Audits

List audits

Returns a paginated list of audits scoped to the audit firm.

To identify IRL (Information Request List) audits, check for the presence of the auditorRequestListMetadata field. This field is only present for IRL-based audits and will be undefined for standard audits.

Each audit includes segments, the audit’s scope. A live audit returns every in-scope program and system segment; more than one segment does not by itself imply more than one framework. The top-level framework field is deprecated; use segments for in-scope frameworks.

This list may include soft-deleted audits so clients can reconcile deletions. Check deletionDate; a deleted audit has an empty segments list.

Rate limit: 250 requests / minute.

GET

audits

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.list({});

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.ListAuditsResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        ListAuditsResponse res = sdk.audits().list()
                .pageSize(10)
                .call();

        if (res.paginatedResponseAudit().isPresent()) {
            System.out.println(res.paginatedResponseAudit().get());
        }
    }
}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "results": {
    "data": [
      {
        "id": "65fc81a3359c8508c9af880f",
        "customerOrganizationName": "corporation.com",
        "customerDisplayName": "Corporation Company",
        "customerOrganizationId": "65fc81a3359c8508c9af880f",
        "auditStartDate": "2024-03-07T21:25:56.000Z",
        "auditEndDate": "2024-03-14T21:25:56.000Z",
        "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z",
        "framework": "SOC 2 Type II",
        "displayName": "Q1 2024 SOC 2 Audit",
        "allowAuditorEmails": [
          "sam@auditor.com"
        ],
        "allowAllAuditors": true,
        "deletionDate": null,
        "creationDate": "2024-03-07T21:25:56.000Z",
        "modificationDate": "2024-03-07T21:25:56.000Z",
        "completionDate": "2024-03-07T21:25:56.000Z",
        "auditFocus": "EXTERNAL",
        "auditView": "FULL",
        "irlGenerationStatus": "READY",
        "auditorRequestListMetadata": {
          "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z"
        },
        "segments": [
          {
            "id": "65fc81a3359c8508c9af8810",
            "kind": "PROGRAM",
            "displayName": "SOC 2 Type II",
            "framework": {
              "displayName": "SOC 2 Type II"
            },
            "businessUnit": null,
            "system": null,
            "soc2Deliverable": {
              "reportType": "soc2type2",
              "tscs": [
                "SECURITY",
                "AVAILABILITY"
              ]
            }
          }
        ]
      }
    ],
    "pageInfo": {
      "hasNextPage": false,
      "hasPreviousPage": false,
      "startCursor": "YXJyYXljb25uZWN0aW9uOjA=",
      "endCursor": "YXJyYXljb25uZWN0aW9uOjE="
    }
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

pageSize

integer<int32>

default:10

Controls the maximum number of items returned in one response from the listAudits API.

We have increased the pagination size for this endpoint to enable our upmarket audit firms to sync in a timely manner. The rest of the API will use a pagination size of 100.

Required range: 1 <= x <= 200

pageCursor

string

A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.

changedSinceDate

string<date-time>

Includes all audits that have changed since changedSinceDate, including soft-deleted audits whose deletionDate is on or after that timestamp.

isActiveAudit

boolean

Includes only audits with no audit report uploaded

Response

200 - application/json

results

object

required

Show child attributes

⌘I

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.list({});

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.ListAuditsResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        ListAuditsResponse res = sdk.audits().list()
                .pageSize(10)
                .call();

        if (res.paginatedResponseAudit().isPresent()) {
            System.out.println(res.paginatedResponseAudit().get());
        }
    }
}

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "results": {
    "data": [
      {
        "id": "65fc81a3359c8508c9af880f",
        "customerOrganizationName": "corporation.com",
        "customerDisplayName": "Corporation Company",
        "customerOrganizationId": "65fc81a3359c8508c9af880f",
        "auditStartDate": "2024-03-07T21:25:56.000Z",
        "auditEndDate": "2024-03-14T21:25:56.000Z",
        "earlyAccessStartsAt": "2024-03-07T21:25:56.000Z",
        "framework": "SOC 2 Type II",
        "displayName": "Q1 2024 SOC 2 Audit",
        "allowAuditorEmails": [
          "sam@auditor.com"
        ],
        "allowAllAuditors": true,
        "deletionDate": null,
        "creationDate": "2024-03-07T21:25:56.000Z",
        "modificationDate": "2024-03-07T21:25:56.000Z",
        "completionDate": "2024-03-07T21:25:56.000Z",
        "auditFocus": "EXTERNAL",
        "auditView": "FULL",
        "irlGenerationStatus": "READY",
        "auditorRequestListMetadata": {
          "requestsSharedWithCustomer": "2024-03-07T21:25:56.000Z"
        },
        "segments": [
          {
            "id": "65fc81a3359c8508c9af8810",
            "kind": "PROGRAM",
            "displayName": "SOC 2 Type II",
            "framework": {
              "displayName": "SOC 2 Type II"
            },
            "businessUnit": null,
            "system": null,
            "soc2Deliverable": {
              "reportType": "soc2type2",
              "tscs": [
                "SECURITY",
                "AVAILABILITY"
              ]
            }
          }
        ]
      }
    ],
    "pageInfo": {
      "hasNextPage": false,
      "hasPreviousPage": false,
      "startCursor": "YXJyYXljb25uZWN0aW9uOjA=",
      "endCursor": "YXJyYXljb25uZWN0aW9uOjE="
    }
  }
}

API Basics

Manage API

Integrations API

Audit API

Webhooks

List audits

Authorizations

Query Parameters

Response