Build Integrations API

​

Who is this API for?

​

When to use this API

• Publish a public integration to the Vanta marketplace so any Vanta customer can connect your tool.
• Build a private integration for a homegrown app, on-prem system, or unsupported SaaS tool inside your own tenant.
• Sync resources Vanta doesn’t natively support via custom resources, then layer Custom Tests on top. Custom resources and Custom Tests are a private-integration feature, available to direct Vanta customers building against their own tenant, not to public marketplace integrations.
• Upload file-based evidence on a customer’s behalf to satisfy evidence requests.

​

Authentication

• Private integration — single-tenant, used only inside your own Vanta account. Uses client_credentials. Start here if you’re building for your own tenant.
• Public integration — listed in the Vanta marketplace, installable by any customer. Uses authorization_code with refresh tokens, one set per customer authorization.

​

Private integrations

curl --request POST 'https://api.vanta.com/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "vci_your_client_id",
    "client_secret": "vcs_your_client_secret",
    "scope": "connectors.self:write-resource connectors.self:read-resource",
    "grant_type": "client_credentials"
  }'

const response = await fetch("https://api.vanta.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: process.env.VANTA_CLIENT_ID,
    client_secret: process.env.VANTA_CLIENT_SECRET,
    scope: "connectors.self:write-resource connectors.self:read-resource",
    grant_type: "client_credentials",
  }),
});
const { access_token } = await response.json();

import requests

response = requests.post(
    "https://api.vanta.com/oauth/token",
    json={
        "client_id": client_id,
        "client_secret": client_secret,
        "scope": "connectors.self:write-resource connectors.self:read-resource",
        "grant_type": "client_credentials",
    },
)
access_token = response.json()["access_token"]

{
  "access_token": "vat_...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

​

Public integrations

curl --request POST 'https://api.vanta.com/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "vci_your_client_id",
    "client_secret": "vcs_your_client_secret",
    "code": "vac_authorization_code_from_callback",
    "source_id": "acct1234",
    "redirect_uri": "https://partner-app.com/oauth/callback",
    "grant_type": "authorization_code"
  }'

const response = await fetch("https://api.vanta.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: process.env.VANTA_CLIENT_ID,
    client_secret: process.env.VANTA_CLIENT_SECRET,
    code,
    source_id: accountId,
    redirect_uri: "https://partner-app.com/oauth/callback",
    grant_type: "authorization_code",
  }),
});
const tokens = await response.json();

import requests

response = requests.post(
    "https://api.vanta.com/oauth/token",
    json={
        "client_id": client_id,
        "client_secret": client_secret,
        "code": code,
        "source_id": account_id,
        "redirect_uri": "https://partner-app.com/oauth/callback",
        "grant_type": "authorization_code",
    },
)
tokens = response.json()

{
  "access_token": "...",
  "refresh_token": "...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

​

Refreshing the token

curl --request POST 'https://api.vanta.com/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "vci_your_client_id",
    "client_secret": "vcs_your_client_secret",
    "refresh_token": "your_refresh_token",
    "grant_type": "refresh_token"
  }'

​

Revoking access

curl --request POST 'https://api.vanta.com/v1/oauth/token/suspend' \
  --header 'Content-Type: application/json' \
  --data '{
    "token": "access_or_refresh_token_to_revoke",
    "client_id": "vci_your_client_id",
    "client_secret": "vcs_your_client_secret"
  }'

​

Scopes

​

Base URL

​

Resource model

​

Supported resource types

​

Pagination

{
  "resources": [ /* ... */ ]
}

​

Payload limits

• Sync only the records you need to act on. This is most relevant for vulnerability resource types (PackageVulnerabilityConnectors, ApiEndpointVulnerabilityConnectors, StaticAnalysisCodeVulnerabilityConnectors), where scanners often emit thousands of findings spanning Critical, High, Medium, and Low CVEs alongside Known malware and Protestware / potentially unwanted behavior alerts. Customers overwhelmingly take action on Critical and High in Vanta, and those are the severities that drive compliance monitoring. Sending only Critical and High keeps payloads well under the limit and matches what Vanta’s own native scanner integrations do.
• Let customers pick severities at install time. For public integrations, expose a severity selector in your install or settings UI so customers opt into what they want synced. Defaulting to Critical and High covers the common case; customers with specific framework requirements can broaden the set themselves.

​

Rate limits

• Vanta doesn’t send a Retry-After header on 429, so pace your own retries rather than waiting for the response to tell you when.
• As an example you can sleep 5 seconds on the first 429, then double the delay on each subsequent one (exponential backoff) up to 3 attempts.
• The 10/minute limit is per access token — if you operate across many customers, each customer’s token gets its own limits.
• Use one access token per customer for the hour it’s valid; mint and refresh on schedule rather than per request to avoid the /oauth/token cap of 25/minute.

​

Common workflows

​

OpenAPI specification

​

Tools