Manage Vanta APINew
Business units and program scopes are now available via API
GET /business-units and GET /business-units/{businessUnitId} list and retrieve your business units. They return 403 when business unit scoping is disabled.GET /program-scopes and GET /program-scopes/{programScopeId} list and retrieve program scopes. A program scope pairs a businessUnitId with a frameworkId. Filter the list with businessUnitIdMatchesAny and frameworkIdMatchesAny.Manage Vanta APINew
Groups can now be updated and deleted
PATCH /groups/{groupId} updates a group’s name, description, or pointOfContactEmail. Pass null to clear description or pointOfContactEmail. DELETE /groups/{groupId} deletes a group. You can’t delete the default group, and groups created in Vanta must have no assigned people.Manage Vanta APINew
Look up the organization behind your token
A newGET /organization endpoint returns the id, displayName, and region of the organization your token is connected to.Manage Vanta APINew
Personnel notification settings can now be managed via API
GET /personnel-notification-settings returns your personnel reminder and employee-digest settings. PATCH /personnel-notification-settings updates them. Omitted fields stay unchanged.Manage Vanta APINew
Risk scenarios can now be mapped to vendor findings
GET /risk-scenarios/{riskScenarioId}/mappings/vendor-findingslists mapped vendor finding IDs.POST /risk-scenarios/{riskScenarioId}/mappings/vendor-findingslinks findings viavendorFindingIdsToLink.DELETE /risk-scenarios/{riskScenarioId}/mappings/vendor-findingsunlinks findings viavendorFindingIdsToUnlink.GET /risk-scenarios/{riskScenarioId}/mappings/enterprise-riskreturns the enterprise risk a scenario is linked to, if any.
Manage Vanta APIUpdated
People can now be filtered by framework, program scope, and business unit
GET /people adds the frameworkIdMatchesAny, programScopeIdMatchesAny, and businessUnitIdMatchesAny filters. Person objects now include programScopeIds.Manage Vanta APIUpdated
Frameworks now include a lifecycle status
GET /frameworks and GET /frameworks/{frameworkId} now return a nullable status: ACTIVE, DRAFT, SNOOZED, ARCHIVED, or NEW_UPGRADE. Set the new includeStatus query parameter to false to omit it. It defaults to true.Manage Vanta APIUpdated
Controls now support implementation details
Control responses, includingGET /controls and GET /controls/{controlId}, now include a nullable implementationDetails field. PATCH /controls/{controlId} accepts implementationDetails.Manage Vanta APIUpdated
Deactivated controls now include frameworks and deactivation reason
GET /controls/deactivated-controls now returns frameworks (with id, displayName, shorthandName, and sections), a nullable deactivationReason, and implementationDetails for each control.Manage Vanta APIUpdated
Vendor assessments now include questionnaire question counts
GET /vendors/{vendorId}/assessments now returns a nullable questionnaire object. Its questionCounts include all, needsReview, notAnswered, and flaggedByAI.Manage Vanta APIUpdated
Vendor risk attributes now include their risk section
GET /vendor-risk-attributes now returns a riskSection object (id and name) for each attribute.Manage Vanta APIUpdated
Risk scenarios now include a score breakdown
Risk scenario responses, includingGET /risk-scenarios and GET /risk-scenarios/{riskScenarioId}, now include a nullable scoreBreakdown array. Each entry has a kind (SCORE, DIMENSION, or FACTOR), a status (SCORED, MISSING, or NOT_APPLICABLE), score, scoreLabel, and parentId. It’s null when Flexible Risk Scoring is off.Manage Vanta APIUpdated
Trust Center updates: section visibility, denial emails, and new frameworks
GET /trust-centers/{slugId}/compliance-frameworksnow returnsisSectionVisiblealongsideresults.POST /trust-centers/{slugId}/access-requests/{accessRequestId}/denyaccepts an optionalsendEmailflag to notify the requester. It defaults tofalse.- The
standardenum for creating and updating Trust Center compliance frameworks addsaiuc1_26q3,atc, andfedramp20x_classA.
