Audits

Get audit by ID

Returns a single audit by ID, scoped to the audit firm.

To identify IRL (Information Request List) audits, check for the presence of the auditorRequestListMetadata field. This field is only present for IRL-based audits and will be undefined for standard audits.

The response includes segments, the audit’s scope. It returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. The top-level framework field is deprecated; use segments for in-scope frameworks.

This endpoint returns 404 for a soft-deleted audit.

Rate limit: 250 requests / minute.

GET

audits

{auditId}

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.getAudit({
    auditId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.GetAuditResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        GetAuditResponse res = sdk.audits().getAudit()
                .auditId("<id>")
                .call();

        if (res.audit().isPresent()) {
            System.out.println(res.audit().get());
        }
    }
}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "65fc81a3359c8508c9af880f",
  "customerOrganizationName": "corporation.com",
  "customerDisplayName": "Corporation Company",
  "customerOrganizationId": "65fc81a3359c8508c9af880f",
  "auditStartDate": "2024-03-07T21:25:56.000Z",
  "auditEndDate": "2024-03-14T21:25:56.000Z",
  "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z",
  "framework": "SOC 2 Type II",
  "displayName": "Q1 2024 SOC 2 Audit",
  "allowAuditorEmails": [
    "sam@auditor.com"
  ],
  "allowAllAuditors": true,
  "deletionDate": null,
  "creationDate": "2024-03-07T21:25:56.000Z",
  "modificationDate": "2024-03-07T21:25:56.000Z",
  "completionDate": "2024-03-07T21:25:56.000Z",
  "auditFocus": "EXTERNAL",
  "irlGenerationStatus": "READY",
  "auditorRequestListMetadata": {
    "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z"
  },
  "segments": [
    {
      "id": "65fc81a3359c8508c9af8810",
      "kind": "PROGRAM",
      "displayName": "SOC 2 Type II",
      "framework": {
        "displayName": "SOC 2 Type II"
      },
      "businessUnit": null,
      "system": null,
      "soc2Deliverable": {
        "reportType": "soc2type2",
        "tscs": [
          "SECURITY",
          "AVAILABILITY"
        ]
      }
    }
  ]
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

auditId

string

required

Response

200 - application/json

string

required

The unique identifier for the audit.

customerOrganizationName

string

required

The domain name of the customer organization being audited (e.g. vanta.com)

customerDisplayName

string | null

required

The human readable name of the customer organization being audited (e.g. Vanta)

customerOrganizationId

string

required

The uuid of the customer organization being audited

auditStartDate

string<date-time>

required

The start of the audit window. This is also when data collection for audit starts.

auditEndDate

string<date-time>

required

The end of the audit window.

earlyAccessStartsAt

string<date-time> | null

required

Timestamp at which auditors gain access to the audit. Occurs before the audit window begins

framework

string

required

deprecated

Legacy singular framework display name from the audit type. Incomplete for a multi-framework audit — use segments instead.

displayName

string

required

The display name for the audit. Returns the custom audit name if set, otherwise returns the framework name.

allowAuditorEmails

string[]

required

Emails of auditors with access to audit

allowAllAuditors

boolean

required

Set to true if all auditors in audit firm have access

deletionDate

string<date-time> | null

required

Timestamp when the audit was deleted

creationDate

string<date-time>

required

Timestamp when the audit was created

modificationDate

string<date-time> | null

required

Timestamp when the audit was updated

completionDate

string<date-time> | null

required

Timestamp when the audit was marked completed, and report was uploaded

auditFocus

enum<string>

required

Audit focus determines if the audit is internal or external facing

Available options:

EXTERNAL,

INTERNAL

irlGenerationStatus

enum<string> | null

required

Generation status of this audit's Vanta-generated information request list (IRL). PENDING/RUNNING defer initial sync, READY permits a full sync, and FAILED is terminal. Null means the audit has no generated IRL.

Available options:

PENDING,

RUNNING,

READY,

FAILED

segments

object[]

required

The audit's scope as a list of segments. Always present. A live audit returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. Soft-deleted audits return an empty list. Prefer this over the deprecated top-level framework field.

Show child attributes

auditorRequestListMetadata

object

Metadata about the auditor request list. This field is only present for IRL (Information Request List) based audits and will be undefined for standard audits. Use the presence of this field to differentiate between IRL and non-IRL audits.

Show child attributes

⌘I

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.getAudit({
    auditId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.GetAuditResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        GetAuditResponse res = sdk.audits().getAudit()
                .auditId("<id>")
                .call();

        if (res.audit().isPresent()) {
            System.out.println(res.audit().get());
        }
    }
}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "65fc81a3359c8508c9af880f",
  "customerOrganizationName": "corporation.com",
  "customerDisplayName": "Corporation Company",
  "customerOrganizationId": "65fc81a3359c8508c9af880f",
  "auditStartDate": "2024-03-07T21:25:56.000Z",
  "auditEndDate": "2024-03-14T21:25:56.000Z",
  "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z",
  "framework": "SOC 2 Type II",
  "displayName": "Q1 2024 SOC 2 Audit",
  "allowAuditorEmails": [
    "sam@auditor.com"
  ],
  "allowAllAuditors": true,
  "deletionDate": null,
  "creationDate": "2024-03-07T21:25:56.000Z",
  "modificationDate": "2024-03-07T21:25:56.000Z",
  "completionDate": "2024-03-07T21:25:56.000Z",
  "auditFocus": "EXTERNAL",
  "irlGenerationStatus": "READY",
  "auditorRequestListMetadata": {
    "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z"
  },
  "segments": [
    {
      "id": "65fc81a3359c8508c9af8810",
      "kind": "PROGRAM",
      "displayName": "SOC 2 Type II",
      "framework": {
        "displayName": "SOC 2 Type II"
      },
      "businessUnit": null,
      "system": null,
      "soc2Deliverable": {
        "reportType": "soc2type2",
        "tscs": [
          "SECURITY",
          "AVAILABILITY"
        ]
      }
    }
  ]
}

API Basics

Manage API

Integrations API

Audit API

Webhooks

Get audit by ID

Authorizations

Path Parameters

Response