Copy the prompt to run this live via the MCP server or have AI generate a runnable script.
{children}
;
export const TASKS_ASK = "Using the Vanta MCP server, show me all current employees who have overdue security tasks.\n\nFor each person, include their name, email address, and which specific task types are overdue — training completions, policy acceptances, custom tasks, background checks, or device monitoring installs.";
export const TASKS_BUILD = "Using the Manage Vanta API (base URL https://api.vanta.com), write a Node.js script that:\n\n1. Mints a Vanta API token using the client-credentials flow. Re-mint at the top of every scheduled run (tokens expire after one hour).\n2. Calls GET /v1/people with pageSize=100, employmentStatusMatchesAny=CURRENT, taskStatusMatchesAny=OVERDUE, and taskTypeMatchesAny for each of: COMPLETE_TRAININGS, ACCEPT_POLICIES, COMPLETE_CUSTOM_TASKS, COMPLETE_BACKGROUND_CHECKS, INSTALL_DEVICE_MONITORING.\n3. Paginates using results.pageInfo.endCursor until hasNextPage is false.\n4. For each person in results.data: skip records where tasksSummary is null; iterate tasksSummary.details and collect every key whose status is OVERDUE; emit { name, email, overdueTasks } as a JSON line.\n5. Print a summary: total overdue count and a breakdown by task type.\n\nError handling:\n- 401: re-mint and retry once.\n- 5xx: retry with 2s exponential back-off, max 3 attempts.\n\nScope required: vanta-api.all:read.";
This guide queries `GET /v1/people` on the Manage Vanta API for current employees with overdue security tasks — incomplete trainings, unaccepted policies, open custom tasks, missing background checks, or missing device-monitoring installs. Use the ask prompt to surface overdue tasks through the Vanta MCP server in seconds, or the build prompt to generate a scheduled job that emits one JSON line per person with the specific task types still open.
## Before you begin
This guide is for Vanta admins managing data inside their own Vanta account.
You'll need:
* A Manage Vanta [API token](/docs/quickstart/manage-vanta).
* The token must have scope `vanta-api.all:read`.
* At least one source of personnel data connected to Vanta (HRIS, IDP, or manually added users).
Vanta tracks recurring security tasks for every person in your organization — security training, policy acceptance, custom checklists, background checks, and device-monitoring installs. The People endpoint lets you filter for people whose tasks are `OVERDUE`, then chase them down.
Wiring this into a recurring nudge (Slack reminder, email digest)? Run Step 1 on a schedule and feed the output into your notifier. Tokens expire hourly — re-mint at the top of each run.
**Your terminal** — call [`GET /v1/people`](/reference/manage-vanta/overview) with `taskTypeMatchesAny` for the task types you care about, `taskStatusMatchesAny=OVERDUE`, and `employmentStatusMatchesAny=CURRENT` so you don't chase former employees.
```bash Terminal theme={"system"}
curl 'https://api.vanta.com/v1/people?pageSize=50&employmentStatusMatchesAny=CURRENT&taskStatusMatchesAny=OVERDUE&taskTypeMatchesAny=COMPLETE_TRAININGS&taskTypeMatchesAny=ACCEPT_POLICIES&taskTypeMatchesAny=COMPLETE_CUSTOM_TASKS&taskTypeMatchesAny=COMPLETE_BACKGROUND_CHECKS&taskTypeMatchesAny=INSTALL_DEVICE_MONITORING' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer YOUR_TOKEN'
```
Response (truncated for readability)
```json theme={"system"}
{
"results": {
"data": [
{
"id": "5fc82421a228f6b6f713547d",
"emailAddress": "alex@example.com",
"name": { "display": "Alex Admin" },
"employment": { "status": "CURRENT", "jobTitle": "Engineer" },
"tasksSummary": {
"status": "OVERDUE",
"dueDate": "2024-05-12T04:31:54.490Z",
"details": {
"completeTrainings": { "status": "OVERDUE", "incompleteTrainings": [{ "name": "AI_RISK_SECURITY_TRAINING" }] },
"acceptPolicies": { "status": "OVERDUE", "unacceptedPolicies": [{ "name": "Secure Development Policy" }] },
"completeBackgroundChecks": { "status": "COMPLETE" }
}
}
}
],
"pageInfo": { "hasNextPage": true, "endCursor": "..." }
}
}
```
`tasksSummary.details` breaks down each task type so you can build a precise nudge ("you owe AI Risk training and one policy acceptance") rather than a generic "you have overdue tasks" message.