Manage Vanta APIUpdated
Questionnaire status adds queued states
TheQuestionnaireStatus enum on GET /customer-trust/questionnaires adds QUEUED_FOR_SECTION_EXTRACTION and QUEUED_FOR_ANSWERING.Manage Vanta APIBreaking
Legacy answer field removed from questionnaire responses
Questionnaire responses, such as GET /customer-trust/questionnaires/{questionnaireId}/responses, no longer return the deprecated answer field. Use answerPartsSchema and answerPartsValues instead.Manage Vanta APIDeprecated
status on vendor updates is deprecated
The status field on PATCH /vendors/{vendorId} is deprecated and ignored. Use POST /vendors/{vendorId}/set-status to change vendor status.Auditor APIUpdated
Audits now expose their scope as segments
Audit objects onGET /audits and GET /audits/{auditId} now include a segments array. Each segment has a kind (PROGRAM or SYSTEM), displayName, framework, and nullable businessUnit, system, and soc2Deliverable (with reportType and tscs). The top-level framework field is deprecated. Use segments instead.Auditor APIUpdated
Audits now report information request list generation status
Audit objects now include a nullableirlGenerationStatus: PENDING, RUNNING, READY, or FAILED. It’s null when the audit has no Vanta-generated information request list.Auditor APIUpdated
Audit controls and assessments are now segment-aware
GET /audits/{auditId}/controlsnow returnsinScopeSegmentIds, and each entry inassessmentsincludessegmentId. The control’sframeworkfield is deprecated.PUT /audits/{auditId}/controls/{controlId}/assessmentacceptssegmentIdand returns it. You can omit it only when the audit has exactly one segment.
Auditor APIUpdated
Information requests add linkedControlIds and segment assignment
- Information requests now return
linkedControlIds, the complete current set of linked controls, andsegmentIds, the audit segments the request is assigned to. PATCH /audits/{auditId}/information-requests/{requestId}acceptslinkedControlIdsto replace the linked set.GET /audits/{auditId}/information-requestsadds asegmentIdsMatchesAnyfilter.additionalControlIdsandframeworkCodesare deprecated on information requests.frameworkCodesis always empty on read.
Auditor APIUpdated
Framework codes are now grouped by framework
GET /audits/{auditId}/framework-codes now returns codesByFramework, with valid codes grouped by each in-scope framework. The flat frameworkCodes field is deprecated.Auditor APIDeprecated
fillOutcome on information request activity is deprecated
The fillOutcome field on GET /audits/{auditId}/information-requests/{requestId}/activity is deprecated and always null.Integrations APIUpdated
More resource fields now accept null
Several fields on Integrations API resource types now accept null on PUT and may return null on GET. Affected resources include user_account (for example mfaEnabled and lastLoginTimestamp), macos_user_computer, windows_user_computer, secret, security_task, background_check_connector, user_security_training_status, and the package, static analysis, and API endpoint vulnerability connectors.Manage Vanta APINew
Questionnaire responses are now available via API
Four new endpoints manage the responses on a Customer Trust questionnaire.GET /customer-trust/questionnaires/{questionnaireId}/responses lists responses, and GET /customer-trust/questionnaires/{questionnaireId}/responses/{responseId} retrieves one. PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId} updates answer content, and PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}/owner reassigns or clears the response owner. Each response carries answerPartsSchema and answerPartsValues; the legacy answer field is deprecated.Manage Vanta APINew
Groups can now be created and imported from your IdP
A newPOST /groups endpoint creates a group. GET /groups/importable-idp-groups lists identity provider groups available to import, and POST /groups/import-from-idp imports them, returning a per-group success or error result.Manage Vanta APINew
Tag categories can now be enabled per product context
A newPOST /customer-trust/tag-categories/{tagCategoryId}/product-contexts endpoint enables a tag category for a product context, such as document sharing or control sharing. DELETE /customer-trust/tag-categories/{tagCategoryId}/product-contexts/{productContextId} disables it. Both operations are idempotent.Auditor APINew
Information request evidence can now be fetched by ID
A newGET /audits/{auditId}/information-requests/{requestId}/evidence/{evidenceId} endpoint retrieves a single evidence item attached to an information request. Soft-deleted evidence stays fetchable; check deletionDate to identify deleted records.Manage Vanta APIUpdated
