Manage Vanta APINew
Vendor assessment types are now available via API
NewGET /vendor-assessment-types and GET /vendor-assessment-types/{assessmentTypeId} endpoints list and retrieve vendor assessment types, filterable by status (ACTIVE or ARCHIVED). See the Vendor Assessment Types reference.Auditor APINew
Auditors can now record control assessments via API
A newPUT /audits/{auditId}/controls/{controlId}/assessment endpoint records an auditor’s assessment and justification for a control within an IRL audit. See the Upsert a control’s assessment within an audit reference.Auditor APINew
Audit evidence items and comments can now be fetched by ID
Three new endpoints get a single record by ID:GET /audits/{auditId}/evidence/{auditEvidenceId} for an audit evidence item, GET /audits/{auditId}/evidence/{auditEvidenceId}/comments/{commentId} for an evidence comment, and GET /audits/{auditId}/information-requests/{requestId}/comments/{commentId} for an information-request comment.WebhooksNew
New webhooks fire when audit evidence enters or leaves scope
v1.evidence.created fires when an evidence item comes into scope for an audit, and v1.evidence.deleted fires when an evidence item leaves scope (soft-deleted).WebhooksUpdated
v1.evidence.status-changed can now fire with unchanged status
v1.evidence.status-changed can now fire with oldStatus equal to newStatus.Manage Vanta APIUpdated
Trust Center responses now expose control status visibility settings
TrustCenter responses now include a new controlVisibilityMode field, and TrustCenterControlCategory responses include new visibility and statusVisibilityOverride fields. The Update Trust Center control category endpoint accepts both new fields.Manage Vanta APIUpdated
Customer Trust tag category filter now supports CONTROL_SHARING
GET /customer-trust/tag-categories now accepts CONTROL_SHARING in the productContextIdsMatchesAny query filter.Auditor APIUpdated
assessments array only includes in-scope segments
On GET /audits/{auditId}/controls, the assessments array now contributes an entry only for segments the control is in scope for.Auditor APINew
IRL audits can now be duplicated into a new engagement
A newPOST /audits/duplicate endpoint copies an existing IRL audit, including its information requests, into a new engagement with new dates and auditor roster.Auditor APINew
Audit controls now include per-segment assessments
GET /audits/{auditId}/controls now returns an assessments array with the auditor’s assessmentState and justification for each audit segment.Manage Vanta APIAuditor APINew
Framework enums now include NIST 800-171 R3 and BSI C5
The Manage Vanta API and Auditor APIFramework enum adds NIST_171_R3, and the Manage Vanta API FrameworkKey enum adds nist171r3 and bsic5. See the Frameworks reference and Audits API reference.Manage Vanta APIUpdated
Contracts now support an externalId for idempotent uploads
POST /customer-trust/contracts now accepts and returns an optional externalId. Repeat uploads with the same externalId return 409.Manage Vanta APIBreaking
Trust Center viewer NDA response no longer includes DocuSign webhookId
The ndaInfo.docuSign.webhookId field has been removed from Trust Center viewer responses. envelopeId, accountId, and accountBaseUrl still identify the DocuSign envelope.Manage Vanta APINew
Vendor assessments API is now GA
GET /v1/vendors/{vendorId}/assessments and GET /v1/vendors/{vendorId}/assessments/{assessmentId} are now generally available and include the assessment-level owner field.Manage Vanta APINew
Deactivated controls can now be listed via API
A newGET /v1/controls/deactivated-controls endpoint returns paginated deactivated controls. GET /v1/controls/controls-library will be deprecated in a future release.Manage Vanta APINew
Trust Center compliance frameworks can now be managed via API
New endpoints list, create, update, and delete Trust Center compliance frameworks, and upload a framework badge image. See the Trust Center compliance frameworks reference.Manage Vanta APINew
Trust Center chatbot conversations are now available via API
GET /trust-centers/{slugId}/chatbot/conversations lists Trust Center chatbot conversations, and GET /trust-centers/{slugId}/chatbot/conversations/{conversationId} returns the messages in a conversation.Manage Vanta APINew
Trust Center controls now support bulk operations
New endpoints bulk add or remove tags on Trust Center controls, bulk edit controls in a category, and reorder controls and control categories.Manage Vanta APINew
More Trust Center settings can now be managed via API
New endpoints list and set the data collected shown on your Trust Center, upload a favicon, set videos, send viewer invite reminders, and manage Trust Center FAQ categories.Manage Vanta APINew
Data deletion requests can now be created via API
A newPOST /customer-trust/deletion-requests endpoint creates a data deletion request.Manage Vanta APINew
Vanta issues are now available via API
GET /issues lists issues, and GET /issues/{issueId} returns a single issue.WebhooksNew
Webhooks now include a Control domain for audit comment events
Webhook events now include a Control domain covering audit control comment events, delivered only to Audit Partner accounts during an active audit engagement. See the Webhooks overview.Auditor APINew
Auditor APINew
Audit integrations and organization details are now available via API
Three new read endpoints give auditors more context during an engagement:GET /audits/{auditId}/integrations, GET /audits/{auditId}/organization/information, and GET /audits/{auditId}/organization/notifications. Available only to Audit Partner accounts during an active audit engagement.Manage Vanta APIUpdated
Security reviews now include assessment type and owner
GET /v1/vendors/{vendorId}/security-reviews responses now include assessmentType and owner (id, type, displayName, email). owner is null when unassigned; email is populated for user owners and null for team owners.Auditor APIUpdated
