> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # List evidence for an information request > Retrieves a paginated list of all evidence attached to an information request, enabling auditors to review evidence submitted by customers. This endpoint always includes soft-deleted records (where `deletionDate !== null`). Clients should check the `deletionDate` field to identify and handle deleted records appropriately in their systems. This endpoint supports delta synchronization via the `changedSinceDate` parameter, allowing efficient polling for changes without retrieving the entire dataset. Pagination usage: 1. Make initial request with desired `pageSize` 2. Check `results.pageInfo.hasNextPage` to see if more data exists 3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request 4. Repeat until `hasNextPage` is false Delta sync usage: 1. Store the timestamp of your last sync 2. Pass that timestamp as `changedSinceDate` 3. Only evidence created, modified, shared, or deleted since that timestamp is returned 4. Process updates, including soft-deletes (deletionDate !== null) 5. Update your last sync timestamp to the current time Rate limit: 50 requests / minute. ## OpenAPI ````yaml https://spec.speakeasy.com/vanta/vanta/conduct-an-audit-with-code-samples get /audits/{auditId}/information-requests/{requestId}/evidence openapi: 3.0.0 info: title: Conduct an audit version: 1.0.0 description: >- The Auditor API lets audit firms conduct audits from a tool outside of Vanta. Unlock data syncing with Vanta through this API. **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: Vanta (Commercial) - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /audits/{auditId}/information-requests/{requestId}/evidence: get: tags: - Audits summary: List evidence for an information request description: >- Retrieves a paginated list of all evidence attached to an information request, enabling auditors to review evidence submitted by customers. This endpoint always includes soft-deleted records (where `deletionDate !== null`). Clients should check the `deletionDate` field to identify and handle deleted records appropriately in their systems. This endpoint supports delta synchronization via the `changedSinceDate` parameter, allowing efficient polling for changes without retrieving the entire dataset. Pagination usage: 1. Make initial request with desired `pageSize` 2. Check `results.pageInfo.hasNextPage` to see if more data exists 3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request 4. Repeat until `hasNextPage` is false Delta sync usage: 1. Store the timestamp of your last sync 2. Pass that timestamp as `changedSinceDate` 3. Only evidence created, modified, shared, or deleted since that timestamp is returned 4. Process updates, including soft-deletes (deletionDate !== null) 5. Update your last sync timestamp to the current time Rate limit: 50 requests / minute. operationId: ListInformationRequestEvidence parameters: - in: path name: auditId required: true schema: type: string - in: path name: requestId required: true schema: type: string - description: Maximum number of evidence entries to return per page. in: query name: pageSize required: false schema: $ref: '#/components/schemas/PageSize' - description: >- Pagination cursor from a previous response. Provide to fetch the next page of evidence. in: query name: pageCursor required: false schema: $ref: '#/components/schemas/PageCursor' - description: >- Includes all evidence that have changed since changedSinceDate. Considers creationDate, modificationDate, deletionDate, and visibleToAuditorDate timestamps when determining changes. in: query name: changedSinceDate required: false schema: type: string format: date-time - description: >- Limits results to the provided evidence types. Must include at least one of: UPLOADED_DOCUMENT, OBSERVATION, LINK, VANTA_DOCUMENT, VANTA_POLICY, VANTA_TEST, VANTA_TEST_SNAPSHOT. in: query name: evidenceTypeMatchesAny required: false schema: default: [] type: array items: $ref: '#/components/schemas/InformationRequestSupportedEvidenceType' responses: '200': description: Ok content: application/json: schema: $ref: >- #/components/schemas/PaginatedResponse_InformationRequestEvidence_ examples: Example 1: value: results: data: - id: 6890e473dce1da5d8406f5e8 evidenceType: UPLOADED_DOCUMENT visibleToAuditorDate: '2025-10-16T12:00:00.000Z' creationDate: '2025-10-15T10:30:00.000Z' modificationDate: '2025-10-16T12:00:00.000Z' deletionDate: null evidence: id: 6890e473dce1da5d8406f5ea filename: security-policy.pdf mimeType: application/pdf url: https://example.com/presigned-url pageInfo: hasNextPage: false hasPreviousPage: false startCursor: Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4 endCursor: Njg5MGU0NzNkY2UxZGE1ZDg0MDZmNWU4 security: - bearerAuth: [] x-codeSamples: - lang: typescript label: ListInformationRequestEvidence source: |- import { Vanta } from "vanta-auditor-api-sdk"; const vanta = new Vanta({ bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "", }); async function run() { const result = await vanta.audits.listInformationRequestEvidence({ auditId: "", requestId: "", }); console.log(result); } run(); - lang: java label: ListInformationRequestEvidence source: >- package hello.world; import com.vanta.vanta_auditor_api.Vanta; import com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceRequest; import com.vanta.vanta_auditor_api.models.operations.ListInformationRequestEvidenceResponse; import java.lang.Exception; public class Application { public static void main(String[] args) throws Exception { Vanta sdk = Vanta.builder() .