Manage Vanta API

The Manage Vanta API is the operational surface for your own Vanta tenant. Use it to automate the work your team would otherwise click through in the Vanta dashboard — assigning control owners, uploading evidence, syncing personnel, querying test results, and managing vendors.

Who is this API for?

This API is for Vanta customers automating their own tenant. It is not available to partners building marketplace integrations — partners must use the Build Integrations API.

You are…	Use this API to…
A Vanta customer’s security or GRC team	Automate compliance workflows in your own tenant: assign control owners, surface overdue tasks, manage vendors.
A Vanta customer’s engineering team	Pull tests, manage frameworks and automate your compliance program.

Building an integration that syncs data into Vanta from an external tool? Use the Build Integrations API instead.

When to use this API

Reach for Manage Vanta endpoints when you want to:

Automate compliance workflows — assign control owners, mark people as not-a-person, surface overdue tasks.
Report on your security posture — query controls, tests, vulnerabilities, and resources to feed dashboards or downstream systems.
Manage your vendor inventory — create vendors, attach documentation, and apply custom fields.
Track and triage issues — list and retrieve issues to sync them into your ticketing system or dashboards. The Issues API is read-only: GET /issues and GET /issues/{issueId} are the only endpoints. Creating, editing, or linking issues to external tickets must be handled in your downstream system.

If you’re new to the API, start with the Manage Vanta quickstart to authenticate and make your first call.

Authentication

Manage Vanta apps use the client_credentials OAuth flow. Create a Manage Vanta application in the Developer Console, then exchange your client_id / client_secret at the token endpoint for an access token scoped to your own Vanta tenant.


Endpoint	`POST /oauth/token`
Base URL	`https://api.vanta.com` · `https://api.vanta-gov.com`
Content-Type	`application/json`
Grant type	`client_credentials`

Request body

Field	Type	Required	Description
`client_id`	string	yes	OAuth client ID from your Manage Vanta application.
`client_secret`	string	yes	OAuth client secret from your application.
`scope`	string	yes	Space-separated list of Manage Vanta scopes, e.g. `vanta-api.all:read`.
`grant_type`	string	yes	Must be `client_credentials`.

curl --request POST 'https://api.vanta.com/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "client_id": "vci_your_client_id",
    "client_secret": "vcs_your_client_secret",
    "scope": "vanta-api.all:read",
    "grant_type": "client_credentials"
  }'

const response = await fetch("https://api.vanta.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: process.env.VANTA_CLIENT_ID,
    client_secret: process.env.VANTA_CLIENT_SECRET,
    scope: "vanta-api.all:read",
    grant_type: "client_credentials",
  }),
});
const { access_token } = await response.json();

import requests

response = requests.post(
    "https://api.vanta.com/oauth/token",
    json={
        "client_id": client_id,
        "client_secret": client_secret,
        "scope": "vanta-api.all:read",
        "grant_type": "client_credentials",
    },
)
access_token = response.json()["access_token"]

Response

{
  "access_token": "vat_...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Field	Type	Description
`access_token`	string	Bearer token. Send as `Authorization: Bearer <access_token>` on every API request.
`expires_in`	integer	Lifetime in seconds. Always `3600` (1 hour).
`token_type`	string	Always `Bearer`.

No refresh_token is issued. When the token expires after one hour, re-exchange your client_id / client_secret for a fresh one. Most integrations request a new token at the start of each scheduled run.

One active token per Application. Requesting a new token with the same client_id / client_secret immediately revokes the previous one — any in-flight requests using the old token will fail with 401. Centralize token issuance and don’t run two processes that both mint tokens for the same application.

For grant-type tradeoffs, secret rotation, and other common pitfalls, see Authentication concepts.

Scopes

Scope	Grants
`vanta-api.all:read`	`GET` access to all Manage Vanta endpoints.
`vanta-api.all:write`	`PUT`, `PATCH`, `POST`, `DELETE` access to all Manage Vanta endpoints.
`vanta-api.documents:read`	`GET` access to document endpoints.
`vanta-api.documents:list`	`GET` access to list documents.
`vanta-api.documents:write`	Write access to document endpoints.
`vanta-api.documents:upload`	Upload files via the document upload endpoint.
`vanta-api.vendors:read`	`GET` access to vendor endpoints.
`vanta-api.vendors:write`	Write access to vendor endpoints.
`vanta-api.issues:read`	`GET` access to issue endpoints.

