Skip to main content
Subscribe to stay up to date on changes to the Vanta API and developer documentation, including new endpoints, breaking changes, and release notes. Subscribe via RSS.
Manage Vanta APINew

Document evidence can now be evaluated via API

POST /documents/{documentId}/evaluate requests a Vanta AI evaluation of all files and URLs in a document’s current draft. It returns 202 when the request is accepted, or 204 when a matching successful evaluation already exists. Repeated requests for the same evidence are deduplicated.GET /documents/{documentId}/evaluation returns the evaluation summary for the current draft. It returns 404 until an evaluation outcome is saved, including while an evaluation is running, so poll it with a bounded timeout. Both endpoints return 422 with a message when the evidence can’t be evaluated, for example for sensitive documents.
Manage Vanta APINew

Trust Center videos can now be listed via API

GET /trust-centers/{slugId}/videos lists the videos on a Trust Center in display order. Each video has an id, url, title, and description. To keep a video when you call PUT /trust-centers/{slugId}/videos, send its id from this list. A video sent without an id is added as a new video with a new id.
Manage Vanta APIUpdated

Vendors can now be filtered by website URL

GET /vendors accepts an optional websiteUrl query parameter that filters vendors by website URL using canonical vendor matching. Combine it with name and statusMatchesAny to narrow the results further.
Manage Vanta APIUpdated

Issues add eight source types

The SourceType enum adds VULNERABILITY_SCANNER, PENETRATION_TEST, SECURITY_ASSESSMENT, BUG_BOUNTY, THREAT_INTELLIGENCE, AUTOMATED_CONTROL_TESTING, MANUAL_ANALYSIS, and SUPPLY_CHAIN_MONITORING. The new values can appear in source.sourceType on issues returned by GET /issues and GET /issues/{issueId}, and you can pass them to the sourceMatchesAny filter on GET /issues.
Manage Vanta APIUpdated

Trust Center compliance frameworks add aiuc1_26q4

The standard enum for creating and updating Trust Center compliance frameworks adds aiuc1_26q4.
Manage Vanta APIUpdated

Security training requirements add businessContinuity

The SecurityTrainingCategory enum adds businessContinuity. It applies to the security training requirement’s requiredCategories and to each training’s category on the task requirement set endpoints and GET /groups/{groupId}/task-requirement-set.
Manage Vanta APINew

Vendor categories can now be managed via API

New endpoints let you read every vendor category and manage your organization’s custom categories:Each category has an id, label, description, and isSystem.
Manage Vanta APINew

Frameworks can now be snoozed and reactivated via API

POST /frameworks/{frameworkId}/snooze snoozes an active framework until snoozedUntilDate, a YYYY-MM-DD date that must be tomorrow or later. Call it again to change the end date of an existing snooze. While a framework is snoozed, its tests and documents are hidden and send no notifications, and its policies are marked inactive. The framework becomes active again at 00:00 UTC on snoozedUntilDate.POST /frameworks/{frameworkId}/reactivate reactivates a snoozed framework right away. Both endpoints return the framework’s frameworkId, status (ACTIVE or SNOOZED), snoozedUntilDate, and hasChanged, which is false only when you reactivate a framework that was already active. Draft and archived frameworks can’t be snoozed or reactivated.
Manage Vanta APINew

Task requirement sets can now be managed via API

New endpoints manage the onboarding and offboarding requirements Vanta applies to your personnel:Custom requirements have their own endpoints:
Manage Vanta APIUpdated

Risk scenario mapping endpoints now accept Risk IDs

The riskScenarioId path parameter on every /risk-scenarios/{riskScenarioId}/mappings/... endpoint now accepts the risk scenario’s Risk ID as well as its object ID. This covers the issue, custom asset, integration, account, vendor finding, and enterprise risk mappings, for example GET /risk-scenarios/{riskScenarioId}/mappings/issues.
Manage Vanta APIUpdated

Vendor assessments now include audience

Vendor assessments and assessment types now return audience, which says who fills out the assessment. EXTERNAL means the vendor fills it out. INTERNAL means your organization’s own employees fill it out.The field is on GET /vendors/{vendorId}/assessments, GET /vendors/{vendorId}/assessments/{assessmentId}, GET /vendor-assessment-types, and GET /vendor-assessment-types/{assessmentTypeId}.
Manage Vanta APIUpdated