Group responses now include description, source, and point of contact
Group objects onGET /groups and GET /groups/{groupId} now include description, source, personnelCount, and pointOfContact (with email and displayName).Manage Vanta APIUpdated
Questionnaire status adds section and answer-generation states
TheQuestionnaireStatus enum on GET /customer-trust/questionnaires adds EXTRACTING_SECTIONS, MAPPING_SECTIONS, and GENERATING_ANSWERS.Manage Vanta APIUpdated
Issue actors can now be applications
TheActorType enum on GET /issues responses adds APPLICATION alongside USER and WORKFLOW_GENERATED, so issue history can attribute actions to an API client.Manage Vanta APIUpdated
Trust Center compliance frameworks support TISAX 2027
Thestandard enum on Create Trust Center compliance framework and Update Trust Center compliance framework adds tisax2027.Manage Vanta APIUpdated
Document and Trust Center media downloads support YAML
GET /documents/{documentId}/uploads/{uploadedFileId}/media and GET /trust-centers/{slugId}/resources/{resourceId}/media now declare application/yaml and text/x-yaml response content types for YAML files.Auditor APIUpdated
Issue snapshots now expose approval progress
OnGET /audits/{auditId}/issues/items, snapshotted issues now include a nullable approvalProgress object with approvedCount and totalApprovers, and the snapshot status enum adds PENDING_REVIEW.Manage Vanta APIAuditor APIUpdated
Rate limits raised on several Auditor API endpoints
Rate limits increased from 10 to 50 requests per minute on Update audit evidence, Get framework codes for an audit, Delete an information request for an audit, and Share information request list with customer. Limits increased from 10 to 25 requests per minute on Create a comment for audit evidence, Update a comment for an information request, and Delete a comment for an information request. On the Manage Vanta API,POST /contracts now documents a limit of 10 requests per minute.Manage Vanta APINew
Vendor assessment types are now available via API
NewGET /vendor-assessment-types and GET /vendor-assessment-types/{assessmentTypeId} endpoints list and retrieve vendor assessment types, filterable by status (ACTIVE or ARCHIVED). See the Vendor Assessment Types reference.Auditor APINew
Auditors can now record control assessments via API
A newPUT /audits/{auditId}/controls/{controlId}/assessment endpoint records an auditor’s assessment and justification for a control within an IRL audit. See the Upsert a control’s assessment within an audit reference.Auditor APINew
Audit evidence items and comments can now be fetched by ID
Three new endpoints get a single record by ID:GET /audits/{auditId}/evidence/{auditEvidenceId} for an audit evidence item, GET /audits/{auditId}/evidence/{auditEvidenceId}/comments/{commentId} for an evidence comment, and GET /audits/{auditId}/information-requests/{requestId}/comments/{commentId} for an information-request comment.WebhooksNew
New webhooks fire when audit evidence enters or leaves scope
v1.evidence.created fires when an evidence item comes into scope for an audit, and v1.evidence.deleted fires when an evidence item leaves scope (soft-deleted).WebhooksUpdated
v1.evidence.status-changed can now fire with unchanged status
v1.evidence.status-changed can now fire with oldStatus equal to newStatus.Manage Vanta APIUpdated
Trust Center responses now expose control status visibility settings
TrustCenter responses now include a new controlVisibilityMode field, and TrustCenterControlCategory responses include new visibility and statusVisibilityOverride fields. The Update Trust Center control category endpoint accepts both new fields.Manage Vanta APIUpdated
Customer Trust tag category filter now supports CONTROL_SHARING
GET /customer-trust/tag-categories now accepts CONTROL_SHARING in the productContextIdsMatchesAny query filter.Auditor APIUpdated
assessments array only includes in-scope segments
On GET /audits/{auditId}/controls, the assessments array now contributes an entry only for segments the control is in scope for.Auditor APINew
IRL audits can now be duplicated into a new engagement
A newPOST /audits/duplicate endpoint copies an existing IRL audit, including its information requests, into a new engagement with new dates and auditor roster.Auditor APINew
Audit controls now include per-segment assessments
GET /audits/{auditId}/controls now returns an assessments array with the auditor’s assessmentState and justification for each audit segment.Manage Vanta APIAuditor APINew
Framework enums now include NIST 800-171 R3 and BSI C5