Granular scopes exist only for documents, vendors, and issues. For every other endpoint group — including Customer Trust, risk scenarios, integrations, policies, and people — use vanta-api.all:read for GET requests and vanta-api.all:write for POST, PUT, PATCH, and DELETE requests. Request only the scopes your application needs. Requesting a scope that doesn’t match your application type returns invalid_scope.

Base URL

Use https://api.vanta.com, or https://api.vanta-gov.com if you’re on Vanta Gov. See Base URLs for details.

Pagination

List endpoints use cursor-based pagination via the pageSize and pageCursor query parameters. To page through results:

Make the initial request, optionally setting pageSize (defaults vary by endpoint).
Check results.pageInfo.hasNextPage in the response.
If true, pass results.pageInfo.endCursor as the pageCursor in your next request.
Repeat until hasNextPage is false.

Responses are wrapped as:

{
  "results": {
    "data": [ /* ... */ ],
    "pageInfo": {
      "endCursor": "...",
      "hasNextPage": true,
      "hasPreviousPage": false,
      "startCursor": "..."
    }
  }
}

Many list endpoints also support filters — see the per-endpoint reference for available options.

Trust Center

Trust Center endpoints (/trust-centers/{slugId}/...) require your Trust Center’s slugId as a path parameter. To find it:

In Vanta, navigate to Trust Center > Overview.
In the top right, copy the unique URL for your Trust Center — it looks like https://app.vanta.com/your-domain.com/trust/tz7gh0fvb2ymzbl34hca2w. The slugId is the final segment (in this example, tz7gh0fvb2ymzbl34hca2w).
If you’ve configured a custom domain, visit your public Trust Center, view source, and look for the data-slug attribute on the <head> element.

Rate limits

Endpoint group	Limit
Manage Vanta endpoints	50 / minute
OAuth (`/oauth/token`)	25 / minute

Exceeding a limit returns 429 Too Many Requests. How to retry:

Vanta doesn’t send a Retry-After header on 429, so pace your own retries rather than waiting for the response to tell you when.
As an example you can sleep 5 seconds on the first 429, then double the delay on each subsequent one (exponential backoff) up to 3 attempts.
Mint your OAuth token once per run and reuse it for the hour it’s valid — minting per request will hit the /oauth/token cap of 25/minute first.

Common workflows

Add an owner to a control

Programmatically assign control ownership across your framework.

Upload a document

Attach evidence to controls, vendors, or tests.

Manage personnel

Surface overdue tasks, offboard people, and mark non-personnel.

Query test results

Build dashboards from failing tests and resources.

OpenAPI specification

Download the Manage Vanta OpenAPI spec

Generate clients, import into your favorite tool, or browse the schema offline.

Tools

Postman Collection

Import the collection to explore endpoints quickly.

MCP Server

Connect AI assistants to the Vanta API.

Webhooks

Subscribe to events and receive real-time updates.

API Basics

Manage API

Integrations API

Audit API

Webhooks

Who is this API for?

When to use this API

Authentication

Scopes

Base URL

Trust Center

Rate limits

Common workflows

Add an owner to a control

Upload a document

Manage personnel

Query test results

OpenAPI specification

Download the Manage Vanta OpenAPI spec

Tools

Postman Collection

MCP Server

Webhooks

​Who is this API for?

​When to use this API

​Authentication

​Scopes

​Base URL

​Pagination

​Trust Center

​Rate limits

​Common workflows

Add an owner to a control

Upload a document

Manage personnel

Query test results

​OpenAPI specification

Download the Manage Vanta OpenAPI spec

​Tools

Postman Collection

MCP Server

Webhooks

Who is this API for?

When to use this API

Authentication

Scopes

Base URL

Pagination

Trust Center

Rate limits

Common workflows

OpenAPI specification

Tools