Vanta

Connect a Vanta organization via OAuth2 Client Credentials (API application), after verifying connectivity.

Disconnect a Vanta organization: deletes only the saved credentials. Nothing in Vanta itself is changed.

List the connected Vanta organizations.

List automated compliance Tests (control checks) with their status (OK/FAIL/DISABLED/OUTDATED/NOT_APPLICABLE).

Read one compliance Test in full by id.

Dismiss a failing Test with a documented reason -- records an explicit exception/justification in Vanta rather than silently ignoring the failure.

List Controls (named requirements mapped to one or more frameworks, each backed by 1+ Tests).

Read one Control in full by id.

List compliance Frameworks enabled on the connected organization (SOC 2, ISO 27001, HIPAA, etc.).

List Risk Register entries.

Read one Risk Register entry in full by id.

Create a new Risk Register entry.

Update selected fields of an existing Risk Register entry (status, treatment plan). Only given fields change.

List Risk Scenarios (the named risk categories Risk Register entries can be tied to).

List Vendor risk inventory (third-party risk management) entries.

Read one Vendor risk record in full by id.

Register a new Vendor for risk tracking.

Update selected fields of an existing Vendor (risk tier, review status). Only given fields change.

List Policy Documents tracked in Vanta (with review status/dates).

Read one Policy Document in full by id.

List Personnel records with security-training and offboarding compliance status.

Read one Personnel record in full by id.

List connected data-source Integrations (cloud/IdP/HR/ticketing) Vanta pulls evidence from, with their sync status.

List Groups (Vanta's grouping of resources/people for scoping tests).

List employee computers Vanta monitors for device-compliance (disk encryption, screen lock, AV, OS updates).

Build one aggregated audit-readiness health report: failing tests, overdue risks, overdue vendor reviews, and documents past their review date.