Customer Trust accounts now include custom revenue metrics

Customer Trust account responses, such as GET /customer-trust/accounts, now include customRevenueMetrics. Each metric has a metricId, displayName, fieldName, syncedAmount, overrideAmount, and currency. When overrideAmount is set, it takes precedence over syncedAmount. The list is empty when no metrics are configured.
Manage Vanta APIUpdated

Policy documents add Greek

The language of a policy document returned by GET /policies and GET /policies/{policyId} can now be EL (Greek).
Auditor APIUpdated

Audit controls can now be filtered by segment

GET /audits/{auditId}/controls adds a segmentIdsMatchesAny query parameter. It returns only controls whose inScopeSegmentIds include at least one of the given segment IDs from the audit’s segments[].id. Repeat the parameter for several IDs, and send the same filters with every pageCursor.The Auditor API is available to Audit Partner accounts during an active audit engagement.
Auditor APIUpdated

Information request evidence now includes capturedSegmentIds

GET /audits/{auditId}/information-requests/{requestId}/evidence and GET /audits/{auditId}/information-requests/{requestId}/evidence/{evidenceId} now return capturedSegmentIds, the IDs of the audit segments the evidence was relevant to when it was captured. It’s empty for uploaded, link, and observation evidence, and for evidence captured before Vanta recorded this attribution.The Auditor API is available to Audit Partner accounts during an active audit engagement.
Auditor APIUpdated

Information request evidence now documents how to identify evidence and files

GET /audits/{auditId}/information-requests/{requestId}/evidence now documents how to key evidence when you sync it. Use id as the key for every evidence item. A file attached to two information requests appears as two evidence items with different IDs.To recognize the same file across information requests, use the file key for the evidence type. UPLOADED_DOCUMENT uses evidence.id. VANTA_DOCUMENT and VANTA_POLICY use evidence.file.id. VANTA_TEST uses evidence.snapshotId plus evidence.fileType, because each file in a test snapshot is a separate evidence item. LINK, OBSERVATION, and VANTA_TEST_SNAPSHOT evidence has no file. Don’t use file.url as a key, because it’s a temporary download link.The Auditor API is available to Audit Partner accounts during an active audit engagement.
Manage Vanta APIDeprecated

Vendors now use categoryId, and category is deprecated

Vendors returned by GET /vendors and GET /vendors/{vendorId} now include categoryId, the ID of the vendor’s category, or null. Use GET /vendor-categories to look up category IDs.POST /vendors and PATCH /vendors/{vendorId} accept categoryId. On create, pass null for no category, or omit it to let Vanta pick one. On update, pass null to clear the category, or omit it to keep it. You can’t send categoryId and category in the same request. The category field on vendors and on these requests is deprecated. Use categoryId instead.
Auditor APIDeprecated

Audit vendors now return category IDs, and category labels are deprecated

GET /audits/{auditId}/vendors now returns categoryId, and its category field is deprecated. GET /audits/{auditId}/managed-vendors now returns vendorCategoryId, and its vendorCategory field is deprecated. Both new fields hold the ID of the vendor’s category, or null.The Auditor API is available to Audit Partner accounts during an active audit engagement.
Manage Vanta APINew

Framework controls can now be exported to CSV

POST /frameworks/exports starts a controls CSV export for a framework enabled in your organization. It takes a frameworkId and an optional includeEvidenceStatus, and returns 202 with an exportId and a status of RUNNING.GET /frameworks/exports/{exportId} returns the export’s status: RUNNING, COMPLETED, or FAILED. A completed export includes a downloadUrl that’s valid for one hour. Call the endpoint again to get a fresh link. If an export fails, create a new one to retry.
Manage Vanta APINew

Framework control sets can now be set via API

A new PUT /frameworks/{frameworkId}/variants endpoint replaces all selected control sets for an enabled, customer-selectable framework. Send the complete selection in variantIds. An empty selection is rejected. The response returns the saved frameworkId and variantIds.
Manage Vanta APIUpdated

List frameworks can now return the full Vanta catalog

GET /frameworks adds two query parameters:
  • purchasedOnly defaults to true. Set it to false to list every available framework, not only those in your program.
  • includeProgress defaults to true. When it’s false, the progress counts are -1. Counts are also -1 for frameworks that aren’t in your program.
Frameworks now include isPurchased. Frameworks returned by GET /frameworks and GET /frameworks/{frameworkId} also include activeVariants, the assessment tiers your program is on (such as HITRUST i1), each with an id and label.
Manage Vanta APIUpdated

