Upsert a control's assessment within an audit
Records (upserts) an auditor’s assessment state and justification for a control within an IRL audit — the API equivalent of assessing a control in the web app. Overwrites the single assessment for this control in the audit’s program segment.
The assessmentState must be valid for the audit’s framework (the request
is rejected otherwise). The acting auditor is identified by auditorEmail,
which must belong to the audit firm making the request.
Returns 404 when the control is not part of the audit or the auditor email does not resolve to a firm user. Applies to both Full and Controlled Audit View audits.
Rate limit: 10 requests / minute.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Input for upserting a control's auditor assessment within an audit. Overwrites the single assessment for this control in the audit's program segment.
The assessment state to record. Must be one of the states valid for the audit's framework; the request is rejected otherwise.
IN_PLACE, NOT_IN_PLACE, PARTIAL, NOT_ASSESSED, CONFORMING, MINOR_NON_CONFORMITY, MAJOR_NON_CONFORMITY, SATISFIED, NOT_SATISFIED, OTHER_THAN_SATISFIED, TRUE, FALSE Free-text reasoning for the assessment. Required, and at most 5000 characters.
Email of the auditor performing the assessment. Must match an existing Vanta user who belongs to the audit firm making the API request.
Response
Ok
A control's auditor assessment, as persisted. Returned by the assessment write endpoint so the caller sees exactly what was recorded.
The control this assessment belongs to.
The recorded assessment state.
IN_PLACE, NOT_IN_PLACE, PARTIAL, NOT_ASSESSED, CONFORMING, MINOR_NON_CONFORMITY, MAJOR_NON_CONFORMITY, SATISFIED, NOT_SATISFIED, OTHER_THAN_SATISFIED, TRUE, FALSE The recorded justification.