> ## Documentation Index
> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Evidence created

> Fires when an audit evidence item comes into scope for an audit, including when a previously removed item re-enters scope after soft-delete.

Evidence items are derived from the customer's compliance program, so this event means "a new item is now in scope for this audit", not "a customer uploaded a file". A brand-new item starts in `NOT_READY_FOR_AUDIT` with no files; wait for [`v1.evidence.status-changed`](/reference/webhooks/v1-evidence-status-changed) before requesting URLs. A re-scoped item retains its previous status and files. It may already be in `READY_FOR_AUDIT` or another state, and no follow-up status-change event is guaranteed.

**This event does not replace the initial sync.** Items can come into scope from the moment the audit exists, which is normally before your access to the audit begins, and events from before that point are not delivered or replayed. Always perform a full traversal of `GET /audits/{auditId}/evidence` when you first pick up an audit, then rely on this event for items that come into scope afterwards.



## OpenAPI

````yaml /reference/webhooks.json post /v1.evidence.created
openapi: 3.0.3
info:
  title: Vanta Webhook Events
  version: 1.0.0
  description: >-
    Reference for the events Vanta delivers to your registered webhook
    endpoints. Each operation documents a single event type, its payload schema,
    and an example body.


    These operations describe **events Vanta sends to you** — they are not
    endpoints you call. The documented schema is the event `payload`. Every
    delivery also includes signature headers and is wrapped in a delivery
    envelope. See the [Webhooks guide](/docs/webhooks) for setup, signature
    verification, and retries.
servers:
  - url: https://your-endpoint.example.com
    description: >-
      Your webhook endpoint. Vanta sends a POST request with the event payload
      as the body.
security: []
tags:
  - name: Questionnaire
    description: Questionnaire automation events.
  - name: Trust Center
    description: Trust Center access request events.
  - name: Vendor
    description: Vendor risk management events.
  - name: Information Request
    description: Audit information request (IRL) events.
  - name: Evidence
    description: Audit evidence events.
  - name: Control
    description: Audit control comment events.
paths:
  /v1.evidence.created:
    post:
      tags:
        - Evidence
      summary: Evidence created
      description: >-
        Fires when an audit evidence item comes into scope for an audit,
        including when a previously removed item re-enters scope after
        soft-delete.


        Evidence items are derived from the customer's compliance program, so
        this event means "a new item is now in scope for this audit", not "a
        customer uploaded a file". A brand-new item starts in
        `NOT_READY_FOR_AUDIT` with no files; wait for
        [`v1.evidence.status-changed`](/reference/webhooks/v1-evidence-status-changed)
        before requesting URLs. A re-scoped item retains its previous status and
        files. It may already be in `READY_FOR_AUDIT` or another state, and no
        follow-up status-change event is guaranteed.


        **This event does not replace the initial sync.** Items can come into
        scope from the moment the audit exists, which is normally before your
        access to the audit begins, and events from before that point are not
        delivered or replayed. Always perform a full traversal of `GET
        /audits/{auditId}/evidence` when you first pick up an audit, then rely
        on this event for items that come into scope afterwards.
      operationId: v1.evidence.created
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - evidence
              properties:
                evidence:
                  type: object
                  description: The evidence item that came into scope for the audit.
                  required:
                    - id
                    - auditId
                  properties:
                    id:
                      type: string
                      description: The unique identifier of the evidence.
                    auditId:
                      type: string
                      description: >-
                        The unique identifier of the audit the evidence belongs
                        to.
            example:
              evidence:
                id: 8f9e0d1c2b3a4f5e6d7c8b9a
                auditId: 5f8d0f3b9d3f2a1b4c5d6e7f
      responses:
        '200':
          description: Return any 2xx status within 15 seconds to acknowledge receipt.

````

## Related topics

- [Information request evidence created](/api-reference/information-request/information-request-evidence-created.md)
- [Evidence deleted](/api-reference/evidence/evidence-deleted.md)
- [Evidence status changed](/api-reference/evidence/evidence-status-changed.md)
- [List evidence for an information request](/api-reference/audits/list-evidence-for-an-information-request.md)
- [Vanta API changelog](/docs/changelog.md)