> ## Documentation Index
> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get framework codes for an audit

> Retrieves all valid framework codes for the specified audit. This endpoint helps users discover which framework codes are available for creating and updating information requests for this audit.

Use this endpoint to:
- Discover available framework codes (`frameworkCodes`, the original flat list)
- Validate framework codes against the audit's frameworks
- See which codes belong to which in-scope framework (`codesByFramework`)

Rate limit: 50 requests / minute.



## OpenAPI

````yaml https://spec.speakeasy.com/vanta/vanta/conduct-an-audit-with-code-samples get /audits/{auditId}/framework-codes
openapi: 3.0.0
info:
  title: Conduct an audit
  version: 1.0.0
  description: >-
    The Auditor API lets audit firms conduct audits from a tool outside of
    Vanta. Unlock data syncing with Vanta through this API.


    **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)`
    from the server dropdown to issue requests against
    `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the
    commercial host — replace it with `https://api.vanta-gov.com/oauth/token`.
  termsOfService: https://www.vanta.com/terms
  license:
    name: UNLICENSED
  contact:
    name: API Support
    url: https://help.vanta.com/
    email: support@vanta.com
servers:
  - url: https://api.vanta.com/v1
    description: Vanta (Commercial)
  - url: https://api.vanta-gov.com/v1
    description: Vanta Gov (FedRAMP)
security: []
paths:
  /audits/{auditId}/framework-codes:
    get:
      tags:
        - Audits
      summary: Get framework codes for an audit
      description: >-
        Retrieves all valid framework codes for the specified audit. This
        endpoint helps users discover which framework codes are available for
        creating and updating information requests for this audit.


        Use this endpoint to:

        - Discover available framework codes (`frameworkCodes`, the original
        flat list)

        - Validate framework codes against the audit's frameworks

        - See which codes belong to which in-scope framework
        (`codesByFramework`)


        Rate limit: 50 requests / minute.
      operationId: GetFrameworkCodes
      parameters:
        - in: path
          name: auditId
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FrameworkCodes'
              examples:
                Example 1:
                  value:
                    frameworkCodes:
                      - '164.308'
                      - '164.312'
                      - '164.314'
                      - CC1.1
                      - CC1.2
                      - CC1.3
                      - CC2.1
                      - CC2.2
                      - CC3.1
                      - CC3.2
                      - CC4.1
                      - CC4.2
                      - CC5.1
                      - CC5.2
                      - CC6.1
                      - CC6.2
                      - CC7.1
                      - CC7.2
                      - CC8.1
                      - CC8.2
                    codesByFramework:
                      - framework: SOC 2 Type II
                        codes:
                          - CC1.1
                          - CC1.2
                          - CC1.3
                          - CC2.1
                          - CC2.2
                          - CC3.1
                          - CC3.2
                          - CC4.1
                          - CC4.2
                          - CC5.1
                          - CC5.2
                          - CC6.1
                          - CC6.2
                          - CC7.1
                          - CC7.2
                          - CC8.1
                          - CC8.2
                      - framework: HIPAA
                        codes:
                          - '164.308'
                          - '164.312'
                          - '164.314'
      security:
        - bearerAuth: []
      x-codeSamples:
        - lang: typescript
          label: GetFrameworkCodes
          source: |-
            import { Vanta } from "vanta-auditor-api-sdk";

            const vanta = new Vanta({
              bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
            });

            async function run() {
              const result = await vanta.audits.getFrameworkCodes({
                auditId: "<id>",
              });

              console.log(result);
            }

            run();
        - lang: java
          label: GetFrameworkCodes
          source: >-
            package hello.world;


            import com.vanta.vanta_auditor_api.Vanta;

            import
            com.vanta.vanta_auditor_api.models.operations.GetFrameworkCodesResponse;

            import java.lang.Exception;


            public class Application {

                public static void main(String[] args) throws Exception {

                    Vanta sdk = Vanta.builder()
                            .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
                        .build();

                    GetFrameworkCodesResponse res = sdk.audits().getFrameworkCodes()
                            .auditId("<id>")
                            .call();

                    if (res.frameworkCodes().isPresent()) {
                        System.out.println(res.frameworkCodes().get());
                    }
                }
            }
components:
  schemas:
    FrameworkCodes:
      description: Framework codes response resource
      properties:
        frameworkCodes:
          items:
            type: string
          type: array
          description: Valid framework codes for this audit.
          deprecated: true
        codesByFramework:
          items:
            $ref: '#/components/schemas/FrameworkCodesByFramework'
          type: array
          description: >-
            Valid codes grouped by each distinct in-scope framework. A code that
            exists

            on two frameworks appears in both groups. Two segments that share a

            framework contribute one group. `framework` is the display name.
      required:
        - frameworkCodes
        - codesByFramework
      type: object
      additionalProperties: false
    FrameworkCodesByFramework:
      properties:
        framework:
          type: string
          description: Display name of the in-scope framework these codes belong to.
        codes:
          items:
            type: string
          type: array
          description: Valid codes for this framework, sorted.
      required:
        - framework
        - codes
      type: object
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````

## Related topics

- [Vanta API changelog](/docs/changelog.md)
- [List code changes for an audit](/api-reference/audits/list-code-changes-for-an-audit.md)
- [Pull Information Request Lists for your audits](/docs/quickstart/conduct-audit.md)
- [Get audit by ID](/api-reference/audits/get-audit-by-id.md)
- [Update an information request for an audit](/api-reference/audits/update-an-information-request-for-an-audit.md)