Skip to main content
This reference documents every event type Vanta can deliver to a registered webhook endpoint, along with its payload schema and an example body. The payload documented for each event is the event body.
New to webhooks? Follow the step-by-step Subscribe to webhook events guide to register an endpoint, verify signatures, and handle retries.

​
Domains

Every event type is a stable identifier in the form v1.<domain>.<entity>.<action>. Events are grouped into the following domains — browse each domain in the sidebar to see its individual events, payloads, and schemas.
DomainWhat it covers
QuestionnaireQuestionnaire lifecycle and export events
Trust CenterTrust Center access request events
VendorVendor risk decision events
Information RequestAudit information request (IRL) status, comment, and evidence events
EvidenceAudit evidence status and comment events
The Information Request and Evidence domains are auditor-specific — these events are only delivered to Audit Partner accounts during an active audit engagement. All other domains are delivered to your own Vanta account.

​
Delivery format

Vanta sends each event as an HTTP POST with the event payload as the JSON body. Every delivery includes the following headers:
HeaderDescription
svix-idThe unique message identifier. Use it to deduplicate events.
svix-timestampThe timestamp of the message attempt (seconds since epoch).
svix-signatureThe Base64-encoded signature(s), space-delimited. Use it to verify the request originated from Vanta.
Treat IDs in payloads as opaque strings. To fetch the full object referenced by an event, call the corresponding Manage Vanta API endpoint with the ID from the payload.

​
Retry schedule

A delivery is considered failed if your endpoint doesn’t respond with a 2xx status code within 15 seconds, including network timeouts. Vanta automatically retries failed deliveries using an exponential backoff schedule:
AttemptDelay after previous attempt
1Immediately
25 seconds
35 minutes
430 minutes
52 hours
68 hours
71 day
82 days
After all retry attempts are exhausted (approximately 5 days total), the message is marked as failed. You can also manually retry failed messages from the webhook dashboard, or recover missed events as described in the Webhooks guide.

​
Next steps

Set up webhooks

Register an endpoint, verify signatures, and handle retries.

Manage Vanta API

Look up the full objects referenced in webhook payloads.