: [
      "<value 1>",
      "<value 2>",
      "<value 3>",
    ],
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.components.DuplicateAuditRequest;
import com.vanta.vanta_auditor_api.models.operations.DuplicateResponse;
import java.lang.Exception;
import java.time.OffsetDateTime;
import java.util.List;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        DuplicateAuditRequest req = DuplicateAuditRequest.builder()
                .sourceAuditId("<id>")
                .displayName("Orpha.Schoen")
                .auditStartDate(OffsetDateTime.parse("2024-01-02T08:34:53.150Z"))
                .auditEndDate(OffsetDateTime.parse("2024-10-06T07:06:05.931Z"))
                .earlyAccessStartsAt(OffsetDateTime.parse("2025-05-31T02:08:59.254Z"))
                .allowAuditorEmails(List.of(
                    "<value 1>",
                    "<value 2>",
                    "<value 3>"))
                .build();

        DuplicateResponse res = sdk.audits().duplicate()
                .request(req)
                .call();

        if (res.audit().isPresent()) {
            System.out.println(res.audit().get());
        }
    }
}

curl --request POST \
  --url https://api.vanta.com/v1/audits/duplicate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "sourceAuditId": "<string>",
  "displayName": "<string>",
  "auditStartDate": "2023-11-07T05:31:56Z",
  "auditEndDate": "2023-11-07T05:31:56Z",
  "earlyAccessStartsAt": "2023-11-07T05:31:56Z",
  "allowAuditorEmails": [
    "<string>"
  ]
}
'

import requests

url = "https://api.vanta.com/v1/audits/duplicate"

payload = {
    "sourceAuditId": "<string>",
    "displayName": "<string>",
    "auditStartDate": "2023-11-07T05:31:56Z",
    "auditEndDate": "2023-11-07T05:31:56Z",
    "earlyAccessStartsAt": "2023-11-07T05:31:56Z",
    "allowAuditorEmails": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    sourceAuditId: '<string>',
    displayName: '<string>',
    auditStartDate: '2023-11-07T05:31:56Z',
    auditEndDate: '2023-11-07T05:31:56Z',
    earlyAccessStartsAt: '2023-11-07T05:31:56Z',
    allowAuditorEmails: ['<string>']
  })
};

fetch('https://api.vanta.com/v1/audits/duplicate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/duplicate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'sourceAuditId' => '<string>',
    'displayName' => '<string>',
    'auditStartDate' => '2023-11-07T05:31:56Z',
    'auditEndDate' => '2023-11-07T05:31:56Z',
    'earlyAccessStartsAt' => '2023-11-07T05:31:56Z',
    'allowAuditorEmails' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/duplicate"

	payload := strings.NewReader("{\n  \"sourceAuditId\": \"<string>\",\n  \"displayName\": \"<string>\",\n  \"auditStartDate\": \"2023-11-07T05:31:56Z\",\n  \"auditEndDate\": \"2023-11-07T05:31:56Z\",\n  \"earlyAccessStartsAt\": \"2023-11-07T05:31:56Z\",\n  \"allowAuditorEmails\": [\n    \"<string>\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/duplicate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"sourceAuditId\": \"<string>\",\n  \"displayName\": \"<string>\",\n  \"auditStartDate\": \"2023-11-07T05:31:56Z\",\n  \"auditEndDate\": \"2023-11-07T05:31:56Z\",\n  \"earlyAccessStartsAt\": \"2023-11-07T05:31:56Z\",\n  \"allowAuditorEmails\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "65fc81a3359c8508c9af880f",
  "customerOrganizationName": "corporation.com",
  "customerDisplayName": "Corporation Company",
  "customerOrganizationId": "65fc81a3359c8508c9af880f",
  "auditStartDate": "2024-03-07T21:25:56.000Z",
  "auditEndDate": "2024-03-14T21:25:56.000Z",
  "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z",
  "framework": "SOC 2 Type II",
  "displayName": "Q1 2024 SOC 2 Audit",
  "allowAuditorEmails": [
    "sam@auditor.com"
  ],
  "allowAllAuditors": true,
  "deletionDate": "2024-03-07T21:25:56.000Z",
  "creationDate": "2024-03-07T21:25:56.000Z",
  "modificationDate": "2024-03-07T21:25:56.000Z",
  "completionDate": "2024-03-07T21:25:56.000Z",
  "auditFocus": "EXTERNAL",
  "auditorRequestListMetadata": {
    "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z"
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