The Manage Vanta API and Auditor APIFramework enum adds NIST_171_R3, and the Manage Vanta API FrameworkKey enum adds nist171r3 and bsic5. See the Frameworks reference and Audits API reference.Manage Vanta APIUpdated
Contracts now support an externalId for idempotent uploads
POST /customer-trust/contracts now accepts and returns an optional externalId. Repeat uploads with the same externalId return 409.Manage Vanta APIBreaking
Trust Center viewer NDA response no longer includes DocuSign webhookId
The ndaInfo.docuSign.webhookId field has been removed from Trust Center viewer responses. envelopeId, accountId, and accountBaseUrl still identify the DocuSign envelope.Manage Vanta APINew
Vendor assessments API is now GA
GET /v1/vendors/{vendorId}/assessments and GET /v1/vendors/{vendorId}/assessments/{assessmentId} are now generally available and include the assessment-level owner field.Manage Vanta APINew
Deactivated controls can now be listed via API
A newGET /v1/controls/deactivated-controls endpoint returns paginated deactivated controls. GET /v1/controls/controls-library will be deprecated in a future release.Manage Vanta APINew
Trust Center compliance frameworks can now be managed via API
New endpoints list, create, update, and delete Trust Center compliance frameworks, and upload a framework badge image. See the Trust Center compliance frameworks reference.Manage Vanta APINew
Trust Center chatbot conversations are now available via API
GET /trust-centers/{slugId}/chatbot/conversations lists Trust Center chatbot conversations, and GET /trust-centers/{slugId}/chatbot/conversations/{conversationId} returns the messages in a conversation.Manage Vanta APINew
Trust Center controls now support bulk operations
New endpoints bulk add or remove tags on Trust Center controls, bulk edit controls in a category, and reorder controls and control categories.Manage Vanta APINew
More Trust Center settings can now be managed via API
New endpoints list and set the data collected shown on your Trust Center, upload a favicon, set videos, send viewer invite reminders, and manage Trust Center FAQ categories.Manage Vanta APINew
Data deletion requests can now be created via API
A newPOST /customer-trust/deletion-requests endpoint creates a data deletion request.Manage Vanta APINew
Vanta issues are now available via API
GET /issues lists issues, and GET /issues/{issueId} returns a single issue.WebhooksNew
Webhooks now include a Control domain for audit comment events
Webhook events now include a Control domain covering audit control comment events, delivered only to Audit Partner accounts during an active audit engagement. See the Webhooks overview.Auditor APINew
Auditor APINew
Audit integrations and organization details are now available via API
Three new read endpoints give auditors more context during an engagement:GET /audits/{auditId}/integrations, GET /audits/{auditId}/organization/information, and GET /audits/{auditId}/organization/notifications. Available only to Audit Partner accounts during an active audit engagement.Manage Vanta APIUpdated
Security reviews now include assessment type and owner
GET /v1/vendors/{vendorId}/security-reviews responses now include assessmentType and owner (id, type, displayName, email). owner is null when unassigned; email is populated for user owners and null for team owners.Auditor APIUpdated
Information request history now tracks audit duplication
Information request history activities now include two new fields:sourceInformationRequestId (the request this one was copied from) and sourceAuditId (the audit it was duplicated from). Both are populated only for audit-duplication activities and null otherwise. See the Audits API reference.Manage Vanta APIUpdated
Event log reference now includes new action types
The event log reference addsUNDELETE_PROGRAM_SEGMENT and REMOVE_DATA_SUBJECT_REQUEST_RELATIONSHIP_OPTION to the list of action types. PROVIDE_JUSTIFICATION_FOR_AUDIT_CONTROL_ASSESSMENT was removed.Auditor APIBreaking
Integration category and tag enums renamed
AuditIntegrationCategory was renamed to AuditIntegrationTag, and AuditIntegrationServiceCategory was renamed to AuditIntegrationCategory. Update generated clients that reference the old schema names.Manage Vanta APIBreaking
Issue sort field values changed to camelCase
IssueSortField enum values on the Issues endpoints changed from DUE_DATE, CREATED_AT, DETECTED_AT, LAST_MODIFIED_AT, STATUS, SEVERITY to dueDate, createdDate, detectedDate, lastModifiedDate, status, severity. Update any clients that hardcoded the old values.Manage Vanta APIBreaking
Vendor accountManagerEmail max length reduced
