Upsert a control's assessment within an audit
Records (upserts) an auditor’s assessment state and justification for a control within an IRL audit — the API equivalent of assessing a control in the web app. Overwrites the assessment for this control in the chosen program segment.
segmentId is required when the audit has more than one program segment.
On a single-program audit it may be omitted. The assessmentState must be
valid for that segment’s framework (the request is rejected otherwise). The
acting auditor is identified by auditorEmail, which must belong to the
audit firm making the request.
Returns 404 when the control is not part of the audit or the auditor email
does not resolve to a firm user. Returns 422 when segmentId is missing on
a multi-program audit, is not a program segment on the audit, or the
control is not assessment-eligible in that segment. Applies to both Full
and Controlled Audit View audits.
Rate limit: 10 requests / minute.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Input for upserting a control's auditor assessment within an audit. Overwrites the assessment for this control in the chosen program segment.
The assessment state to record. Must be one of the states valid for the segment's framework; the request is rejected otherwise.
IN_PLACE, NOT_IN_PLACE, PARTIAL, NOT_ASSESSED, CONFORMING, MINOR_NON_CONFORMITY, MAJOR_NON_CONFORMITY, SATISFIED, NOT_SATISFIED, OTHER_THAN_SATISFIED, TRUE, FALSE Free-text reasoning for the assessment. Required, and at most 5000 characters.
Email of the auditor performing the assessment. Must match an existing Vanta user who belongs to the audit firm making the API request.
The program segment to assess. Required when the audit has more than one program segment. Optional on a single-program audit (the only program is used). Must be a program segment on the audit; system segments are rejected.
Response
Ok
A control's auditor assessment, as persisted. Returned by the assessment write endpoint so the caller sees exactly what was recorded.
The control this assessment belongs to.
The program segment this assessment was written to.
The recorded assessment state.
IN_PLACE, NOT_IN_PLACE, PARTIAL, NOT_ASSESSED, CONFORMING, MINOR_NON_CONFORMITY, MAJOR_NON_CONFORMITY, SATISFIED, NOT_SATISFIED, OTHER_THAN_SATISFIED, TRUE, FALSE The recorded justification.