Request body for duplicating an IRL audit into a new audit engagement.

sourceAuditId

string

required

ID of the source IRL audit to duplicate.

displayName

string

required

Display name for the new audit engagement.

auditStartDate

string<date-time>

required

Start of the audit window for the new audit.

auditEndDate

string<date-time>

required

End of the audit window for the new audit.

earlyAccessStartsAt

string<date-time>

required

When auditors gain access to the new audit.

allowAuditorEmails

string[]

required

Emails of auditors who may access the new audit. Minimum one entry required. Each email must match an active user in the authenticated audit firm's domain.

Response

200 - application/json

string

required

The unique identifier for the audit.

customerOrganizationName

string

required

The domain name of the customer organization being audited (e.g. vanta.com)

customerDisplayName

string | null

required

The human readable name of the customer organization being audited (e.g. Vanta)

customerOrganizationId

string

required

The uuid of the customer organization being audited

auditStartDate

string<date-time>

required

The start of the audit window. This is also when data collection for audit starts.

auditEndDate

string<date-time>

required

The end of the audit window.

earlyAccessStartsAt

string<date-time> | null

required

Timestamp at which auditors gain access to the audit. Occurs before the audit window begins

framework

string

required

The name of the framework for the audit

displayName

string

required

The display name for the audit. Returns the custom audit name if set, otherwise returns the framework name.

allowAuditorEmails

string[]

required

Emails of auditors with access to audit

allowAllAuditors

boolean

required

Set to true if all auditors in audit firm have access

deletionDate

string<date-time> | null

required

Timestamp when the audit was deleted

creationDate

string<date-time>

required

Timestamp when the audit was created

modificationDate

string<date-time> | null

required

Timestamp when the audit was updated

completionDate

string<date-time> | null

required

Timestamp when the audit was marked completed, and report was uploaded

auditFocus

enum<string>

required

Audit focus determines if the audit is internal or external facing

Available options:

EXTERNAL,

INTERNAL

auditorRequestListMetadata

object

Metadata about the auditor request list. This field is only present for IRL (Information Request List) based audits and will be undefined for standard audits. Use the presence of this field to differentiate between IRL and non-IRL audits.

Show child attributes

Get audit by IDReturns a single audit by ID, scoped to the audit firm. To identify IRL (Information Request List) audits, check for the presence of the `auditorRequestListMetadata` field. This field is only present for IRL-based audits and will be `undefined` for standard audits. Rate limit: 250 requests / minute.

⌘I

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.duplicate({
    sourceAuditId: "<id>",
    displayName: "Orpha.Schoen",
    auditStartDate: new Date("2024-01-02T08:34:53.150Z"),
    auditEndDate: new Date("2024-10-06T07:06:05.931Z"),
    earlyAccessStartsAt: new Date("2025-05-31T02:08:59.254Z"),
    allowAuditorEmails: [
      "<value 1>",
      "<value 2>",
      "<value 3>",
    ],
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.components.DuplicateAuditRequest;
import com.vanta.vanta_auditor_api.models.operations.DuplicateResponse;
import java.lang.Exception;
import java.time.OffsetDateTime;
import java.util.List;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        DuplicateAuditRequest req = DuplicateAuditRequest.builder()
                .sourceAuditId("<id>")
                .displayName("Orpha.Schoen")
                .auditStartDate(OffsetDateTime.parse("2024-01-02T08:34:53.150Z"))
                .auditEndDate(OffsetDateTime.parse("2024-10-06T07:06:05.931Z"))
                .earlyAccessStartsAt(OffsetDateTime.parse("2025-05-31T02:08:59.254Z"))
                .allowAuditorEmails(List.of(
                    "<value 1>",
                    "<value 2>",
                    "<value 3>"))
                .build();