Information request history now tracks audit duplication
Information request history activities now include two new fields:sourceInformationRequestId (the request this one was copied from) and sourceAuditId (the audit it was duplicated from). Both are populated only for audit-duplication activities and null otherwise. See the Audits API reference.Manage Vanta APIUpdated
Event log reference now includes new action types
The event log reference addsUNDELETE_PROGRAM_SEGMENT and REMOVE_DATA_SUBJECT_REQUEST_RELATIONSHIP_OPTION to the list of action types. PROVIDE_JUSTIFICATION_FOR_AUDIT_CONTROL_ASSESSMENT was removed.Auditor APIBreaking
Integration category and tag enums renamed
AuditIntegrationCategory was renamed to AuditIntegrationTag, and AuditIntegrationServiceCategory was renamed to AuditIntegrationCategory. Update generated clients that reference the old schema names.Manage Vanta APIBreaking
Issue sort field values changed to camelCase
IssueSortField enum values on the Issues endpoints changed from DUE_DATE, CREATED_AT, DETECTED_AT, LAST_MODIFIED_AT, STATUS, SEVERITY to dueDate, createdDate, detectedDate, lastModifiedDate, status, severity. Update any clients that hardcoded the old values.Manage Vanta APIBreaking
Vendor accountManagerEmail max length reduced
The maxLength on the Vendor accountManagerEmail field was reduced from 2000 to 100 characters. Requests with longer values will be rejected.Manage Vanta APIFixed
Issue detectedDate is now non-nullable
The detectedDate field on issue responses is no longer marked nullable in the OpenAPI spec. Every issue has a detected timestamp.Manage Vanta APINew
Risk scenario controls can now be managed via API
New endpoints link and manage controls on a risk scenario:GET /risk-scenarios/{riskScenarioId}/controls lists a scenario’s controls, POST /risk-scenarios/{riskScenarioId}/controls adds a control, PATCH /risk-scenarios/{riskScenarioId}/controls/{controlId} changes a control’s controlType, and DELETE /risk-scenarios/{riskScenarioId}/controls/{controlId} removes a control.Manage Vanta APINew
Trust Center resources can now be organized into categories
New endpoints list, add, reorder, update, and delete Trust Center resource categories. See the Trust Center resource categories reference.Manage Vanta APINew
Trust Center viewer access can now be updated via API
A newPATCH /trust-centers/{slugId}/viewers/{viewerId} endpoint updates a viewer’s access on a Trust Center without removing and re-adding them.Manage Vanta APINew
Trust Center FAQ responses now include category
Trust Center FAQ endpoints now return the FAQ’scategory (id and name).Auditor APIUpdated
Test snapshot evidence now includes more detail
The test-snapshot evidence detail endpoint now returns two new fields.apiRequests lists HTTP requests captured during API introspection tests. outOfScopeResources lists resources excluded at the test level (customer-disabled) and the framework level (segment configuration).Auditor APIUpdated
Audit issues now support more filters
GET /audits/{auditId}/issues/items now accepts createdAfterDate, createdBeforeDate, detectedAfterDate, and detectedBeforeDate query parameters, and orderBy now accepts detectedAt.Auditor APIUpdated
Code changes date filters were renamed
ThestartDate and endDate query parameters on GET /audits/{auditId}/assets/code-changes were renamed to closedAfterDate and closedBeforeDate for consistency with other Auditor API endpoints. Update any clients that hardcoded the old names.Manage Vanta APIUpdated
Event log reference now includes more actions and targets
The event log reference now lists new action types covering Trust Center FAQ and resource categories, program segments, risk register updates, subscription renewals, in-app purchases, and Trust Center viewer reminders. It also adds three new target types:TRUST_CENTER_FAQ_CATEGORY, TRUST_CENTER_RESOURCE_CATEGORY, and QUESTIONNAIRE_AUTOMATION.Auditor APIDeprecated
Legacy Auditor API list endpoints are now deprecated
GET /audits/{auditId}/monitored-computers, GET /audits/{auditId}/people, GET /audits/{auditId}/vendors, GET /audits/{auditId}/vulnerabilities, GET /audits/{auditId}/vulnerability-remediations, and GET /audits/{auditId}/vulnerable-assets are deprecated and work for legacy audits only, not controlled audit view. Controlled audit view uses personnel/people, personnel/computers, and managed-vendors instead.Auditor APINew
Auditors can now access code changes via API
A newGET /audits/{auditId}/assets/code-changes endpoint returns the pull requests visible to auditors during an audit engagement. Each record includes the PR title, identifier, repository, source (GitHub, GitLab, Bitbucket, or Azure DevOps), and opened/closed dates. Supports search, source filtering, date-range filtering, and cursor pagination.Manage Vanta APINew
Vanta event logs are now available via API
A newGET /event-logs endpoint lists audit events from your Vanta account, including the actor, date, and event type.Auditor APINew
Audit issue snapshots are now available via API
Two new endpoints surface the issues an auditor sees during an audit: list snapshotted issues and list audit snapshots.Auditor APINew
Manage Vanta APIUpdated
Knowledge Base resources now include Trust Center category
Knowledge Base resource endpoints now include acategoryId field for the Trust Center category a resource is filed under. Applies to REQUEST_ACCESS and PUBLIC resources.Manage Vanta APIUpdated
Risk scenarios now include an identification date
Risk scenario responses now includeidentificationDate, matching the “Identified Date” field in the Vanta UI. The value defaults to the scenario’s creation time when not explicitly set.Manage Vanta APIUpdated
Knowledge Base webpage resources now have stricter validation
Webpage resourcetitle now requires at least one character, and url is validated as a URI. Existing valid payloads are unaffected.