Get an information request comment by ID
Retrieves a single comment on an information request by its ID.
Soft-deleted comments (where deletionDate !== null) are included in the
response. Clients should check deletionDate to determine whether the
comment has been deleted. This matches
GET /audits/{auditId}/information-requests/{requestId}/comments, which
supports changedSinceDate and returns soft-deleted comments for delta sync.
Comments are only resolvable while their information request exists. Once
the request itself is deleted, this endpoint returns a 4xx HTTP error
instead of the comment. Check the request’s deletionDate using
GET /audits/{auditId}/information-requests before treating its comments
as deleted too.
Rate limit: 50 requests / minute.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Response
Ok
A comment on an information request enables communication between auditors and customers regarding evidence requirements and submissions.
These threaded discussions help clarify requests, explain or resolve questions about evidence, and are always visible to both parties once created.
The unique identifier for the comment within Vanta's system. Format: ObjectId as a string (e.g., "6890e473dce1da5d8406f5e7").
The comment message content. Can include explanations, questions, or clarifications about the information request.
Timestamp when the comment was created. Format: ISO 8601 UTC timestamp.
Timestamp when the comment was last edited. Null if the comment has never been modified. Format: ISO 8601 UTC timestamp.
Timestamp when the comment was soft-deleted. Null if the comment has not been deleted. Soft deletes retain the comment for audit history while hiding it from normal operations. Format: ISO 8601 UTC timestamp.
Email address of the comment author. This email uniquely identifies users between Vanta and external audit systems. Null when the comment author can't be matched to a Vanta user.
Human-readable display name of the comment author. Null if the author's name is not available (e.g., user was deleted). This enables correct author attribution in integrations where users cannot be reliably matched across systems by email alone.