Framework details can now include requirements

Set includeRequirements=true on GET /frameworks/{frameworkId} to get a requirements object. Each item has an id, name, shorthand, description, parentRequirementId, category, and controlIds.requirementsScope chooses which requirements you get. MY_PROGRAM (the default) returns requirements as mapped in your program. CATALOG returns the framework’s published requirements, resolved against the catalog variant IDs in variants. Custom frameworks always use MY_PROGRAM. Both scopes require the framework to be in your program.
Manage Vanta APIUpdated

Vendors now include engagements and parent vendor

Vendor objects now include engagements, the child vendors managed as engagements of this vendor (sorted by name, up to 100). They also include parentVendor, which is null when there’s no accessible parent. Each entry has an id, name, status, and nullable websiteUrl. GET /vendors/{vendorId} returns these summaries when vendor engagements are enabled.
Manage Vanta APIUpdated

Trust Center videos now keep their IDs

PUT /trust-centers/{slugId}/videos now returns an id for each video. To keep an existing video, send its id back with the item. Omit id to add a new video. An id that doesn’t match one of the Trust Center’s videos returns 404.
Auditor APIUpdated

Audit vendors now include engagements and parent vendor

Vendors returned by GET /audits/{auditId}/vendors now include engagements (up to 100) and a nullable parentVendor. Each entry has an id, name, status, and nullable websiteUrl. This endpoint is available to Audit Partner accounts during an active audit engagement.
Manage Vanta APIFixed

Discovered vendors now include Torii and Office GCC High sources

GET /discovered-vendors now returns vendors discovered by Torii and Office GCC High instead of failing with a 500. The source enum adds TORII and OFFICE_GCC_HIGH.
Manage Vanta APIDeprecated

vendorCategories on vendor risk attributes is deprecated

GET /vendor-risk-attributes now returns vendorCategoryIds, the system and custom category IDs each risk attribute applies to. The legacy vendorCategories display labels are deprecated. Use vendorCategoryIds instead.
Manage Vanta APINew

Custom frameworks can now be deleted

A new DELETE /frameworks/{frameworkId} endpoint deletes a custom framework and its requirements and control mappings. Controls, evidence, and mappings to other frameworks remain. You can’t delete built-in frameworks or a framework that has an associated audit.
Manage Vanta APINew

Custom assets can now be listed via API

A new GET /custom-assets endpoint lists your custom inventory assets, newest first, excluding deleted assets. Each asset has an id and a nullable name and description.
Manage Vanta APINew

Risk scenarios can now be mapped to issues, custom assets, integrations, and accounts

New endpoints under /risk-scenarios/{riskScenarioId}/mappings list, link, and unlink a risk scenario’s mappings. Each request body accepts up to 100 items.
  • Issues: list, add via issueIdsToLink, and remove via issueIdsToUnlink on /mappings/issues.
  • Custom assets: list, add via customAssetIdsToLink, and remove via customAssetIdsToUnlink on /mappings/custom-assets.
  • Integrations: list, add via integrationIdsToAdd, and remove via integrationIdsToRemove on /mappings/integrations. Linking an integration includes all of its accounts.
  • Accounts: list, add via accountsToLink, and remove via accountsToUnlink on /mappings/accounts. Each account is identified by serviceId, accountId, and an optional subunitId.
Manage Vanta APIUpdated

Answer Library entries now include createdAt

Answer Library entries returned by GET /knowledge-base/answer-library, GET /knowledge-base/answer-library/{id}, and the create, update, and verify endpoints now include createdAt.
Manage Vanta APIUpdated

Trust Center compliance frameworks add cps230 and iso27017_2026

The standard enum for creating and updating Trust Center compliance frameworks adds cps230 and iso27017_2026.
Auditor APIUpdated

Audits now report their audit view

Audit objects on GET /audits and GET /audits/{auditId} now include auditView: FULL (Full Audit View) or CONTROLLED (Controlled Audit View). It tells you how much population data you can see in the audit.
Auditor APIUpdated

