Upsert a control's assessment within an audit
Records (upserts) an auditor’s assessment state and justification for a control within an IRL audit — the API equivalent of assessing a control in the web app. Overwrites the assessment for this control in the chosen audit segment.
segmentId may be any segment on the audit, PROGRAM or SYSTEM (see
segments on the audit). It may be omitted only when the audit has
exactly one segment. The assessmentState must be valid for that
segment’s framework (the request is rejected otherwise). The acting
auditor is identified by auditorEmail, which must belong to the audit
firm making the request.
Returns 404 when the control is not part of the audit or the auditor email
does not resolve to a firm user. Returns 422 when segmentId is omitted
on an audit with more than one segment, when segmentId is not a segment
on this audit, or when the control is not assigned to that segment for
this audit. Applies to both Full and Controlled Audit View audits.
Rate limit: 10 requests / minute.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Input for upserting a control's auditor assessment within an audit. Overwrites the assessment for this control in the chosen audit segment.
The assessment state to record. Must be one of the states valid for the segment's framework; the request is rejected otherwise.
IN_PLACE, NOT_IN_PLACE, PARTIAL, NOT_ASSESSED, CONFORMING, MINOR_NON_CONFORMITY, MAJOR_NON_CONFORMITY, SATISFIED, NOT_SATISFIED, OTHER_THAN_SATISFIED, TRUE, FALSE Free-text reasoning for the assessment. Required, and at most 5000 characters.
Email of the auditor performing the assessment. Must match an existing Vanta user who belongs to the audit firm making the API request.
The segment to assess: any segment on the audit, PROGRAM or SYSTEM.
May be omitted only when the audit has exactly one segment; required
otherwise.
Response
Ok
A control's auditor assessment returned by the assessment write endpoint.
The control this assessment belongs to.
The audit segment this assessment was written to.
The recorded assessment state.
IN_PLACE, NOT_IN_PLACE, PARTIAL, NOT_ASSESSED, CONFORMING, MINOR_NON_CONFORMITY, MAJOR_NON_CONFORMITY, SATISFIED, NOT_SATISFIED, OTHER_THAN_SATISFIED, TRUE, FALSE The recorded justification.