The maxLength on the Vendor accountManagerEmail field was reduced from 2000 to 100 characters. Requests with longer values will be rejected.Manage Vanta APIFixed
Issue detectedDate is now non-nullable
The detectedDate field on issue responses is no longer marked nullable in the OpenAPI spec. Every issue has a detected timestamp.Manage Vanta APINew
Risk scenario controls can now be managed via API
New endpoints link and manage controls on a risk scenario:GET /risk-scenarios/{riskScenarioId}/controls lists a scenario’s controls, POST /risk-scenarios/{riskScenarioId}/controls adds a control, PATCH /risk-scenarios/{riskScenarioId}/controls/{controlId} changes a control’s controlType, and DELETE /risk-scenarios/{riskScenarioId}/controls/{controlId} removes a control.Manage Vanta APINew
Trust Center resources can now be organized into categories
New endpoints list, add, reorder, update, and delete Trust Center resource categories. See the Trust Center resource categories reference.Manage Vanta APINew
Trust Center viewer access can now be updated via API
A newPATCH /trust-centers/{slugId}/viewers/{viewerId} endpoint updates a viewer’s access on a Trust Center without removing and re-adding them.Manage Vanta APINew
Trust Center FAQ responses now include category
Trust Center FAQ endpoints now return the FAQ’scategory (id and name).Auditor APIUpdated
Test snapshot evidence now includes more detail
The test-snapshot evidence detail endpoint now returns two new fields.apiRequests lists HTTP requests captured during API introspection tests. outOfScopeResources lists resources excluded at the test level (customer-disabled) and the framework level (segment configuration).Auditor APIUpdated
Audit issues now support more filters
GET /audits/{auditId}/issues/items now accepts createdAfterDate, createdBeforeDate, detectedAfterDate, and detectedBeforeDate query parameters, and orderBy now accepts detectedAt.Auditor APIUpdated
Code changes date filters were renamed
ThestartDate and endDate query parameters on GET /audits/{auditId}/assets/code-changes were renamed to closedAfterDate and closedBeforeDate for consistency with other Auditor API endpoints. Update any clients that hardcoded the old names.Manage Vanta APIUpdated
Event log reference now includes more actions and targets
The event log reference now lists new action types covering Trust Center FAQ and resource categories, program segments, risk register updates, subscription renewals, in-app purchases, and Trust Center viewer reminders. It also adds three new target types:TRUST_CENTER_FAQ_CATEGORY, TRUST_CENTER_RESOURCE_CATEGORY, and QUESTIONNAIRE_AUTOMATION.Auditor APIDeprecated
Legacy Auditor API list endpoints are now deprecated
GET /audits/{auditId}/monitored-computers, GET /audits/{auditId}/people, GET /audits/{auditId}/vendors, GET /audits/{auditId}/vulnerabilities, GET /audits/{auditId}/vulnerability-remediations, and GET /audits/{auditId}/vulnerable-assets are deprecated and work for legacy audits only, not controlled audit view. Controlled audit view uses personnel/people, personnel/computers, and managed-vendors instead.Auditor APINew
Auditors can now access code changes via API
A newGET /audits/{auditId}/assets/code-changes endpoint returns the pull requests visible to auditors during an audit engagement. Each record includes the PR title, identifier, repository, source (GitHub, GitLab, Bitbucket, or Azure DevOps), and opened/closed dates. Supports search, source filtering, date-range filtering, and cursor pagination.Manage Vanta APINew
Vanta event logs are now available via API
A newGET /event-logs endpoint lists audit events from your Vanta account, including the actor, date, and event type.Auditor APINew
Audit issue snapshots are now available via API
Two new endpoints surface the issues an auditor sees during an audit: list snapshotted issues and list audit snapshots.Auditor APINew
Manage Vanta APIUpdated
Knowledge Base resources now include Trust Center category
Knowledge Base resource endpoints now include acategoryId field for the Trust Center category a resource is filed under. Applies to REQUEST_ACCESS and PUBLIC resources.Manage Vanta APIUpdated
Risk scenarios now include an identification date
Risk scenario responses now includeidentificationDate, matching the “Identified Date” field in the Vanta UI. The value defaults to the scenario’s creation time when not explicitly set.Manage Vanta APIUpdated
Knowledge Base webpage resources now have stricter validation
Webpage resourcetitle now requires at least one character, and url is validated as a URI. Existing valid payloads are unaffected.