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", "")) .build(); ListInformationRequestEvidenceRequest req = ListInformationRequestEvidenceRequest.builder() .auditId("") .requestId("") .build(); ListInformationRequestEvidenceResponse res = sdk.audits().listInformationRequestEvidence() .request(req) .call(); if (res.paginatedResponseInformationRequestEvidence().isPresent()) { System.out.println(res.paginatedResponseInformationRequestEvidence().get()); } } } components: schemas: PageSize: type: integer format: int32 default: 10 description: >- Controls the maximum number of items returned in one response from the API. minimum: 1 maximum: 100 PageCursor: type: string description: >- A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. InformationRequestSupportedEvidenceType: type: string enum: - UPLOADED_DOCUMENT - OBSERVATION - LINK - VANTA_DOCUMENT - VANTA_POLICY - VANTA_TEST - VANTA_TEST_SNAPSHOT PaginatedResponse_InformationRequestEvidence_: properties: results: properties: data: items: $ref: '#/components/schemas/InformationRequestEvidence' type: array pageInfo: $ref: '#/components/schemas/PageInfo' required: - data - pageInfo type: object required: - results type: object additionalProperties: false InformationRequestEvidence: properties: id: type: string description: |- The unique identifier for the evidence within Vanta's system. Format: ObjectId as a string (e.g., "6890e473dce1da5d8406f5e7"). evidenceType: $ref: '#/components/schemas/InformationRequestSupportedEvidenceType' description: |- Type of evidence attached to this information request. Determines the structure of the `evidence` field. visibleToAuditorDate: type: string format: date-time nullable: true description: >- Timestamp when the evidence was made visible to the auditor. Null if the customer has not yet shared this evidence with the auditor. Evidence must be shared before the auditor can review it. Format: ISO 8601 UTC timestamp. creationDate: type: string format: date-time description: |- Timestamp when the evidence was created/uploaded. Format: ISO 8601 UTC timestamp. modificationDate: type: string format: date-time description: |- Timestamp when the evidence was last modified. Format: ISO 8601 UTC timestamp. deletionDate: type: string format: date-time nullable: true description: >- Timestamp when the evidence was soft-deleted. Null if the evidence has not been deleted. Soft deletes retain evidence in the system for audit history while hiding it from normal operations. Format: ISO 8601 UTC timestamp. evidence: $ref: '#/components/schemas/InformationRequestEvidenceUnion' description: The evidence content. Structure varies based on evidenceType. required: - id - evidenceType - creationDate - modificationDate - evidence type: object additionalProperties: false PageInfo: description: Provides information about the pagination of a dataset. properties: endCursor: type: string nullable: true description: >- The cursor that points to the end of the current page, or null if there is no such cursor. hasNextPage: type: boolean description: Indicates if there is another page after the current page. hasPreviousPage: type: boolean description: Indicates if there is a page before the current page. startCursor: type: string nullable: true description: >- The cursor that points to the start of the current page, or null if there is no such cursor. required: - endCursor - hasNextPage - hasPreviousPage - startCursor type: object additionalProperties: false InformationRequestEvidenceUnion: anyOf: - $ref: '#/components/schemas/UploadedDocumentEvidence' - $ref: '#/components/schemas/LinkEvidence' - $ref: '#/components/schemas/ObservationEvidence' - $ref: '#/components/schemas/VantaDocumentEvidence' - $ref: '#/components/schemas/VantaPolicyEvidence' - $ref: '#/components/schemas/VantaTestEvidence' - $ref: '#/components/schemas/VantaTestSnapshotEvidence' description: >- Union type representing the different forms of evidence content. The specific type is determined by the `evidenceType` field in InformationRequestEvidence. UploadedDocumentEvidence: description: >- Evidence in the form of an uploaded document file. The URL is a temporary presigned URL that expires after a certain period. properties: id: type: string description: The unique identifier for the uploaded document in Vanta's system. filename: type: string description: |- The original filename of the uploaded document. Undefined if the filename was not captured during upload. mimeType: type: string description: >- The MIME type of the document indicating its file format. Common types: "application/pdf", "image/png", "image/jpeg", "text/plain" url: type: string description: |- A presigned URL for downloading the document. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. required: - id - mimeType - url type: object additionalProperties: false LinkEvidence: description: Evidence in the form of a link to external documentation or resources. properties: title: type: string description: The title or descriptive name for the link. description: type: string description: Optional description providing additional context about the link. url: type: string description: The URL pointing to the external documentation or resource. required: - title - url type: object additionalProperties: false ObservationEvidence: description: Evidence in the form of a text observation or note. properties: observationDetails: type: string description: The text content of the observation. required: - observationDetails type: object additionalProperties: false VantaDocumentEvidence: description: >- Evidence in the form of a Vanta Document. Vanta Documents are managed documents with metadata like expiration dates and versioning. They can either be uploaded files stored in Vanta or links to external documentation. properties: title: type: string description: The title of the document as displayed in Vanta. description: type: string description: >- Optional description providing additional context about the document. expirationDate: type: string format: date-time description: |- The date when the document version expires and should be renewed. Undefined if no expiration is set. Format: ISO 8601 UTC timestamp. addedBy: properties: email: type: string name: type: string required: - email - name type: object description: >- Information about the user who added this file version to the document. Undefined if the user information is not available. documentVersionId: type: string description: The unique identifier of the document version submitted as evidence. file: anyOf: - $ref: '#/components/schemas/VantaDocumentUploadedEvidence' - $ref: '#/components/schemas/VantaDocumentLinkEvidence' description: >- The file or link associated with this document version. Use the `type` discriminator to determine whether it's an uploaded file or an external link. required: - title - documentVersionId - file type: object additionalProperties: false VantaPolicyEvidence: description: |- Evidence in the form of a Vanta Policy. Vanta Policies are compliance policies with metadata like locale, effective dates, and versioning. Policies are always uploaded files stored in Vanta's system. properties: title: type: string description: The title of the policy as displayed in Vanta. description: type: string description: Optional description providing additional context about the policy. expirationDate: type: string format: date-time description: |- The date when the policy version expires and should be renewed. Undefined if no expiration is set. Format: ISO 8601 UTC timestamp. lastEditedBy: properties: email: type: string name: type: string required: - email - name type: object description: |- Information about the user who last edited this policy version. Undefined if the user information is not available. policyId: type: string description: >- The policy type this evidence belongs to (e.g. "information-security-policy-bsi"). Policies prefixed with "custom-" are customer-defined; others are Vanta-provided templates. policyVersionId: type: string description: >- The identifier of the approved policy version that was submitted as evidence. A new version is created each time a policy is updated and approved. policyVersionFileId: type: string description: >- The identifier of the locale-specific file within the policy version. Each policy version may contain multiple files, one per supported language. file: properties: effectiveOrCreationDate: type: string format: date-time description: >- The date when this policy version became effective, or when it was created. Format: ISO 8601 UTC timestamp. locale: type: string description: |- The locale/language of the policy document. Examples: "EN" for English, "ES" for Spanish, "FR" for French url: type: string description: |- A presigned URL for downloading the policy document. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. mimeType: type: string description: |- The MIME type of the policy document indicating its file format. Common types: "application/pdf", "application/msword" filename: type: string description: |- The original filename of the uploaded policy document. Undefined if the filename was not captured during upload. id: type: string description: >- The unique identifier for the uploaded policy file in Vanta's system. required: - effectiveOrCreationDate - locale - url - mimeType - id type: object description: The uploaded policy file for this version. required: - title - policyId - policyVersionId - policyVersionFileId - file type: object additionalProperties: false VantaTestEvidence: description: >- Evidence in the form of a Vanta automated test run. Vanta Tests are automated compliance tests with metadata like test status, execution time, and file type. Tests generate evidence files that can be workpapers, raw data, or API request logs. properties: title: type: string description: The title of the test run as displayed in Vanta. testId: type: string description: The unique identifier for the test in Vanta's system. snapshotId: type: string description: >- The unique identifier for the point-in-time capture of this test run's evidence. A snapshot is an immutable record of all files (workpapers, raw data, etc.) generated during a single test execution. testRunStatus: $ref: '#/components/schemas/VantaTestRunStatus' description: The outcome status of the test run. executedAt: type: string format: date-time description: |- The date and time when the test was executed. Format: ISO 8601 UTC timestamp. fileType: $ref: '#/components/schemas/VantaTestFileType' description: The type of evidence file included in this evidence. file: properties: mimeType: type: string description: >- The MIME type of the evidence file. Common types: "application/pdf" for workpapers, "text/csv" for raw data url: type: string description: |- A presigned URL for downloading the evidence file. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. required: - mimeType - url type: object description: The evidence file for this test run. required: - title - testId - snapshotId - testRunStatus - executedAt - fileType - file type: object additionalProperties: false VantaTestSnapshotEvidence: description: >- Evidence in the form of a Vanta automated test run snapshot. Unlike VantaTestEvidence (which represents a single file within a test run's evidence packet), a snapshot represents the entire test-run bundle. Use the dedicated snapshot detail endpoint to retrieve the files associated with a snapshot. properties: snapshotId: type: string description: >- The unique identifier for the point-in-time capture of this test run's evidence. A snapshot is an immutable record of all files (workpapers, raw data, etc.) generated during a single test execution. testId: type: string description: The unique identifier for the test in Vanta's system. testRunId: type: string description: >- The unique identifier for the test run this snapshot was captured from. testRunTitle: type: string description: The title of the test run as displayed in Vanta. testRunStatus: type: string enum: - NA - IN_PROGRESS - FAIL - PASS - INVALID - DISABLED description: The outcome status of the test run. testRunExecutedAt: type: string format: date-time description: |- The date and time when the test was executed. Format: ISO 8601 UTC timestamp. required: - snapshotId - testId - testRunId - testRunTitle - testRunStatus - testRunExecutedAt type: object additionalProperties: false VantaDocumentUploadedEvidence: description: |- Represents an uploaded file in a Vanta Document. The file is stored in Vanta's system and accessed via a presigned URL. properties: type: type: string enum: - uploaded nullable: false description: Discriminator to identify this as an uploaded file. id: type: string description: The unique identifier for the file version in Vanta's system. filename: type: string description: |- The original filename of the uploaded document. Undefined if the filename was not captured during upload. mimeType: type: string description: >- The MIME type of the document indicating its file format. Common types: "application/pdf", "image/png", "image/jpeg", "text/plain" url: type: string description: |- A presigned URL for downloading the document. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. required: - type - id - mimeType - url type: object additionalProperties: false VantaDocumentLinkEvidence: description: |- Represents an external link in a Vanta Document. The link points to documentation hosted outside of Vanta's system. properties: type: type: string enum: - link nullable: false description: Discriminator to identify this as an external link. id: type: string description: The unique identifier for the file version in Vanta's system. url: type: string description: The URL pointing to the external documentation or resource. required: - type - id - url type: object additionalProperties: false VantaTestRunStatus: type: string enum: - NA - IN_PROGRESS - FAIL - PASS - INVALID - DISABLED VantaTestFileType: type: string enum: - TEST_EVIDENCE_WORKPAPER - TEST_RAW_DATA - OUT_OF_SCOPE_RESOURCES - API_REQUESTS securitySchemes: bearerAuth: type: http scheme: bearer ````