Skip to main content
This reference documents every event type Vanta can deliver to a registered webhook endpoint, along with its payload schema and an example body. The payload documented for each event is the event body.
New to webhooks? Follow the step-by-step Subscribe to webhook events guide to register an endpoint, verify signatures, and handle retries.

​
Domains

Every event type is a stable identifier in the form v1.<domain>.<entity>.<action>. Events are grouped into the following domains — browse each domain in the sidebar to see its individual events, payloads, and schemas.
The Information Request, Evidence, and Control domains are auditor-specific — these events are only delivered to Audit Partner accounts during an active audit engagement. All other domains are delivered to your own Vanta account.

​
Delivery format

Vanta sends each event as an HTTP POST with the event payload as the JSON body. Every delivery includes the following headers:
Treat IDs in payloads as opaque strings. To fetch the full object referenced by an event, call the corresponding Manage Vanta API endpoint with the ID from the payload.

​
Retry schedule

A delivery is considered failed if your endpoint doesn’t respond with a 2xx status code within 15 seconds, including network timeouts. Vanta automatically retries failed deliveries using an exponential backoff schedule: After all retry attempts are exhausted (approximately 5 days total), the message is marked as failed. You can also manually retry failed messages from the webhook dashboard, or recover missed events as described in the Webhooks guide.

​
Next steps

Set up webhooks

Register an endpoint, verify signatures, and handle retries.

Manage Vanta API

Look up the full objects referenced in webhook payloads.