Audit population endpoints support multi-program audits and return segmentIds

GET /audits/{auditId}/personnel/account-access/services, GET /audits/{auditId}/personnel/account-access/{serviceId}, and GET /audits/{auditId}/assets/code-changes no longer return 422 for audits with more than one program segment. On a multi-framework audit, each record in scope for any of the audit’s frameworks is returned once. Audits with system segments aren’t supported on population endpoints.Records from the people, groups, account access, integrations, managed vendors, and code changes population endpoints now include segmentIds, the audit segments the record is in scope for. The field is omitted when segment scoping is disabled. These endpoints are available to Audit Partner accounts during an active audit engagement.
Auditor APIUpdated

Audit population endpoints now document their 403 responses

The population endpoint references now explain both causes of a 403. These endpoints serve only Controlled Audit View (CAV) audits and reject Full Audit View audits. They also return 403 when the customer hasn’t made that population page visible to auditors. GET /audits/{auditId}/risks/{snapshotId} also returns 403 for a snapshot that isn’t shared with auditors and 404 for one that doesn’t exist. Use GET /audits/{auditId}/risks/snapshots to list shared snapshots.
WebhooksUpdated

Questionnaire status webhook lists more statuses

The questionnaire status enum on v1.questionnaire.status-changed adds QUEUED_FOR_SECTION_EXTRACTION, EXTRACTING_SECTIONS, MAPPING_SECTIONS, QUEUED_FOR_ANSWERING, and GENERATING_ANSWERS.
Auditor APIUpdated

changedSinceDate on GET /audits now documents soft-deleted audits

GET /audits with changedSinceDate returns soft-deleted audits whose deletionDate is on or after that timestamp. Check deletionDate on each audit so an incremental sync can remove audits that were deleted since your last run.
Manage Vanta APINew

Business units and program scopes are now available via API

GET /business-units and GET /business-units/{businessUnitId} list and retrieve your business units. They return 403 when business unit scoping is disabled.GET /program-scopes and GET /program-scopes/{programScopeId} list and retrieve program scopes. A program scope pairs a businessUnitId with a frameworkId. Filter the list with businessUnitIdMatchesAny and frameworkIdMatchesAny.
Manage Vanta APINew

Groups can now be updated and deleted

PATCH /groups/{groupId} updates a group’s name, description, or pointOfContactEmail. Pass null to clear description or pointOfContactEmail. DELETE /groups/{groupId} deletes a group. You can’t delete the default group, and groups created in Vanta must have no assigned people.
Manage Vanta APINew

Look up the organization behind your token

A new GET /organization endpoint returns the id, displayName, and region of the organization your token is connected to.
Manage Vanta APINew

Personnel notification settings can now be managed via API

GET /personnel-notification-settings returns your personnel reminder and employee-digest settings. PATCH /personnel-notification-settings updates them. Omitted fields stay unchanged.
Manage Vanta APINew

Risk scenarios can now be mapped to vendor findings

Add and remove requests accept up to 100 IDs.
Manage Vanta APIUpdated

People can now be filtered by framework, program scope, and business unit

GET /people adds the frameworkIdMatchesAny, programScopeIdMatchesAny, and businessUnitIdMatchesAny filters. Person objects now include programScopeIds.
Manage Vanta APIUpdated

Frameworks now include a lifecycle status

GET /frameworks and GET /frameworks/{frameworkId} now return a nullable status: ACTIVE, DRAFT, SNOOZED, ARCHIVED, or NEW_UPGRADE. Set the new includeStatus query parameter to false to omit it. It defaults to true.
Manage Vanta APIUpdated

Controls now support implementation details

Control responses, including GET /controls and GET /controls/{controlId}, now include a nullable implementationDetails field. PATCH /controls/{controlId} accepts implementationDetails.
Manage Vanta APIUpdated

Deactivated controls now include frameworks and deactivation reason

GET /controls/deactivated-controls now returns frameworks (with id, displayName, shorthandName, and sections), a nullable deactivationReason, and implementationDetails for each control.
Manage Vanta APIUpdated

Vendor assessments now include questionnaire question counts

GET /vendors/{vendorId}/assessments now returns a nullable questionnaire object. Its questionCounts include all, needsReview, notAnswered, and flaggedByAI.
Manage Vanta APIUpdated

Vendor risk attributes now include their risk section

GET /vendor-risk-attributes now returns a riskSection object (id and name) for each attribute.
Manage Vanta APIUpdated

Risk scenarios now include a score breakdown

Risk scenario responses, including GET /risk-scenarios and GET /risk-scenarios/{riskScenarioId}, now include a nullable scoreBreakdown array. Each entry has a kind (SCORE, DIMENSION, or FACTOR), a status (SCORED, MISSING, or NOT_APPLICABLE), score, scoreLabel, and parentId. It’s null when Flexible Risk Scoring is off.
Manage Vanta APIUpdated