        DuplicateResponse res = sdk.audits().duplicate()
                .request(req)
                .call();

        if (res.audit().isPresent()) {
            System.out.println(res.audit().get());
        }
    }
}

curl --request POST \
  --url https://api.vanta.com/v1/audits/duplicate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "sourceAuditId": "<string>",
  "displayName": "<string>",
  "auditStartDate": "2023-11-07T05:31:56Z",
  "auditEndDate": "2023-11-07T05:31:56Z",
  "earlyAccessStartsAt": "2023-11-07T05:31:56Z",
  "allowAuditorEmails": [
    "<string>"
  ]
}
'

import requests

url = "https://api.vanta.com/v1/audits/duplicate"

payload = {
    "sourceAuditId": "<string>",
    "displayName": "<string>",
    "auditStartDate": "2023-11-07T05:31:56Z",
    "auditEndDate": "2023-11-07T05:31:56Z",
    "earlyAccessStartsAt": "2023-11-07T05:31:56Z",
    "allowAuditorEmails": ["<string>"]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    sourceAuditId: '<string>',
    displayName: '<string>',
    auditStartDate: '2023-11-07T05:31:56Z',
    auditEndDate: '2023-11-07T05:31:56Z',
    earlyAccessStartsAt: '2023-11-07T05:31:56Z',
    allowAuditorEmails: ['<string>']
  })
};

fetch('https://api.vanta.com/v1/audits/duplicate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/duplicate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'sourceAuditId' => '<string>',
    'displayName' => '<string>',
    'auditStartDate' => '2023-11-07T05:31:56Z',
    'auditEndDate' => '2023-11-07T05:31:56Z',
    'earlyAccessStartsAt' => '2023-11-07T05:31:56Z',
    'allowAuditorEmails' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/duplicate"

	payload := strings.NewReader("{\n  \"sourceAuditId\": \"<string>\",\n  \"displayName\": \"<string>\",\n  \"auditStartDate\": \"2023-11-07T05:31:56Z\",\n  \"auditEndDate\": \"2023-11-07T05:31:56Z\",\n  \"earlyAccessStartsAt\": \"2023-11-07T05:31:56Z\",\n  \"allowAuditorEmails\": [\n    \"<string>\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/duplicate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"sourceAuditId\": \"<string>\",\n  \"displayName\": \"<string>\",\n  \"auditStartDate\": \"2023-11-07T05:31:56Z\",\n  \"auditEndDate\": \"2023-11-07T05:31:56Z\",\n  \"earlyAccessStartsAt\": \"2023-11-07T05:31:56Z\",\n  \"allowAuditorEmails\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "65fc81a3359c8508c9af880f",
  "customerOrganizationName": "corporation.com",
  "customerDisplayName": "Corporation Company",
  "customerOrganizationId": "65fc81a3359c8508c9af880f",
  "auditStartDate": "2024-03-07T21:25:56.000Z",
  "auditEndDate": "2024-03-14T21:25:56.000Z",
  "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z",
  "framework": "SOC 2 Type II",
  "displayName": "Q1 2024 SOC 2 Audit",
  "allowAuditorEmails": [
    "sam@auditor.com"
  ],
  "allowAllAuditors": true,
  "deletionDate": "2024-03-07T21:25:56.000Z",
  "creationDate": "2024-03-07T21:25:56.000Z",
  "modificationDate": "2024-03-07T21:25:56.000Z",
  "completionDate": "2024-03-07T21:25:56.000Z",
  "auditFocus": "EXTERNAL",
  "auditorRequestListMetadata": {
    "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z"
  }
}