How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Vanta

Vanta Audits API

The Audits API from Vanta — 15 operation(s) for audits.

Documentation Provider Profile APIs.io OpenAPI GitHub

Vanta Audits API is one of 11 APIs that Vanta publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Audits. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and authentication docs.

This API exposes 15 operations across 15 paths, and defines 91 schemas. It is described by OpenAPI 3.0.0, at version 1.0.0.

Requests are made against a single base URL, https://api.vanta.com/v1.

15 operations 15 paths 91 schemas 11 GET1 PATCH3 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.0
API Version
1.0.0
Base URL
https://api.vanta.com
Authentication
OAuth 2.0, HTTP Bearer
Contact
API Support
License
UNLICENSED
Terms of Service
View terms
Resource Areas
1

Authentication & Security 2

Vanta Audits API declares 2 security schemes for authenticating requests. It supports OAuth 2.0 (oauth) using the clientCredentials flow, exposing 4 scopes. It accepts HTTP bearer tokens (bearerAuth).

  • oauth — Get an oauth token from the token url and use it as a bearer token to access the Vanta API.

Paths & Operations 15

Across 15 paths, the API surfaces 15 operations — 11 GET, 1 PATCH, 3 POST. Each is listed below with its method, path, parameters, and response codes.

Audits 15
GET
/audits
List audits
ListAudits 4 params → 200
GET
/audits/{auditId}/vendors
List of vendors who are in scope for this audit
ListVendorsInAuditScope 3 params → 200
GET
/audits/{auditId}/monitored-computers
List monitored computers
ListMonitoredComputersInAuditScope 4 params → 200
GET
/audits/{auditId}/evidence/{auditEvidenceId}/urls
List audit evidence url
ListAuditEvidenceUrls 4 params → 200
GET
/audits/{auditId}/people
List of people who are in scope for this audit
ListPeopleInAuditScope 6 params → 200
GET
/audits/{auditId}/vulnerability-remediations
List vulnerability remediations that are in scope for this audit
ListVulnerabilityRemediationsInAuditScope 8 params → 200
GET
/audits/{auditId}/evidence
List audit evidence
ListAuditEvidence 4 params → 200
GET
/audits/{auditId}/comments
List audit comments
ListAuditComments 4 params → 200
GET
/audits/{auditId}/controls
List audit controls
ListAuditControls 3 params → 200
POST
/audits/{auditId}/evidence/{auditEvidenceId}/comments
Create a comment for audit evidence
CreateCommentForAuditEvidence 2 params body → 200
PATCH
/audits/{auditId}/evidence/{auditEvidenceId}
Update audit evidence
UpdateAuditEvidence 2 params body → 200
POST
/audits/{auditId}/evidence/custom-evidence-requests
Create a custom evidence request for an audit
CreateCustomEvidenceRequest 1 param body → 200
POST
/audits/{auditId}/controls/custom-controls
Create a custom control for an audit
CreateCustomControl 1 param body → 201
GET
/audits/{auditId}/vulnerabilities
List vulnerabilities within the scope of a given audit
ListVulnerabilities 14 params → 200
GET
/audits/{auditId}/vulnerable-assets
List assets associated with vulnerabilities
GetVulnerableAssets 7 params → 200

Schemas 91

The contract defines 91 schemas that model the data the API accepts and returns. The most detailed are Vendor (25 properties), Vulnerability (20 properties), VulnerableAssetScanner (15 properties), Audit (15 properties). Each schema is shown below with its type and property counts.

