Skip to main content
Vanta logo

Overview

Add Vanta to any ModuleX agent or workflow. Query compliance posture and manage evidence in Vanta — frameworks, controls, automated tests, evidence documents, people, policies, vendors, monitored computers, vulnerabilities, and risk scenarios — via the Vanta v1 REST API (https://api.vanta.com/v1, or https://api.vanta-gov.com/v1 for the FedRAMP region).
Categories: Monitoring & Observability · Security · Compliance · GRC · Auth: Vanta OAuth Client Credentials · Actions: 29

Authentication

Vanta OAuth Client Credentials

Authenticate with a Vanta OAuth application’s Client ID + Client Secret (machine-to-machine client_credentials grant). The tool exchanges them for a short-lived access token on each request. Evidence uploads require the vanta-api.documents:upload scope.
1

Step 1

Sign in to Vanta as an administrator
2

Step 2

Go to Settings -> Developer Console and create an API application
3

Step 3

Copy the generated Client ID and Client Secret (the Secret is shown only once)
4

Step 4

Grant the application the read scopes (and the documents:upload / write scopes if you need evidence upload or document submission)
5

Step 5

Choose your region: ‘us’ (api.vanta.com, default) or ‘gov’ (api.vanta-gov.com)

Required Credentials

Available Actions

Parameters

integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the framework (e.g., soc2).

Response

Parameters

string
required
Unique ID of the framework (e.g., soc2).
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
Comma-separated framework IDs to filter controls by (e.g., soc2,iso27001).
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the control.

Response

Parameters

string
required
Unique ID of the control.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the control.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
Filter by test status: OK, DEACTIVATED, NEEDS_ATTENTION, IN_PROGRESS, INVALID, or NOT_APPLICABLE.
string
Filter by framework ID (e.g., soc2).
string
Filter by integration ID (e.g., aws).
string
Filter by control ID.
string
Filter by owner user ID.
string
Filter by test category (e.g., ACCOUNTS_ACCESS, COMPUTERS, INFRASTRUCTURE, POLICIES, VULNERABILITY_MANAGEMENT).
boolean
Filter by whether the test is in rollout.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the test (e.g., test-aws-cloudtrail-enabled).

Response

Parameters

string
required
Unique ID of the test (e.g., test-aws-cloudtrail-enabled).
string
Filter entities by status: FAILING or DEACTIVATED.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
Comma-separated framework IDs to filter documents by (e.g., soc2,iso27001).
string
Comma-separated document statuses to filter by: “Needs document”, “Needs update”, “Not relevant”, “OK”.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the document.

Response

Parameters

string
required
Unique ID of the document.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the document to attach the file to.
string
required
Base64-encoded content of the evidence file to upload.
string
required
File name for the upload (e.g., access-review.pdf).
string
MIME type of the file (e.g., application/pdf).
string
Description of the uploaded evidence (e.g., “Q3 access review evidence”).
string
ISO 8601 date indicating when the document is effective from.

Response

Parameters

string
required
Unique ID of the document.
string
required
Unique ID of the uploaded file (from list_document_uploads).

Response

Parameters

string
required
Unique ID of the document to submit.

Response

Parameters

string
Filter people by email address or name.
string
Filter by employment status: UPCOMING, CURRENT, ON_LEAVE, INACTIVE, or FORMER.
string
Comma-separated group IDs to filter people by.
string
Comma-separated task summary statuses: NONE, DUE_SOON, OVERDUE, COMPLETE, PAUSED, OFFBOARDING_DUE_SOON, OFFBOARDING_OVERDUE, OFFBOARDING_COMPLETE.
string
Comma-separated task types: COMPLETE_TRAININGS, ACCEPT_POLICIES, COMPLETE_CUSTOM_TASKS, COMPLETE_CUSTOM_OFFBOARDING_TASKS, INSTALL_DEVICE_MONITORING, COMPLETE_BACKGROUND_CHECKS.
string
Comma-separated task statuses: COMPLETE, DUE_SOON, OVERDUE, NONE.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the person.

Response

Parameters

integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the policy.

Response

Parameters

string
Filter vendors by name.
string
Comma-separated vendor statuses: MANAGED, ARCHIVED, IN_PROCUREMENT.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the vendor.

Response

Parameters

string
Comma-separated compliance issues: PWM_NOT_INSTALLED, HD_NOT_ENCRYPTED, AV_NOT_INSTALLED, SCREENLOCK_NOT_CONFIGURED, LAST_CHECK_OVER_14_DAYS.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
Search query for vulnerabilities.
string
Filter by severity: LOW, MEDIUM, HIGH, or CRITICAL.
boolean
Filter by whether a fix is available.
boolean
Filter by whether vulnerability monitoring is deactivated.
boolean
Include vulnerabilities that have no SLA deadline.
string
Filter by the affected package identifier.
string
Filter by external vulnerability ID (e.g., a CVE identifier).
string
Filter by the integration that detected the vulnerability.
string
Filter by the vulnerable asset ID.
string
Only include vulnerabilities with an SLA deadline after this ISO 8601 date.
string
Only include vulnerabilities with an SLA deadline before this ISO 8601 date.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
Filter by the integration that detected the vulnerability.
string
Filter by severity: LOW, MEDIUM, HIGH, or CRITICAL.
boolean
Filter by whether the vulnerability was remediated before its SLA deadline.
string
Only include remediations completed after this ISO 8601 date.
string
Only include remediations completed before this ISO 8601 date.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
Search query for vulnerable assets.
string
Filter by the integration scanning the asset.
string
Filter by asset type: SERVER, SERVERLESS_FUNCTION, CONTAINER, CONTAINER_REPOSITORY, CONTAINER_REPOSITORY_IMAGE, CODE_REPOSITORY, MANIFEST_FILE, WORKSTATION, or OTHER.
string
Filter by the external account ID the asset belongs to.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the vulnerable asset.

Response

Parameters

string
Search string to filter risk scenarios.
boolean
Include ignored risk scenarios.
string
Filter by scenario type: “Risk Scenario” or “Enterprise Risk”.
string
Comma-separated owner emails to filter by.
string
Comma-separated risk categories to filter by.
string
Comma-separated CIA categories: Confidentiality, Integrity, Availability.
string
Comma-separated treatments: Mitigate, Transfer, Avoid, Accept.
string
Comma-separated inherent score groups: “Very low”, Low, Med, High, Critical.
string
Comma-separated residual score groups: “Very low”, Low, Med, High, Critical.
string
Comma-separated review statuses: APPROVED, DRAFT, NOT_REVIEWED, AWAITING_SUBMISSION, PENDING_APPROVAL, REQUESTED_CHANGES.
string
Field to order results by: description or createdAt.
integer
Maximum number of items per page (1-100, default 10).
string
Pagination cursor: pass the end_cursor from a previous response to fetch the next page.
integer
Maximum number of pages to fetch when auto-paginating (default 1). (Default: 1)

Response

Parameters

string
required
Unique ID of the risk scenario.

Response

Limits & Quotas

  • The Manage Vanta API is rate-limited to roughly 50 requests/minute; consult your Vanta plan for exact limits.
  • Vanta keeps only one access token active per application — the tool exchanges a fresh token per call.
  • List actions auto-paginate up to max_pages (default 1); raise it to gather more pages in one call.
  • Error model: non-2xx responses (including auth failures) are caught and returned as success=False + error rather than raising.

CrowdStrike

Datadog

Grafana