Update an information request for an audit
Updates an existing information request for an audit, allowing modification of request details as audit requirements evolve. Supports partial updates where only specified fields are changed; omitted fields remain unchanged.
Common use cases:
- Updating due dates as audit timelines shift
- Refining descriptions to clarify requirements
- Adjusting request type
Note: The modificationDate is automatically updated to the current timestamp
when any field is changed.
Rate limit: 50 requests / minute.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Input for partially updating an information request. Only provided fields will be updated; omitted fields remain unchanged. At least one field must be provided.
Framework codes are assigned only at creation; on update this field is a silent no-op — a value sent here is accepted for backwards compatibility but ignored, leaving the request's framework codes unchanged.
Detailed description of what evidence is needed.
Deadline for fulfilling this request. Null if no deadline. Format: ISO 8601 UTC timestamp.
Start date of the audit period. Evidence before this date may not be accepted. Null if not restricted. Format: ISO 8601 UTC timestamp.
Scope of evidence required.
POINT_IN_TIME, POPULATION, SAMPLE Short, descriptive title.
How frequently this request recurs.
ANNUALLY, BIANNUALLY, MONTHLY, QUARTERLY This legacy field is accepted for backwards compatibility but ignored.
Use linkedControlIds to replace the complete set of linked controls.
The complete desired set of control IDs linked to this request. Send the full list to replace the set, an empty array to clear it, or omit the property to leave links unchanged. Each ID must identify an existing control in the customer's organization and is returned by the audit controls endpoint. The request is rejected if any ID does not match a control.
Response
Ok
Information Request resource representing a single request for audit evidence from a customer.
An information request is created by an auditor and shared with the customer organization. The customer then uploads evidence, which the auditor reviews and either approves or flags for issues.
The unique identifier for the information request within Vanta's system. This is the primary identifier used in all API endpoints. Format: ObjectId as a string (e.g., "6890e473dce1da5d8406f5e7")
External unique ID to prevent duplicates across different audit systems.
Used for idempotency when syncing data between external audit management
systems and Vanta. Unlike id, this value is provided by the external system.
Deprecated control-linkage field retained for response compatibility. It
may contain control IDs supplied directly to the request, but it is not a
complete or guaranteed-current list of controls linked to the request. To
list information requests linked to a particular control, use the
GET /audits/{auditId}/controls/{controlId}/information-requests endpoint.
A request may be absent from that endpoint when its link appears only in
this deprecated field.
Current approval status tracking the request's lifecycle through evidence submission and auditor review.
NEEDS_EVIDENCE, READY_FOR_AUDIT, AUDITOR_APPROVED, AUDITOR_FLAGGED How frequently this information request recurs (e.g., annual password policy reviews). Null for one-time requests.
ANNUALLY, BIANNUALLY, MONTHLY, QUARTERLY Always empty on read. To find requests for a control, use
GET /audits/{auditId}/controls/{controlId}/information-requests.
For request assignment, use segmentIds.
Audit segments this request is assigned to. Empty means unassigned. Resolved against the current audit scope — stale IDs are dropped.
This field is a current-scope projection, not a stored watermark. An
audit-scope change that drops or adds IDs here does not update
creationDate, modificationDate, or deletionDate, so it does not appear in
changedSinceDate delta sync on its own. Re-fetch the list without that
parameter, or GET the request by id, to see the current projection.
Detailed description explaining what evidence is needed and why. Should provide clear instructions to help the customer understand what to submit.
The deadline by which the customer must fulfill this request. Null if no specific deadline is set. Format: ISO 8601 UTC timestamp.
The earliest date for which evidence should be captured. Evidence dated before this date may not be accepted. Null if not restricted. Format: ISO 8601 UTC timestamp.
Non-unique external reference ID for this request.
Unlike uniqueId which must be unique, requestId is for display/reference
purposes only (e.g., "REQ-123"). Null if not provided.
Defines the scope of evidence required.
POINT_IN_TIME, POPULATION, SAMPLE Short, descriptive title summarizing what is being requested.
Timestamp when the request was created in the system. Format: ISO 8601 UTC timestamp.
Timestamp when the request was last modified. Format: ISO 8601 UTC timestamp.
Timestamp when the request was soft-deleted. Null if the request has not been deleted. Soft deletes allow retaining history while hiding the request from normal operations. Format: ISO 8601 UTC timestamp.
Resource owner (user or team) assigned to this information request. Returns null if no resource owner is assigned.
- Option 1
- Option 2