Audits

Get framework codes for an audit

Retrieves all valid framework codes for the specified audit. This endpoint helps users discover which framework codes are available for creating and updating information requests for this audit.

Use this endpoint to:

Discover available framework codes before creating information requests
Validate framework codes against the audit’s framework
Get context about what framework codes are available for the audit type

Rate limit: 10 requests / minute.

GET

audits

{auditId}

framework-codes

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.getFrameworkCodes({
    auditId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.GetFrameworkCodesResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        GetFrameworkCodesResponse res = sdk.audits().getFrameworkCodes()
                .auditId("<id>")
                .call();

        if (res.frameworkCodes().isPresent()) {
            System.out.println(res.frameworkCodes().get());
        }
    }
}

curl --request GET \
  --url https://api.vanta.com/v1/audits/{auditId}/framework-codes \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.vanta.com/v1/audits/{auditId}/framework-codes"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}/framework-codes', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}/framework-codes",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}/framework-codes"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}/framework-codes")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "frameworkCodes": [
    "CC1.1",
    "CC1.2",
    "CC1.3",
    "CC2.1",
    "CC2.2",
    "CC3.1",
    "CC3.2",
    "CC4.1",
    "CC4.2",
    "CC5.1",
    "CC5.2",
    "CC6.1",
    "CC6.2",
    "CC7.1",
    "CC7.2",
    "CC8.1",
    "CC8.2"
  ]
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

auditId

string

required

Response

200 - application/json

Framework codes response resource

frameworkCodes

string[]

required

Array of valid framework codes for the audit's framework (e.g., "CC6.1", "CC6.2"). These represent the different framework sections available for creating information requests.

List information requests for an auditRetrieves a paginated list of all information requests for an audit, enabling external audit management systems to display and track evidence requests. This endpoint always includes soft-deleted records (where `deletionDate !== null`). Clients should check the `deletionDate` field to identify and handle deleted records appropriately in their systems. This endpoint supports delta synchronization via the `changedSinceDate` parameter, allowing efficient polling for changes without retrieving the entire dataset. Pagination usage: 1. Make initial request with desired `pageSize` 2. Check `results.pageInfo.hasNextPage` to see if more data exists 3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request 4. Repeat until `hasNextPage` is false Delta sync usage: 1. Store the timestamp of your last sync 2. Pass that timestamp as `changedSinceDate` 3. Only requests created, modified, or deleted since that timestamp are returned 4. Process updates and soft-deletes by checking the `deletionDate` field 5. Update your last sync timestamp to the current time Rate limit: 50 requests / minute.

⌘I

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.getFrameworkCodes({
    auditId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.GetFrameworkCodesResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        GetFrameworkCodesResponse res = sdk.audits().getFrameworkCodes()
                .auditId("<id>")
                .call();

        if (res.frameworkCodes().isPresent()) {
            System.out.println(res.frameworkCodes().get());
        }
    }
}

curl --request GET \
  --url https://api.vanta.com/v1/audits/{auditId}/framework-codes \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.vanta.com/v1/audits/{auditId}/framework-codes"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}/framework-codes', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}/framework-codes",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}/framework-codes"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}/framework-codes")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "frameworkCodes": [
    "CC1.1",
    "CC1.2",
    "CC1.3",
    "CC2.1",
    "CC2.2",
    "CC3.1",
    "CC3.2",
    "CC4.1",
    "CC4.2",
    "CC5.1",
    "CC5.2",
    "CC6.1",
    "CC6.2",
    "CC7.1",
    "CC7.2",
    "CC8.1",
    "CC8.2"
  ]
}