{ "openapi": "3.0.3", "info": { "title": "Vanta Webhook Events", "version": "1.0.0", "description": "Reference for the events Vanta delivers to your registered webhook endpoints. Each operation documents a single event type, its payload schema, and an example body.\n\nThese operations describe **events Vanta sends to you** — they are not endpoints you call. The documented schema is the event `payload`. Every delivery also includes signature headers and is wrapped in a delivery envelope. See the [Webhooks guide](/docs/webhooks) for setup, signature verification, and retries." }, "servers": [ { "url": "https://your-endpoint.example.com", "description": "Your webhook endpoint. Vanta sends a POST request with the event payload as the body." } ], "tags": [ { "name": "Questionnaire", "description": "Questionnaire automation events." }, { "name": "Trust Center", "description": "Trust Center access request events." }, { "name": "Vendor", "description": "Vendor risk management events." }, { "name": "Information Request", "description": "Audit information request (IRL) events." }, { "name": "Evidence", "description": "Audit evidence events." }, { "name": "Control", "description": "Audit control comment events." } ], "paths": { "/v1.questionnaire.created": { "post": { "operationId": "v1.questionnaire.created", "tags": [ "Questionnaire" ], "summary": "Questionnaire created", "description": "A questionnaire was created.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "questionnaire" ], "properties": { "questionnaire": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The questionnaire ID." } } } } }, "example": { "questionnaire": { "id": "123" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.questionnaire.deleted": { "post": { "operationId": "v1.questionnaire.deleted", "tags": [ "Questionnaire" ], "summary": "Questionnaire deleted", "description": "A questionnaire was deleted.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "questionnaire" ], "properties": { "questionnaire": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The questionnaire ID." } } } } }, "example": { "questionnaire": { "id": "123" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.questionnaire.status-changed": { "post": { "operationId": "v1.questionnaire.status-changed", "tags": [ "Questionnaire" ], "summary": "Questionnaire status changed", "description": "A questionnaire status was changed.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "questionnaire" ], "properties": { "questionnaire": { "type": "object", "required": [ "id", "status" ], "properties": { "id": { "type": "string", "description": "The questionnaire ID." }, "status": { "type": "string", "description": "The new questionnaire status.", "enum": [ "APPROVED", "COMPLETE", "ERROR", "IN_PROGRESS", "IN_REVIEW", "EXTRACTING_QUESTIONS", "QUEUED_FOR_EXTRACTION", "PROCESSING", "QUEUED_FOR_PROCESSING", "READY_FOR_REVIEW", "WAITING_ON_ANSWERS", "WAITING_ON_COLUMN_SELECTION", "WAITING_ON_COLUMN_APPROVAL", "QUEUED_FOR_COLUMN_DETECTION", "DETECTING_COLUMNS", "ON_HOLD", "NO_LONGER_NEEDED" ] } } } } }, "example": { "questionnaire": { "id": "123", "status": "COMPLETE" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.questionnaire.export-completed": { "post": { "operationId": "v1.questionnaire.export-completed", "tags": [ "Questionnaire" ], "summary": "Questionnaire export completed", "description": "A questionnaire export has completed successfully.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "questionnaire", "export" ], "properties": { "questionnaire": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the questionnaire." } } }, "export": { "type": "object", "required": [ "id", "format", "requestedAt", "completedAt" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the export job." }, "format": { "type": "string", "description": "The export format.", "enum": [ "original", "csv" ] }, "requestedAt": { "type": "string", "format": "date-time", "description": "When the export was initiated (ISO 8601)." }, "completedAt": { "type": "string", "format": "date-time", "description": "When the export finished (ISO 8601)." } } } } }, "example": { "questionnaire": { "id": "507f1f77bcf86cd799439011" }, "export": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f", "format": "original", "requestedAt": "2025-01-08T12:00:00.000Z", "completedAt": "2025-01-08T12:05:00.000Z" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.questionnaire.export-failed": { "post": { "operationId": "v1.questionnaire.export-failed", "tags": [ "Questionnaire" ], "summary": "Questionnaire export failed", "description": "A questionnaire export has failed.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "questionnaire", "export" ], "properties": { "questionnaire": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the questionnaire." } } }, "export": { "type": "object", "required": [ "id", "format", "requestedAt", "failedAt", "reason" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the export job." }, "format": { "type": "string", "description": "The export format.", "enum": [ "original", "csv" ] }, "requestedAt": { "type": "string", "format": "date-time", "description": "When the export was initiated (ISO 8601)." }, "failedAt": { "type": "string", "format": "date-time", "description": "When the export failed (ISO 8601)." }, "reason": { "type": "string", "description": "The reason for the export failure." } } } } }, "example": { "questionnaire": { "id": "507f1f77bcf86cd799439011" }, "export": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f", "format": "csv", "requestedAt": "2025-01-08T12:00:00.000Z", "failedAt": "2025-01-08T12:05:00.000Z", "reason": "Questionnaire has no responses to export" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.trust-center.access-request.received": { "post": { "operationId": "v1.trust-center.access-request.received", "tags": [ "Trust Center" ], "summary": "Trust Center access request received", "description": "A Trust Center access request was received.