Audits

List evidence for an information request

Retrieves a paginated list of all evidence attached to an information request, enabling auditors to review evidence submitted by customers.

This endpoint always includes soft-deleted records (where deletionDate !== null). Clients should check the deletionDate field to identify and handle deleted records appropriately in their systems.

If the information request itself has been deleted, this endpoint returns a 4xx HTTP error instead of its evidence.

This endpoint supports delta synchronization via the changedSinceDate parameter, allowing efficient polling for changes without retrieving the entire dataset.

Pagination usage:

Make initial request with desired pageSize
Check results.pageInfo.hasNextPage to see if more data exists
If true, use results.pageInfo.endCursor as pageCursor in next request
Repeat until hasNextPage is false

Delta sync usage:

Store the timestamp of your last sync
Pass that timestamp as changedSinceDate
Only evidence created, modified, shared, or deleted since that timestamp is returned
Process updates, including soft-deletes (deletionDate !== null)
Update your last sync timestamp to the current time

Identifying evidence and files:

Use id as the key for each evidence item, whatever its type.
To recognize the same file across information requests, use the

file key for the evidence type. UPLOADED_DOCUMENT uses evidence.id. VANTA_DOCUMENT and VANTA_POLICY use evidence.file.id, which identifies the source document or policy file. VANTA_TEST uses evidence.snapshotId plus evidence.fileType. LINK, OBSERVATION, and VANTA_TEST_SNAPSHOT evidence has no file.
Do not use file.url as a key. It is a temporary download link.

Rate limit: 50 requests / minute.

GET

audits

{auditId}

information-requests

{requestId}

evidence

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.listInformationRequestEvidence({
    auditId: "<id>",
    requestId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceRequest;
import com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        ListInformationRequestEvidenceRequest req = ListInformationRequestEvidenceRequest.builder()
                .auditId("<id>")
                .requestId("<id>")
                .build();

        ListInformationRequestEvidenceResponse res = sdk.audits().listInformationRequestEvidence()
                .request(req)
                .call();

        if (res.paginatedResponseInformationRequestEvidence().isPresent()) {
            System.out.println(res.paginatedResponseInformationRequestEvidence().get());
        }
    }
}

import requests

url = "https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "results": {
    "data": [
      {
        "id": "6890e473dce1da5d8406f5e8",
        "evidenceType": "VANTA_DOCUMENT",
        "visibleToAuditorDate": "2025-10-16T12:00:00.000Z",
        "creationDate": "2025-10-15T10:30:00.000Z",
        "modificationDate": "2025-10-16T12:00:00.000Z",
        "deletionDate": null,
        "capturedSegmentIds": [
          "6890e473dce1da5d8406f5ec"
        ],
        "evidence": {
          "title": "System boundary diagram",
          "documentVersionId": "6890e473dce1da5d8406f5ee",
          "file": {
            "type": "uploaded",
            "id": "6890e473dce1da5d8406f5ef",
            "filename": "system-boundary.pdf",
            "mimeType": "application/pdf",
            "url": "https://example.com/presigned-url"
          }
        }
      }
    ],
    "pageInfo": {
      "hasNextPage": false,
      "hasPreviousPage": false,
      "startCursor": "Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4",
      "endCursor": "Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4"
    }
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

auditId

string

required

requestId

string

required

Query Parameters

pageSize

integer<int32>

default:10

Maximum number of evidence entries to return per page. Controls the maximum number of items returned in one response from the API.

Required range: 1 <= x <= 100

pageCursor

string

Pagination cursor from a previous response. Provide to fetch the next page of evidence. A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.

changedSinceDate

string<date-time>

Includes all evidence that have changed since changedSinceDate. Considers creationDate, modificationDate, deletionDate, and visibleToAuditorDate timestamps when determining changes.

evidenceTypeMatchesAny

enum<string>[]

Limits results to the provided evidence types. Must include at least one of: UPLOADED_DOCUMENT, OBSERVATION, LINK, VANTA_DOCUMENT, VANTA_POLICY, VANTA_TEST, VANTA_TEST_SNAPSHOT.

Available options:

UPLOADED_DOCUMENT,

OBSERVATION,

LINK,

VANTA_DOCUMENT,

VANTA_POLICY,

VANTA_TEST,

VANTA_TEST_SNAPSHOT

Response

200 - application/json

results

object

required

Show child attributes

⌘I

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.listInformationRequestEvidence({
    auditId: "<id>",
    requestId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceRequest;
import com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        ListInformationRequestEvidenceRequest req = ListInformationRequestEvidenceRequest.builder()
                .auditId("<id>")
                .requestId("<id>")
                .build();

        ListInformationRequestEvidenceResponse res = sdk.audits().listInformationRequestEvidence()
                .request(req)
                .call();

        if (res.paginatedResponseInformationRequestEvidence().isPresent()) {
            System.out.println(res.paginatedResponseInformationRequestEvidence().get());
        }
    }
}

import requests

url = "https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}/information-requests/{requestId}/evidence")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "results": {
    "data": [
      {
        "id": "6890e473dce1da5d8406f5e8",
        "evidenceType": "VANTA_DOCUMENT",
        "visibleToAuditorDate": "2025-10-16T12:00:00.000Z",
        "creationDate": "2025-10-15T10:30:00.000Z",
        "modificationDate": "2025-10-16T12:00:00.000Z",
        "deletionDate": null,
        "capturedSegmentIds": [
          "6890e473dce1da5d8406f5ec"
        ],
        "evidence": {
          "title": "System boundary diagram",
          "documentVersionId": "6890e473dce1da5d8406f5ee",
          "file": {
            "type": "uploaded",
            "id": "6890e473dce1da5d8406f5ef",
            "filename": "system-boundary.pdf",
            "mimeType": "application/pdf",
            "url": "https://example.com/presigned-url"
          }
        }
      }
    ],
    "pageInfo": {
      "hasNextPage": false,
      "hasPreviousPage": false,
      "startCursor": "Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4",
      "endCursor": "Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4"
    }
  }
}

API Basics

Manage API

Integrations API

Audit API

Webhooks

List evidence for an information request

Authorizations

Path Parameters

Query Parameters

Response