Audits

List risks for an audit

Retrieves risk population data for an audit.

This endpoint provides access to the risk records visible to auditors during an audit engagement. Risk data is scoped to a specific risk assessment snapshot identified by the snapshotId parameter.

Supports filtering by:

search: Searches risk scenario descriptions (case-insensitive)

Results are sorted by identified date (newest first) by default. Use orderBy and orderDirection to customize sorting. Sort parameters must remain consistent across paginated requests.

Uses cursor-based pagination. To paginate:

Make initial request with desired pageSize
Check results.pageInfo.hasNextPage
Use results.pageInfo.endCursor as pageCursor for next request

Supports audits with one or more program segments. Audits with system segments are not supported by this endpoint.

Only Controlled Audit View (CAV) audits are supported. Full Audit View audits are rejected with 403. Returns 403 if the customer has not made this population page visible to auditors. Also returns 403 if the snapshot is not shared with auditors, and 404 if the snapshot does not exist. Use snapshot IDs from GET /audits/{auditId}/risks/snapshots, which lists only snapshots shared with auditors.

Rate limit: 10 requests / minute.

GET

audits

{auditId}

risks

{snapshotId}

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.listAuditRisks({
    auditId: "<id>",
    snapshotId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.ListAuditRisksRequest;
import com.vanta.vanta_auditor_api.models.operations.ListAuditRisksResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        ListAuditRisksRequest req = ListAuditRisksRequest.builder()
                .auditId("<id>")
                .snapshotId("<id>")
                .build();

        ListAuditRisksResponse res = sdk.audits().listAuditRisks()
                .request(req)
                .call();

        if (res.paginatedResponseAuditRisk().isPresent()) {
            System.out.println(res.paginatedResponseAuditRisk().get());
        }
    }
}

import requests

url = "https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "results": {
    "pageInfo": {
      "hasNextPage": true,
      "hasPreviousPage": false,
      "startCursor": "5f2c939a52855e725c8d5824",
      "endCursor": "5f2c939a52855e725c8d5824"
    },
    "data": [
      {
        "id": "5f2c939a52855e725c8d5824",
        "riskId": "RISK-001",
        "riskScenario": "Unauthorized access to production database",
        "likelihood": 4,
        "impact": 5,
        "inherentRisk": 20,
        "treatment": "MITIGATE",
        "treatmentStatus": "IN_PROGRESS",
        "residualRisk": 6,
        "reviewStatus": "APPROVED",
        "owner": {
          "displayName": "Jane Doe"
        },
        "categories": [
          "Cryptography",
          "Privacy"
        ],
        "ciaCategories": [
          "CONFIDENTIALITY",
          "INTEGRITY"
        ],
        "linkedControlIds": [
          "control-1",
          "control-2"
        ],
        "identified": "2023-01-15T10:00:00.000Z"
      }
    ]
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

auditId

string

required

The audit ID

snapshotId

string

required

The risk assessment snapshot ID

Query Parameters

pageSize

integer<int32>

default:10

Maximum number of results per page (1-100, default 10) Controls the maximum number of items returned in one response from the API.

Required range: 1 <= x <= 100

pageCursor

string

Pagination cursor from previous response A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.

string

Search term for filtering by risk scenario description

orderBy

enum<string>

Field to sort results by. Allowed: "riskId", "riskScenario", "inherentRisk", "treatment", "residualRisk", "reviewStatus", "owner", "categories", "ciaCategories", "identified". Default: "identified"

Available options:

inherentRisk,

riskId,

riskScenario,

treatment,

residualRisk,

reviewStatus,

owner,

categories,

ciaCategories,

identified

orderDirection

enum<string>

Sort direction: "asc" or "desc". Default: "desc" "asc" for ascending, "desc" for descending.

Available options:

asc,

desc

Response

200 - application/json

Paginated list of risks with pagination metadata

results

object

required

Show child attributes

⌘I

TypeScript

import { Vanta } from "vanta-auditor-api-sdk";

const vanta = new Vanta({
  bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "",
});

async function run() {
  const result = await vanta.audits.listAuditRisks({
    auditId: "<id>",
    snapshotId: "<id>",
  });

  console.log(result);
}

run();

package hello.world;

import com.vanta.vanta_auditor_api.Vanta;
import com.vanta.vanta_auditor_api.models.operations.ListAuditRisksRequest;
import com.vanta.vanta_auditor_api.models.operations.ListAuditRisksResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Vanta sdk = Vanta.builder()
                .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", ""))
            .build();

        ListAuditRisksRequest req = ListAuditRisksRequest.builder()
                .auditId("<id>")
                .snapshotId("<id>")
                .build();

        ListAuditRisksResponse res = sdk.audits().listAuditRisks()
                .request(req)
                .call();

        if (res.paginatedResponseAuditRisk().isPresent()) {
            System.out.println(res.paginatedResponseAuditRisk().get());
        }
    }
}

import requests

url = "https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/audits/{auditId}/risks/{snapshotId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "results": {
    "pageInfo": {
      "hasNextPage": true,
      "hasPreviousPage": false,
      "startCursor": "5f2c939a52855e725c8d5824",
      "endCursor": "5f2c939a52855e725c8d5824"
    },
    "data": [
      {
        "id": "5f2c939a52855e725c8d5824",
        "riskId": "RISK-001",
        "riskScenario": "Unauthorized access to production database",
        "likelihood": 4,
        "impact": 5,
        "inherentRisk": 20,
        "treatment": "MITIGATE",
        "treatmentStatus": "IN_PROGRESS",
        "residualRisk": 6,
        "reviewStatus": "APPROVED",
        "owner": {
          "displayName": "Jane Doe"
        },
        "categories": [
          "Cryptography",
          "Privacy"
        ],
        "ciaCategories": [
          "CONFIDENTIALITY",
          "INTEGRITY"
        ],
        "linkedControlIds": [
          "control-1",
          "control-2"
        ],
        "identified": "2023-01-15T10:00:00.000Z"
      }
    ]
  }
}

API Basics

Manage API

Integrations API

Audit API

Webhooks

List risks for an audit

Authorizations

Path Parameters

Query Parameters

Response