Trust Center updates: section visibility, denial emails, and new frameworks

Manage Vanta APIUpdated

Questionnaire status adds queued states

The QuestionnaireStatus enum on GET /customer-trust/questionnaires adds QUEUED_FOR_SECTION_EXTRACTION and QUEUED_FOR_ANSWERING.
Manage Vanta APIBreaking

Legacy answer field removed from questionnaire responses

Questionnaire responses, such as GET /customer-trust/questionnaires/{questionnaireId}/responses, no longer return the deprecated answer field. Use answerPartsSchema and answerPartsValues instead.
Manage Vanta APIDeprecated

status on vendor updates is deprecated

The status field on PATCH /vendors/{vendorId} is deprecated and ignored. Use POST /vendors/{vendorId}/set-status to change vendor status.
Auditor APIUpdated

Audits now expose their scope as segments

Audit objects on GET /audits and GET /audits/{auditId} now include a segments array. Each segment has a kind (PROGRAM or SYSTEM), displayName, framework, and nullable businessUnit, system, and soc2Deliverable (with reportType and tscs). The top-level framework field is deprecated. Use segments instead.
Auditor APIUpdated

Audits now report information request list generation status

Audit objects now include a nullable irlGenerationStatus: PENDING, RUNNING, READY, or FAILED. It’s null when the audit has no Vanta-generated information request list.
Auditor APIUpdated

Audit controls and assessments are now segment-aware

Auditor APIUpdated

Information requests add linkedControlIds and segment assignment

Auditor APIUpdated

Framework codes are now grouped by framework

GET /audits/{auditId}/framework-codes now returns codesByFramework, with valid codes grouped by each in-scope framework. The flat frameworkCodes field is deprecated.
Auditor APIDeprecated

fillOutcome on information request activity is deprecated

The fillOutcome field on GET /audits/{auditId}/information-requests/{requestId}/activity is deprecated and always null.
Integrations APIUpdated

More resource fields now accept null

Several fields on Integrations API resource types now accept null on PUT and may return null on GET. Affected resources include user_account (for example mfaEnabled and lastLoginTimestamp), macos_user_computer, windows_user_computer, secret, security_task, background_check_connector, user_security_training_status, and the package, static analysis, and API endpoint vulnerability connectors.
Manage Vanta APINew

Questionnaire responses are now available via API

Four new endpoints manage the responses on a Customer Trust questionnaire. GET /customer-trust/questionnaires/{questionnaireId}/responses lists responses, and GET /customer-trust/questionnaires/{questionnaireId}/responses/{responseId} retrieves one. PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId} updates answer content, and PATCH /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}/owner reassigns or clears the response owner. Each response carries answerPartsSchema and answerPartsValues; the legacy answer field is deprecated.
Manage Vanta APINew

Groups can now be created and imported from your IdP

A new POST /groups endpoint creates a group. GET /groups/importable-idp-groups lists identity provider groups available to import, and POST /groups/import-from-idp imports them, returning a per-group success or error result.
Manage Vanta APINew

Tag categories can now be enabled per product context

A new POST /customer-trust/tag-categories/{tagCategoryId}/product-contexts endpoint enables a tag category for a product context, such as document sharing or control sharing. DELETE /customer-trust/tag-categories/{tagCategoryId}/product-contexts/{productContextId} disables it. Both operations are idempotent.
Auditor APINew

Information request evidence can now be fetched by ID

A new GET /audits/{auditId}/information-requests/{requestId}/evidence/{evidenceId} endpoint retrieves a single evidence item attached to an information request. Soft-deleted evidence stays fetchable; check deletionDate to identify deleted records.
Manage Vanta APIUpdated

Group responses now include description, source, and point of contact

Group objects on GET /groups and GET /groups/{groupId} now include description, source, personnelCount, and pointOfContact (with email and displayName).
Manage Vanta APIUpdated

Questionnaire status adds section and answer-generation states

The QuestionnaireStatus enum on GET /customer-trust/questionnaires adds EXTRACTING_SECTIONS, MAPPING_SECTIONS, and GENERATING_ANSWERS.
Manage Vanta APIUpdated

