> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # Get audit by ID > Returns a single audit by ID, scoped to the audit firm. To identify IRL (Information Request List) audits, check for the presence of the `auditorRequestListMetadata` field. This field is only present for IRL-based audits and will be `undefined` for standard audits. The response includes `segments`, the audit's scope. It returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. The top-level `framework` field is deprecated; use `segments` for in-scope frameworks. This endpoint returns 404 for a soft-deleted audit. Rate limit: 250 requests / minute. ## OpenAPI ````yaml https://spec.speakeasy.com/vanta/vanta/conduct-an-audit-with-code-samples get /audits/{auditId} openapi: 3.0.0 info: title: Conduct an audit version: 1.0.0 description: >- The Auditor API lets audit firms conduct audits from a tool outside of Vanta. Unlock data syncing with Vanta through this API. **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: US Region API - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /audits/{auditId}: get: tags: - Audits summary: Get audit by ID description: >- Returns a single audit by ID, scoped to the audit firm. To identify IRL (Information Request List) audits, check for the presence of the `auditorRequestListMetadata` field. This field is only present for IRL-based audits and will be `undefined` for standard audits. The response includes `segments`, the audit's scope. It returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. The top-level `framework` field is deprecated; use `segments` for in-scope frameworks. This endpoint returns 404 for a soft-deleted audit. Rate limit: 250 requests / minute. operationId: GetAudit parameters: - in: path name: auditId required: true schema: type: string responses: '200': description: Ok content: application/json: schema: $ref: '#/components/schemas/Audit' examples: Example 1: value: id: 65fc81a3359c8508c9af880f customerOrganizationName: corporation.com customerDisplayName: Corporation Company customerOrganizationId: 65fc81a3359c8508c9af880f auditStartDate: '2024-03-07T21:25:56.000Z' auditEndDate: '2024-03-14T21:25:56.000Z' earlyAccessStartsAt: '2024-03-07T21:25:56.000Z' framework: SOC 2 Type II displayName: Q1 2024 SOC 2 Audit allowAuditorEmails: - sam@auditor.com allowAllAuditors: true deletionDate: null creationDate: '2024-03-07T21:25:56.000Z' modificationDate: '2024-03-07T21:25:56.000Z' completionDate: '2024-03-07T21:25:56.000Z' auditFocus: EXTERNAL irlGenerationStatus: READY auditorRequestListMetadata: requestsSharedWithCustomer: '2024-03-07T21:25:56.000Z' segments: - id: 65fc81a3359c8508c9af8810 kind: PROGRAM displayName: SOC 2 Type II framework: displayName: SOC 2 Type II businessUnit: null system: null soc2Deliverable: reportType: soc2type2 tscs: - SECURITY - AVAILABILITY security: - bearerAuth: [] x-codeSamples: - lang: typescript label: GetAudit source: |- import { Vanta } from "vanta-auditor-api-sdk"; const vanta = new Vanta({ bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "", }); async function run() { const result = await vanta.audits.getAudit({ auditId: "", }); console.log(result); } run(); - lang: java label: GetAudit source: >- package hello.world; import com.vanta.vanta_auditor_api.Vanta; import com.vanta.vanta_auditor_api.models.operations.GetAuditResponse; import java.lang.Exception; public class Application { public static void main(String[] args) throws Exception { Vanta sdk = Vanta.builder() .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", "")) .build(); GetAuditResponse res = sdk.audits().getAudit() .auditId("") .call(); if (res.audit().isPresent()) { System.out.println(res.audit().get()); } } } components: schemas: Audit: properties: id: type: string description: The unique identifier for the audit. customerOrganizationName: type: string description: >- The domain name of the customer organization being audited (e.g. vanta.com) customerDisplayName: type: string nullable: true description: >- The human readable name of the customer organization being audited (e.g. Vanta) customerOrganizationId: type: string description: The uuid of the customer organization being audited auditStartDate: type: string format: date-time description: >- The start of the audit window. This is also when data collection for audit starts. auditEndDate: type: string format: date-time description: The end of the audit window. earlyAccessStartsAt: type: string format: date-time nullable: true description: >- Timestamp at which auditors gain access to the audit. Occurs before the audit window begins framework: type: string description: >- Legacy singular framework display name from the audit type. Incomplete for a multi-framework audit — use `segments` instead. deprecated: true displayName: type: string description: >- The display name for the audit. Returns the custom audit name if set, otherwise returns the framework name. allowAuditorEmails: items: type: string type: array description: Emails of auditors with access to audit allowAllAuditors: type: boolean description: Set to true if all auditors in audit firm have access deletionDate: type: string format: date-time nullable: true description: Timestamp when the audit was deleted creationDate: type: string format: date-time description: Timestamp when the audit was created modificationDate: type: string format: date-time nullable: true description: Timestamp when the audit was updated completionDate: type: string format: date-time nullable: true description: >- Timestamp when the audit was marked completed, and report was uploaded auditFocus: $ref: '#/components/schemas/AuditFocus' description: Audit focus determines if the audit is internal or external facing irlGenerationStatus: allOf: - $ref: '#/components/schemas/AuditIrlGenerationStatus' nullable: true description: >- Generation status of this audit's Vanta-generated information request list (IRL). `PENDING`/`RUNNING` defer initial sync, `READY` permits a full sync, and `FAILED` is terminal. Null means the audit has no generated IRL. auditorRequestListMetadata: properties: requestsSharedWithCustomer: type: string format: date-time nullable: true description: >- Timestamp when information requests were shared with the customer. Null if not shared. required: - requestsSharedWithCustomer type: object description: >- Metadata about the auditor request list. This field is only present for IRL (Information Request List) based audits and will be undefined for standard audits. Use the presence of this field to differentiate between IRL and non-IRL audits. segments: items: $ref: '#/components/schemas/AuditSegment' type: array description: >- The audit's scope as a list of segments. Always present. A live audit returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. Soft-deleted audits return an empty list. Prefer this over the deprecated top-level `framework` field. required: - id - customerOrganizationName - customerDisplayName - customerOrganizationId - auditStartDate - auditEndDate - earlyAccessStartsAt - framework - displayName - allowAuditorEmails - allowAllAuditors - deletionDate - creationDate - modificationDate - completionDate - auditFocus - irlGenerationStatus - segments type: object additionalProperties: false AuditFocus: type: string enum: - EXTERNAL - INTERNAL AuditIrlGenerationStatus: type: string enum: - PENDING - RUNNING - READY - FAILED AuditSegment: description: >- One segment of an audit's scope. A live audit returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. Soft-deleted audits return an empty list. `displayName` is the segment label owned by audit scope (for example "{Framework}" or "{Framework} — {Business Unit}"). `soc2Deliverable` is the per-segment SOC 2 config, or null. `businessUnit` is set for program segments that are BU-scoped and null otherwise. `system` is set for system segments and null otherwise. properties: id: type: string description: The unique identifier for the segment. kind: $ref: '#/components/schemas/AuditSegmentKind' description: >- Whether this segment is a program (framework / business unit) or a system. displayName: type: string description: >- The segment's display label. Do not reconstruct this from framework + BU. framework: $ref: '#/components/schemas/AuditSegmentFramework' description: The framework this segment is in. businessUnit: allOf: - $ref: '#/components/schemas/AuditSegmentAssociation' nullable: true description: >- The business unit this program segment is scoped to, or null when the segment is not BU-scoped or the BU cannot be resolved. system: allOf: - $ref: '#/components/schemas/AuditSegmentAssociation' nullable: true description: |- The information system this system segment is scoped to, or null on program segments. soc2Deliverable: allOf: - $ref: '#/components/schemas/AuditSoc2Deliverable' nullable: true description: >- SOC 2 report type and Trust Services Criteria for this segment, or null. required: - id - kind - displayName - framework - businessUnit - system - soc2Deliverable type: object additionalProperties: false AuditSegmentKind: type: string enum: - PROGRAM - SYSTEM AuditSegmentFramework: description: The framework this segment is in. properties: displayName: type: string description: Display name of the framework. required: - displayName type: object additionalProperties: false AuditSegmentAssociation: description: A business unit or information-system association on an audit segment. properties: id: type: string description: >- The unique identifier of the associated business unit or information system. displayName: type: string description: >- The human-readable name of the associated business unit or information system. required: - id - displayName type: object additionalProperties: false AuditSoc2Deliverable: description: >- Per-segment SOC 2 report configuration. Null when the segment is not SOC 2 or has no configured deliverable. properties: reportType: $ref: '#/components/schemas/AuditSoc2ReportType' description: SOC 2 report type for this segment. tscs: items: $ref: '#/components/schemas/AuditSoc2Tsc' type: array description: Trust Services Criteria this segment covers. required: - reportType - tscs type: object additionalProperties: false AuditSoc2ReportType: type: string enum: - soc2type1 - soc2type2 AuditSoc2Tsc: type: string enum: - SECURITY - AVAILABILITY - CONFIDENTIALITY - PRIVACY - PROCESSING_INTEGRITY securitySchemes: bearerAuth: type: http scheme: bearer ```` ## Related topics - [Get an audit evidence item by ID](/api-reference/audits/get-an-audit-evidence-item-by-id.md) - [Get an audit evidence comment by ID](/api-reference/audits/get-an-audit-evidence-comment-by-id.md) - [Get organization information for an audit](/api-reference/audits/get-organization-information-for-an-audit.md) - [Get framework codes for an audit](/api-reference/audits/get-framework-codes-for-an-audit.md) - [Get an information request by ID](/api-reference/audits/get-an-information-request-by-id.md)