Token is expired (one-hour lifetime), missing, or lacks `vanta-api.all:read`. Mint a fresh one — see [Authentication → Token expiration](/docs/concepts/authentication#token-expiration).
`COMPLETE_TRAININGS`, `ACCEPT_POLICIES`, `COMPLETE_CUSTOM_TASKS`, `INSTALL_DEVICE_MONITORING`, `COMPLETE_BACKGROUND_CHECKS`. Pass each one as a separate `taskTypeMatchesAny=` query param.
`COMPLETE`, `DUE_SOON`, `OVERDUE`, `NONE`. `taskStatusMatchesAny` is **required** when you pass `taskTypeMatchesAny`.
You omitted `employmentStatusMatchesAny=CURRENT`. The endpoint returns all matches by default, including offboarded people whose tasks were never completed.
**Your terminal** — paginate with `pageCursor` if `hasNextPage` is `true`, then collapse each person's `tasksSummary.details` down to the specific items they owe.
```javascript Node.js theme={"system"}
const URL =
"https://api.vanta.com/v1/people?pageSize=50" +
"&employmentStatusMatchesAny=CURRENT" +
"&taskStatusMatchesAny=OVERDUE" +
"&taskTypeMatchesAny=COMPLETE_TRAININGS" +
"&taskTypeMatchesAny=ACCEPT_POLICIES" +
"&taskTypeMatchesAny=COMPLETE_CUSTOM_TASKS" +
"&taskTypeMatchesAny=COMPLETE_BACKGROUND_CHECKS" +
"&taskTypeMatchesAny=INSTALL_DEVICE_MONITORING";
const res = await fetch(URL, {
headers: { Authorization: "Bearer YOUR_TOKEN" },
});
const { results } = await res.json();
const overdue = results.data.map((person) => ({
name: person.name.display,
email: person.emailAddress,
overdueTasks: Object.entries(person.tasksSummary?.details ?? {})
.filter(([, task]) => task.status === "OVERDUE")
.map(([type]) => type),
}));
console.log(overdue);
```
```python Python theme={"system"}
import requests
url = "https://api.vanta.com/v1/people"
params = [
("pageSize", 50),
("employmentStatusMatchesAny", "CURRENT"),
("taskStatusMatchesAny", "OVERDUE"),
("taskTypeMatchesAny", "COMPLETE_TRAININGS"),
("taskTypeMatchesAny", "ACCEPT_POLICIES"),
("taskTypeMatchesAny", "COMPLETE_CUSTOM_TASKS"),
("taskTypeMatchesAny", "COMPLETE_BACKGROUND_CHECKS"),
("taskTypeMatchesAny", "INSTALL_DEVICE_MONITORING"),
]
r = requests.get(
url,
headers={"Authorization": "Bearer YOUR_TOKEN"},
params=params,
)
r.raise_for_status()
for person in r.json()["results"]["data"]:
overdue = [
t for t, info in (person["tasksSummary"] or {}).get("details", {}).items()
if info.get("status") == "OVERDUE"
]
if overdue:
print(person["name"]["display"], person["emailAddress"], overdue)
```
Example collapsed output:
```json theme={"system"}
[
{
"name": "Alex Admin",
"email": "alex@example.com",
"overdueTasks": ["completeTrainings", "acceptPolicies"]
}
]
```
That person has no tasks assigned (e.g. a contractor or service account marked as not-a-person). Skip them. See [Mark accounts as not a person](/docs/guides/mark-people-as-not-a-person).
Read `results.pageInfo.endCursor` and `hasNextPage`. Re-call the endpoint with `pageCursor=` until `hasNextPage` is `false`. Don't try to fetch all people in one call — `pageSize` caps at 100.
**Just want a count, not the list?** The same query returns `pageInfo.hasNextPage` plus a `data` array — paginate to count, or filter more aggressively (e.g. by single `taskTypeMatchesAny`) for a smaller response.
## Congratulations
You've pulled the canonical list of current employees with overdue security tasks straight from Vanta. Wire this into a Slack nudge, email digest, or compliance dashboard so reminders happen without anyone clicking through the Vanta UI.
## Next steps
Exclude shared mailboxes and service accounts from these task tallies.
Once an employee is `FORMER`, complete the offboarding programmatically.
Import the collection and run the People query against a sandbox in seconds.
Browse every Manage Vanta endpoint — controls, tests, documents, people.