Issue actors can now be applications

The ActorType enum on GET /issues responses adds APPLICATION alongside USER and WORKFLOW_GENERATED, so issue history can attribute actions to an API client.
Manage Vanta APIUpdated

Trust Center compliance frameworks support TISAX 2027

The standard enum on Create Trust Center compliance framework and Update Trust Center compliance framework adds tisax2027.
Manage Vanta APIUpdated

Document and Trust Center media downloads support YAML

GET /documents/{documentId}/uploads/{uploadedFileId}/media and GET /trust-centers/{slugId}/resources/{resourceId}/media now declare application/yaml and text/x-yaml response content types for YAML files.
Auditor APIUpdated

Issue snapshots now expose approval progress

On GET /audits/{auditId}/issues/items, snapshotted issues now include a nullable approvalProgress object with approvedCount and totalApprovers, and the snapshot status enum adds PENDING_REVIEW.
Manage Vanta APIAuditor APIUpdated

Rate limits raised on several Auditor API endpoints

Rate limits increased from 10 to 50 requests per minute on Update audit evidence, Get framework codes for an audit, Delete an information request for an audit, and Share information request list with customer. Limits increased from 10 to 25 requests per minute on Create a comment for audit evidence, Update a comment for an information request, and Delete a comment for an information request. On the Manage Vanta API, POST /contracts now documents a limit of 10 requests per minute.
Manage Vanta APINew

Vendor assessment types are now available via API

New GET /vendor-assessment-types and GET /vendor-assessment-types/{assessmentTypeId} endpoints list and retrieve vendor assessment types, filterable by status (ACTIVE or ARCHIVED). See the Vendor Assessment Types reference.
Auditor APINew

Auditors can now record control assessments via API

A new PUT /audits/{auditId}/controls/{controlId}/assessment endpoint records an auditor’s assessment and justification for a control within an IRL audit. See the Upsert a control’s assessment within an audit reference.
Auditor APINew

Audit evidence items and comments can now be fetched by ID

Three new endpoints get a single record by ID: GET /audits/{auditId}/evidence/{auditEvidenceId} for an audit evidence item, GET /audits/{auditId}/evidence/{auditEvidenceId}/comments/{commentId} for an evidence comment, and GET /audits/{auditId}/information-requests/{requestId}/comments/{commentId} for an information-request comment.
WebhooksNew

New webhooks fire when audit evidence enters or leaves scope

v1.evidence.created fires when an evidence item comes into scope for an audit, and v1.evidence.deleted fires when an evidence item leaves scope (soft-deleted).
WebhooksUpdated

v1.evidence.status-changed can now fire with unchanged status

v1.evidence.status-changed can now fire with oldStatus equal to newStatus.
Manage Vanta APIUpdated

Trust Center responses now expose control status visibility settings

TrustCenter responses now include a new controlVisibilityMode field, and TrustCenterControlCategory responses include new visibility and statusVisibilityOverride fields. The Update Trust Center control category endpoint accepts both new fields.
Manage Vanta APIUpdated

Customer Trust tag category filter now supports CONTROL_SHARING

GET /customer-trust/tag-categories now accepts CONTROL_SHARING in the productContextIdsMatchesAny query filter.
Auditor APIUpdated

assessments array only includes in-scope segments

On GET /audits/{auditId}/controls, the assessments array now contributes an entry only for segments the control is in scope for.
Auditor APINew

IRL audits can now be duplicated into a new engagement

A new POST /audits/duplicate endpoint copies an existing IRL audit, including its information requests, into a new engagement with new dates and auditor roster.
Auditor APINew

Audit controls now include per-segment assessments

GET /audits/{auditId}/controls now returns an assessments array with the auditor’s assessmentState and justification for each audit segment.
Manage Vanta APIAuditor APINew

Framework enums now include NIST 800-171 R3 and BSI C5

The Manage Vanta API and Auditor API Framework enum adds NIST_171_R3, and the Manage Vanta API FrameworkKey enum adds nist171r3 and bsic5. See the Frameworks reference and Audits API reference.
Manage Vanta APIUpdated

Contracts now support an externalId for idempotent uploads

POST /customer-trust/contracts now accepts and returns an optional externalId. Repeat uploads with the same externalId return 409.
Manage Vanta APIBreaking

Trust Center viewer NDA response no longer includes DocuSign webhookId

The ndaInfo.docuSign.webhookId field has been removed from Trust Center viewer responses. envelopeId, accountId, and accountBaseUrl still identify the DocuSign envelope.
Manage Vanta APINew