Training
object
A person's security training.
1 property 1 required
Vulnerability
object
20 properties 19 required
PageSize
integer
Controls the maximum number of items returned in one response from the API.
MonitoredComputer
object
11 properties 11 required
KeyValuePair
object
2 properties 2 required
InstallDeviceMonitoringTaskSummary
object
Task summary for installing device monitoring.
5 properties 5 required
ControlDomain
string
PaginatedResponse_Vendor_
object
1 property 1 required
PersonInfoSourceType.VANTA
string
Comment
object
7 properties 7 required
AuditFocus
string
TaskSummaryDetails
object
All detailed information about a person's tasks, split across task categories.
6 properties 6 required
CreateCustomControlInput
object
7 properties 5 required
PaginatedResponse_Evidence_
object
1 property 1 required
AddCommentInput
object
3 properties 3 required
PaginatedResponse_EvidenceUrl_
object
1 property 1 required
OperatingSystemType
string
The possible types of the operating system. One of macOS, linux, or windows.
CompleteBackgroundChecksTaskSummary
object
Task summary for completing background checks.
5 properties 5 required
CompleteCustomTasksTaskSummary
object
Task summary for completing all custom tasks.
7 properties 7 required
RecurrenceDuration
string
PaginatedResponse_AuditorControl_
object
1 property 1 required
PaginatedResponse_Vulnerability_
object
1 property 1 required
IntegrationBasedPersonInfoSource
object
The person's information comes from an integration.
3 properties 3 required
VantaBasedPersonInfoSource
object
The person's information comes from what is set in Vanta.
1 property 1 required
AuditEvidenceType
string
PersonInfoSource
The source of the person's information.
LeaveInfo
object
3 properties 3 required
FrameworkId
string
TasksSummaryStatus
string
The overall status of a person's outstanding tasks: - NONE: There are no tasks. - DUESOON: At least one task is due soon. - OVERDUE: At least one task is overd…
VulnerabilityType
string
CustomEvidenceRequest
object
7 properties 7 required
ControlSource
string
PageInfo
object
Provides information about the pagination of a dataset.
4 properties 4 required
PaginatedResponse_Comment_
object
1 property 1 required
PageCursor
string
A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not includ…
AcceptPoliciesTaskSummary
object
Policy acceptance details for a person.
7 properties 7 required
Audit
object
15 properties 15 required
ExternalFindingSeverityType
string
PaginatedResponse_Person_
object
1 property 1 required
TaskType
string
The type a task summary falls into. COMPLETETRAININGS: The task summary containing security trainings. ACCEPTPOLICIES: The task summary containing policy accep…
Owner
object
3 properties 3 required
TaskType.INSTALL_DEVICE_MONITORING
string
Evidence
object
12 properties 12 required
AuditEvidenceState
string
ListAuditsPageSize
integer
Controls the maximum number of items returned in one response from the listAudits API. We have increased the pagination size for this endpoint to enable our up…
PersonInfoSourceType.SCIM
string
LeaveStatus
string
User can be active or upcoming leave period
TaskType.ACCEPT_POLICIES
string
ScimBasedPersonInfoSource
object
The person's information comes from SCIM.
1 property 1 required
VulnerableAssetType
string
VulnerableAssetType describes the types of assets a vulnerability is on.
Section
object
2 properties 2 required
EvidenceUrl
object
4 properties 4 required
Control
object
9 properties 8 required
VulnerabilityRemediation
object
7 properties 7 required
ComputerStatusOutcome
string
The possible outcomes of a status check. The outcome can be one of the following: FAIL: The check is failing. INPROGRESS: The check needs further data from the…
PersonInfoSourceType.INTEGRATION
string
PaginatedResponse_Audit_
object
1 property 1 required
TaskType.COMPLETE_CUSTOM_TASKS
string
EmploymentStatus
string
The employment status of a person: - UPCOMING: The person is not yet employed and will start employment in the future. - CURRENT: The person is currently emplo…
OperatingSystem
object
The computer's operating system type and version.
2 properties 2 required
TaskType.COMPLETE_BACKGROUND_CHECKS
string
VendorAuthenticationMethod
string
The authentication method a vendor uses: - AUTH0: The vendor authenticates using Auth0 - AZUREAD: The vendor authenticates using Azure Active Directory - GSUIT…
PaginatedResponse_VulnerableAsset_
object
1 property 1 required
CreateCustomEvidenceRequestInput
object
7 properties 7 required
CountryCode
string
CurrencyCode
string
ComputerStatus
object
The a status check for a computer. Representation for screenlock, diskEncryption, passwordManager, and antivirusInstallation.
1 property 1 required
EvidenceControl
object
2 properties 2 required
FrameworkSection
object
2 properties 2 required
Person
object
8 properties 8 required
Vendor
object
25 properties 25 required
VulnerableAsset
object
6 properties 6 required
AuditEvidenceUpdateInput
object
1 property
CompleteOffboardingCustomTasksTaskSummary
object
Task summary for completing all offboarding custom tasks.
7 properties 7 required
ComputerStatusFilter
string
Enum representing computer compliance statuses that can be utilized as a filter. The meanings are as follows: AVNOTINSTALLED: The computer does not have antivi…
ExternalFindingSeverity
string
ExternalFindingSeverity describes the severity of an external finding (Vulnerability or Security Alert)
PaginatedResponse_MonitoredComputer_
object
1 property 1 required
VendorRiskLevel
string
The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium s…
TaskStatus
string
The status of a task. - COMPLETE: The task has been completed. - DUESOON: The task is due soon. - OVERDUE: The task is overdue. - NONE: The task is not assigne…
PaginatedResponse_VulnerabilityRemediation_
object
1 property 1 required
VendorStatus
string
The current state of a vendor: - MANAGED: The vendor is actively managed. - ARCHIVED: The vendor has been archived - INPROCUREMENT: The vendor is in the procur…
CustomField
object
2 properties 2 required
VulnerableAssetScanner
object
15 properties 15 required
TaskType.COMPLETE_CUSTOM_OFFBOARDING_TASKS
string
GdprRole
string
CustomTask
object
A custom task.
1 property 1 required
VendorContractAmount
object
2 properties 2 required
AuditorEnabledStateTransition
string
CompleteTrainingsTaskSummary
object
Task summary for completing all trainings.
7 properties 7 required
AuditorControl
object
11 properties 10 required
TaskType.COMPLETE_TRAININGS
string

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

vanta-audits-api-openapi.yml Raw ↑

Other APIs Vanta publishes across the network.

Vanta Auditors API
AE Profile APIs.io
Vanta Authentication API
AE Profile APIs.io
Vanta Controls API
AE Profile APIs.io
Vanta Documents API
AE Profile APIs.io
Vanta Integrations API
AE Profile APIs.io
Vanta Resources API
AE Profile APIs.io
Vanta Tests API
AE Profile APIs.io
Vanta Users API
AE Profile APIs.io
Vanta Vendors API
AE Profile APIs.io
Vanta Vulnerabilities API
AE Profile APIs.io
#Audits
← Back to V APIs
API Details
ID
vanta:vanta-audits-api
Base URL
https://api.vanta.com
Docs
https://developer.vanta.com/docs/vanta-api-overview
Provider
Vanta
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=vanta-audits-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/vanta-audits-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Vanta Audits API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.