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "trustCenter", "accessRequest" ], "properties": { "trustCenter": { "type": "object", "required": [ "slugId" ], "properties": { "slugId": { "type": "string", "description": "The Trust Center slug ID." } } }, "accessRequest": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The access request ID." } } } } }, "example": { "trustCenter": { "slugId": "123" }, "accessRequest": { "id": "123" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.trust-center.access-request.denied": { "post": { "operationId": "v1.trust-center.access-request.denied", "tags": [ "Trust Center" ], "summary": "Trust Center access request denied", "description": "A Trust Center access request was denied.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "trustCenter", "accessRequest" ], "properties": { "trustCenter": { "type": "object", "required": [ "slugId" ], "properties": { "slugId": { "type": "string", "description": "The Trust Center slug ID." } } }, "accessRequest": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The access request ID." } } } } }, "example": { "trustCenter": { "slugId": "123" }, "accessRequest": { "id": "123" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.trust-center.access-request.approved": { "post": { "operationId": "v1.trust-center.access-request.approved", "tags": [ "Trust Center" ], "summary": "Trust Center access request approved", "description": "A Trust Center access request was approved.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "trustCenter", "accessRequest", "viewer" ], "properties": { "trustCenter": { "type": "object", "required": [ "slugId" ], "properties": { "slugId": { "type": "string", "description": "The Trust Center slug ID." } } }, "accessRequest": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The access request ID." } } }, "viewer": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The viewer ID granted access." } } } } }, "example": { "trustCenter": { "slugId": "123" }, "accessRequest": { "id": "123" }, "viewer": { "id": "123" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.vendor.decision.created": { "post": { "operationId": "v1.vendor.decision.created", "tags": [ "Vendor" ], "summary": "Vendor decision created", "description": "A new vendor decision has been created.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "vendor" ], "properties": { "vendor": { "type": "object", "required": [ "id", "decision" ], "properties": { "id": { "type": "string", "description": "The vendor ID." }, "decision": { "type": "object", "required": [ "status", "lastUpdatedAt" ], "properties": { "status": { "type": "string", "description": "The vendor decision status.", "enum": [ "APPROVED", "CONDITIONALLY_APPROVED", "NOT_APPROVED" ] }, "lastUpdatedAt": { "type": "string", "format": "date-time", "description": "When the decision was last updated (ISO 8601)." }, "comments": { "type": "string", "description": "Optional comments on the decision." } } } } } } }, "example": { "vendor": { "id": "123", "decision": { "status": "APPROVED", "lastUpdatedAt": "2025-10-10T00:00:00.000Z", "comments": "No weaknesses or flagged findings identified in the review." } } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.information-request.status-changed": { "post": { "operationId": "v1.information-request.status-changed", "tags": [ "Information Request" ], "summary": "Information request status changed", "description": "Fires when an information request's approval status changes. This is a status-change event.\n\n**Ready-to-review signal:** a `newStatus` of `READY_FOR_AUDIT` means the customer has submitted the information request and it is ready for the auditor to review.\n\n**When it fires:** once per information request, each time its status changes between the values below. Not every status transition emits an event.\n\n**Status values:**\n- `NEEDS_EVIDENCE` — the request still needs work from the customer; it is not yet ready for the auditor.\n- `READY_FOR_AUDIT` — the customer has submitted the request and it is ready for the auditor to review.\n- `AUDITOR_APPROVED` — the auditor reviewed the request and approved it.\n- `AUDITOR_FLAGGED` — the auditor flagged the request for the customer to address.\n\nA typical lifecycle is `NEEDS_EVIDENCE → READY_FOR_AUDIT → AUDITOR_APPROVED` (or `→ AUDITOR_FLAGGED`). A request can also move from `READY_FOR_AUDIT` back to `NEEDS_EVIDENCE` when the customer takes it back to continue working on it.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "informationRequest" ], "properties": { "informationRequest": { "type": "object", "required": [ "id", "auditId", "oldStatus", "newStatus" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the information request." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the information request belongs to." }, "oldStatus": { "type": "string", "description": "The status the information request was in before the change.", "enum": [ "NEEDS_EVIDENCE", "READY_FOR_AUDIT", "AUDITOR_APPROVED", "AUDITOR_FLAGGED" ] }, "newStatus": { "type": "string", "description": "The status the information request is in after the change. A value of `READY_FOR_AUDIT` means the customer has submitted the request and it is ready for the auditor to review.", "enum": [ "NEEDS_EVIDENCE", "READY_FOR_AUDIT", "AUDITOR_APPROVED", "AUDITOR_FLAGGED" ] } } } } }, "example": { "informationRequest": { "id": "507f1f77bcf86cd799439011", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f", "oldStatus": "NEEDS_EVIDENCE", "newStatus": "READY_FOR_AUDIT" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.information-request.comment.created": { "post": { "operationId": "v1.information-request.comment.created", "tags": [ "Information Request" ], "summary": "Information request comment created", "description": "Fires when a comment is created on an information request. Fires once per comment.\n\nThe payload contains only identifiers; fetch the comment body from the information request comments endpoint (`GET /v1/audits/{auditId}/information-requests/{requestId}/comments`).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "informationRequest", "comment" ], "properties": { "informationRequest": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the information request." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the information request belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "informationRequest": { "id": "507f1f77bcf86cd799439011", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.information-request.comment.updated": { "post": { "operationId": "v1.information-request.comment.updated", "tags": [ "Information Request" ], "summary": "Information request comment updated", "description": "Fires when a comment on an information request is updated. Fires once per comment update.\n\nThe payload contains only identifiers; fetch the current comment body from the information request comments endpoint (`GET /v1/audits/{auditId}/information-requests/{requestId}/comments`).", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "informationRequest", "comment" ], "properties": { "informationRequest": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the information request." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the information request belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "informationRequest": { "id": "507f1f77bcf86cd799439011", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.information-request.comment.deleted": { "post": { "operationId": "v1.information-request.comment.deleted", "tags": [ "Information Request" ], "summary": "Information request comment deleted", "description": "Fires when a comment is deleted from an information request. Fires once per comment deletion.\n\nThe payload contains only identifiers; the deleted comment is still returned by the information request comments endpoint (`GET /v1/audits/{auditId}/information-requests/{requestId}/comments`) as a soft-deleted record with a non-null `deletionDate`.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "informationRequest", "comment" ], "properties": { "informationRequest": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the information request." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the information request belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "informationRequest": { "id": "507f1f77bcf86cd799439011", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.information-request.evidence.created": { "post": { "operationId": "v1.information-request.evidence.created", "tags": [ "Information Request" ], "summary": "Information request evidence created", "description": "Fires when a piece of evidence is added to an information request. Fires once per piece of evidence — if several pieces are added in a single action, you receive one event per piece.\n\nThese `v1.information-request.evidence.*` events belong to the Information Request experience and are unrelated to the `v1.evidence.*` classic audit evidence events.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "informationRequest", "evidence" ], "properties": { "informationRequest": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the information request." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the information request belongs to." } } }, "evidence": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the evidence." } } } } }, "example": { "informationRequest": { "id": "507f1f77bcf86cd799439011", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "evidence": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.information-request.evidence.deleted": { "post": { "operationId": "v1.information-request.evidence.deleted", "tags": [ "Information Request" ], "summary": "Information request evidence deleted", "description": "Fires when a piece of evidence is removed from an information request. Fires once per piece of evidence removed.\n\nThese `v1.information-request.evidence.*` events belong to the Information Request experience and are unrelated to the `v1.evidence.*` classic audit evidence events.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "informationRequest", "evidence" ], "properties": { "informationRequest": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the information request." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the information request belongs to." } } }, "evidence": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the evidence." } } } } }, "example": { "informationRequest": { "id": "507f1f77bcf86cd799439011", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "evidence": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.evidence.status-changed": { "post": { "operationId": "v1.evidence.status-changed", "tags": [ "Evidence" ], "summary": "Evidence status changed", "description": "Fires when an existing audit evidence item changes status. This is a status-change event, not a creation event — there is no separate \"created\" event for audit evidence, so `oldStatus` and `newStatus` always describe a transition of an item that already exists.\n\n**Ready-to-review signal:** a `newStatus` of `READY_FOR_AUDIT` means the customer has provided evidence for the item and it is ready for the auditor to review.\n\n**When it fires:** once per evidence item, each time its status changes. Status can also change on its own as the customer's compliance posture changes, so an item may move from `READY_FOR_AUDIT` back to `NOT_READY_FOR_AUDIT` without an explicit auditor action.\n\n**Status values:**\n- `NOT_READY_FOR_AUDIT` — the item is not yet ready for the auditor; required evidence is missing or does not meet the requirement.\n- `READY_FOR_AUDIT` — the customer has provided the evidence and it is ready for the auditor to review.\n- `ACCEPTED` — the auditor reviewed the item and accepted it.\n- `FLAGGED` — the auditor reviewed the item and flagged an issue for the customer to address; once the customer addresses it the item returns to `READY_FOR_AUDIT`.\n- `NA` — the item is not applicable to this audit.\n\nA typical lifecycle is `NOT_READY_FOR_AUDIT → READY_FOR_AUDIT → ACCEPTED` (or `→ FLAGGED`, which returns to `READY_FOR_AUDIT` once the customer addresses the issue). `INITIALIZED` is an internal status and is never delivered — `oldStatus` and `newStatus` are always one of the values above.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "evidence" ], "properties": { "evidence": { "type": "object", "required": [ "id", "auditId", "oldStatus", "newStatus" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the evidence." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the evidence belongs to." }, "oldStatus": { "type": "string", "description": "The status the evidence item was in before the change. `INITIALIZED` is an internal status and is never delivered.", "enum": [ "ACCEPTED", "FLAGGED", "INITIALIZED", "NA", "NOT_READY_FOR_AUDIT", "READY_FOR_AUDIT" ] }, "newStatus": { "type": "string", "description": "The status the evidence item is in after the change. A value of `READY_FOR_AUDIT` means the customer has provided evidence for the item and it is ready for the auditor to review. `INITIALIZED` is an internal status and is never delivered.", "enum": [ "ACCEPTED", "FLAGGED", "INITIALIZED", "NA", "NOT_READY_FOR_AUDIT", "READY_FOR_AUDIT" ] } } } } }, "example": { "evidence": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f", "oldStatus": "NOT_READY_FOR_AUDIT", "newStatus": "READY_FOR_AUDIT" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.evidence.comment.created": { "post": { "operationId": "v1.evidence.comment.created", "tags": [ "Evidence" ], "summary": "Evidence comment created", "description": "Fires when a comment is created on an audit evidence item. Fires once per comment.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "evidence", "comment" ], "properties": { "evidence": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the evidence." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the evidence belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "evidence": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.evidence.comment.updated": { "post": { "operationId": "v1.evidence.comment.updated", "tags": [ "Evidence" ], "summary": "Evidence comment updated", "description": "Fires when a comment on an audit evidence item is updated. Fires once per comment update.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "evidence", "comment" ], "properties": { "evidence": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the evidence." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the evidence belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "evidence": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.evidence.comment.deleted": { "post": { "operationId": "v1.evidence.comment.deleted", "tags": [ "Evidence" ], "summary": "Evidence comment deleted", "description": "Fires when a comment is deleted from an audit evidence item. Fires once per comment deletion.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "evidence", "comment" ], "properties": { "evidence": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the evidence." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the evidence belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "evidence": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.control.comment.created": { "post": { "operationId": "v1.control.comment.created", "tags": [ "Control" ], "summary": "Control comment created", "description": "An external comment was created on an audit control. Fires once per comment.\n\nThis event is delivered only to [Audit Partner](/reference/audits/overview) accounts and is gated by the early-access `audit_control_comment_webhook` feature — reach out to your Vanta contact to enable it.\n\nThe payload contains only identifiers. Fetch the comment body from `GET /v1/audits/{auditId}/controls/{controlId}/comments`.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "control", "comment" ], "properties": { "control": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the control the comment was added to." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the control belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "control": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.control.comment.updated": { "post": { "operationId": "v1.control.comment.updated", "tags": [ "Control" ], "summary": "Control comment updated", "description": "An external comment on an audit control was updated. Fires once per comment update.\n\nThis event is delivered only to [Audit Partner](/reference/audits/overview) accounts and is gated by the early-access `audit_control_comment_webhook` feature — reach out to your Vanta contact to enable it.\n\nThe payload contains only identifiers. Fetch the current comment body from `GET /v1/audits/{auditId}/controls/{controlId}/comments`.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "control", "comment" ], "properties": { "control": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the control the comment belongs to." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the control belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "control": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } }, "/v1.control.comment.deleted": { "post": { "operationId": "v1.control.comment.deleted", "tags": [ "Control" ], "summary": "Control comment deleted", "description": "An external comment was deleted from an audit control. Fires once per comment deletion.\n\nThis event is delivered only to [Audit Partner](/reference/audits/overview) accounts and is gated by the early-access `audit_control_comment_webhook` feature — reach out to your Vanta contact to enable it.\n\nThe payload contains only identifiers. The deleted comment no longer appears in `GET /v1/audits/{auditId}/controls/{controlId}/comments`.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "control", "comment" ], "properties": { "control": { "type": "object", "required": [ "id", "auditId" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the control the comment was deleted from." }, "auditId": { "type": "string", "description": "The unique identifier of the audit the control belongs to." } } }, "comment": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The unique identifier of the comment." } } } } }, "example": { "control": { "id": "8f9e0d1c2b3a4f5e6d7c8b9a", "auditId": "5f8d0f3b9d3f2a1b4c5d6e7f" }, "comment": { "id": "6a7b8c9d0e1f2a3b4c5d6e7f" } } } } }, "responses": { "200": { "description": "Return any 2xx status within 15 seconds to acknowledge receipt." } } } } } }