Vendor assessments API is now GA

GET /v1/vendors/{vendorId}/assessments and GET /v1/vendors/{vendorId}/assessments/{assessmentId} are now generally available and include the assessment-level owner field.
Manage Vanta APINew

Deactivated controls can now be listed via API

A new GET /v1/controls/deactivated-controls endpoint returns paginated deactivated controls. GET /v1/controls/controls-library will be deprecated in a future release.
Manage Vanta APINew

Trust Center compliance frameworks can now be managed via API

New endpoints list, create, update, and delete Trust Center compliance frameworks, and upload a framework badge image. See the Trust Center compliance frameworks reference.
Manage Vanta APINew

Trust Center chatbot conversations are now available via API

GET /trust-centers/{slugId}/chatbot/conversations lists Trust Center chatbot conversations, and GET /trust-centers/{slugId}/chatbot/conversations/{conversationId} returns the messages in a conversation.
Manage Vanta APINew

Trust Center controls now support bulk operations

New endpoints bulk add or remove tags on Trust Center controls, bulk edit controls in a category, and reorder controls and control categories.
Manage Vanta APINew

More Trust Center settings can now be managed via API

New endpoints list and set the data collected shown on your Trust Center, upload a favicon, set videos, send viewer invite reminders, and manage Trust Center FAQ categories.
Manage Vanta APINew

Data deletion requests can now be created via API

A new POST /customer-trust/deletion-requests endpoint creates a data deletion request.
Manage Vanta APINew

Vanta issues are now available via API

GET /issues lists issues, and GET /issues/{issueId} returns a single issue.
WebhooksNew

Webhooks now include a Control domain for audit comment events

Webhook events now include a Control domain covering audit control comment events, delivered only to Audit Partner accounts during an active audit engagement. See the Webhooks overview.
Auditor APINew

Auditors can now manage control comments via API

New POST, PATCH, and DELETE endpoints at /audits/{auditId}/controls/{controlId}/comments let auditors create, update, and delete comments on a control. Delivered only to Audit Partner accounts during an active audit engagement.
Auditor APINew

Audit integrations and organization details are now available via API

Three new read endpoints give auditors more context during an engagement: GET /audits/{auditId}/integrations, GET /audits/{auditId}/organization/information, and GET /audits/{auditId}/organization/notifications. Available only to Audit Partner accounts during an active audit engagement.
Manage Vanta APIUpdated

Security reviews now include assessment type and owner

GET /v1/vendors/{vendorId}/security-reviews responses now include assessmentType and owner (id, type, displayName, email). owner is null when unassigned; email is populated for user owners and null for team owners.
Auditor APIUpdated

Information request history now tracks audit duplication

Information request history activities now include two new fields: sourceInformationRequestId (the request this one was copied from) and sourceAuditId (the audit it was duplicated from). Both are populated only for audit-duplication activities and null otherwise. See the Audits API reference.
Manage Vanta APIUpdated

Event log reference now includes new action types

The event log reference adds UNDELETE_PROGRAM_SEGMENT and REMOVE_DATA_SUBJECT_REQUEST_RELATIONSHIP_OPTION to the list of action types. PROVIDE_JUSTIFICATION_FOR_AUDIT_CONTROL_ASSESSMENT was removed.
Auditor APIBreaking

Integration category and tag enums renamed

AuditIntegrationCategory was renamed to AuditIntegrationTag, and AuditIntegrationServiceCategory was renamed to AuditIntegrationCategory. Update generated clients that reference the old schema names.
Manage Vanta APIBreaking

Issue sort field values changed to camelCase

IssueSortField enum values on the Issues endpoints changed from DUE_DATE, CREATED_AT, DETECTED_AT, LAST_MODIFIED_AT, STATUS, SEVERITY to dueDate, createdDate, detectedDate, lastModifiedDate, status, severity. Update any clients that hardcoded the old values.
Manage Vanta APIBreaking

Vendor accountManagerEmail max length reduced

The maxLength on the Vendor accountManagerEmail field was reduced from 2000 to 100 characters. Requests with longer values will be rejected.
Manage Vanta APIFixed

Issue detectedDate is now non-nullable

The detectedDate field on issue responses is no longer marked nullable in the OpenAPI spec. Every issue has a detected timestamp.
Manage Vanta APINew

Risk scenario controls can now be managed via API

New endpoints link and manage controls on a risk scenario: GET /risk-scenarios/{riskScenarioId}/controls lists a scenario’s controls, POST /risk-scenarios/{riskScenarioId}/controls adds a control, PATCH /risk-scenarios/{riskScenarioId}/controls/{controlId} changes a control’s controlType, and DELETE /risk-scenarios/{riskScenarioId}/controls/{controlId} removes a control.
Manage Vanta APINew

Trust Center resources can now be organized into categories

New endpoints list, add, reorder, update, and delete Trust Center resource categories. See the Trust Center resource categories reference.
Manage Vanta APINew

Trust Center viewer access can now be updated via API

A new PATCH /trust-centers/{slugId}/viewers/{viewerId} endpoint updates a viewer’s access on a Trust Center without removing and re-adding them.
Manage Vanta APINew

Trust Center FAQ responses now include category

Trust Center FAQ endpoints now return the FAQ’s category (id and name).
Auditor APIUpdated

Test snapshot evidence now includes more detail

The test-snapshot evidence detail endpoint now returns two new fields. apiRequests lists HTTP requests captured during API introspection tests. outOfScopeResources lists resources excluded at the test level (customer-disabled) and the framework level (segment configuration).
Auditor APIUpdated

Audit issues now support more filters

GET /audits/{auditId}/issues/items now accepts createdAfterDate, createdBeforeDate, detectedAfterDate, and detectedBeforeDate query parameters, and orderBy now accepts detectedAt.
Auditor APIUpdated

Code changes date filters were renamed

The startDate and endDate query parameters on GET /audits/{auditId}/assets/code-changes were renamed to closedAfterDate and closedBeforeDate for consistency with other Auditor API endpoints. Update any clients that hardcoded the old names.
Manage Vanta APIUpdated

Event log reference now includes more actions and targets

The event log reference now lists new action types covering Trust Center FAQ and resource categories, program segments, risk register updates, subscription renewals, in-app purchases, and Trust Center viewer reminders. It also adds three new target types: TRUST_CENTER_FAQ_CATEGORY, TRUST_CENTER_RESOURCE_CATEGORY, and QUESTIONNAIRE_AUTOMATION.
Auditor APIDeprecated

Legacy Auditor API list endpoints are now deprecated

GET /audits/{auditId}/monitored-computers, GET /audits/{auditId}/people, GET /audits/{auditId}/vendors, GET /audits/{auditId}/vulnerabilities, GET /audits/{auditId}/vulnerability-remediations, and GET /audits/{auditId}/vulnerable-assets are deprecated and work for legacy audits only, not controlled audit view. Controlled audit view uses personnel/people, personnel/computers, and managed-vendors instead.
Auditor APINew

Auditors can now access code changes via API

A new GET /audits/{auditId}/assets/code-changes endpoint returns the pull requests visible to auditors during an audit engagement. Each record includes the PR title, identifier, repository, source (GitHub, GitLab, Bitbucket, or Azure DevOps), and opened/closed dates. Supports search, source filtering, date-range filtering, and cursor pagination.
Manage Vanta APINew

Vanta event logs are now available via API

A new GET /event-logs endpoint lists audit events from your Vanta account, including the actor, date, and event type.
Auditor APINew

Audit issue snapshots are now available via API

Two new endpoints surface the issues an auditor sees during an audit: list snapshotted issues and list audit snapshots.
Auditor APINew

Test snapshot evidence detail is now available via API

A new endpoint returns rich detail for a single test-snapshot evidence row attached to an information request, including test metadata, integrations, SLA remediation policy, and the raw test data captured at snapshot time.
Manage Vanta APIUpdated

Knowledge Base resources now include Trust Center category

Knowledge Base resource endpoints now include a categoryId field for the Trust Center category a resource is filed under. Applies to REQUEST_ACCESS and PUBLIC resources.
Manage Vanta APIUpdated

Risk scenarios now include an identification date

Risk scenario responses now include identificationDate, matching the “Identified Date” field in the Vanta UI. The value defaults to the scenario’s creation time when not explicitly set.
Manage Vanta APIUpdated

Knowledge Base webpage resources now have stricter validation

Webpage resource title now requires at least one character, and url is validated as a URI. Existing valid payloads are unaffected.

Welcome to the Vanta developer changelog

Future updates to the Vanta API and developer documentation will be listed here.