Save a vendor's security review

Create a new vendor's security review

Securitybearer

Request

path Parameters

vendor_id

required

number

Request Body schema: application/json
required

title	string or null <= 191 characters Vendor security review title
reviewDeadlineAt required	string <date-time> Vendor security review deadline date
requestedAt required	string <date-time> Vendor security requested date
securityReviewStatus required	string The status for the security review Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"
securityReviewType required	string The type for the security review Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"
requesterUserId	number <= 1000000000 The user ID of the person that requested the security review

Responses

201

Record created!

400

Malformed data and/or validation errors

401

Invalid Authorization

402

Response Code 402

You must pay to activate this feature

403

You are not allowed to perform this action

404

Record Not Found

500

Internal server error

default

Response Code: 412

You must accept the Drata terms and conditions to use the API

post/vendors/{vendor_id}/security-reviews

Request samples

application/json

{"title": "Security review title",
"reviewDeadlineAt": "2025-01-29",
"requestedAt": "2025-01-29",
"securityReviewStatus": "NOT_YET_STARTED",
"securityReviewType": "SECURITY",
"requesterUserId": 1
}

Response samples

application/json

{"id": 1,
"requestedAt": "2019-08-24T14:15:22Z",
"reviewDeadlineAt": "2019-08-24T14:15:22Z",
"decision": "APPROVED",
"note": "string",
"status": "NOT_YET_STARTED",
"type": "SECURITY",
"requesterUser": {"id": 1,
"email": "[email protected]",
"firstName": "Sally",
"lastName": "Smith",
"jobTitle": "CEO",
"avatarUrl": "https://cdn-prod.imgpilot.com/avatar.png",
"drataTermsAgreedAt": "2020-07-06 12:00:00.000000",
"createdAt": "2020-07-06 12:00:00.000000",
"updatedAt": "2020-07-06 12:00:00.000000",
"roles": ["ROLE",
"ANOTHER_ROLE"
],
"backgroundChecks": [{"id": 1,
"userId": 1,
"status": "OK",
"caseId": "abc123",
"caseInvitationId": "abc123",
"url": "https://app-stage.karmacheck.com/background_check/aaaaaaaa-bbbb-0000-cccc-dddddddddddd",
"manualCheckDate": "2020-07-06",
"manuallyCheckUrl": "url.com",
"type": "CERTN",
"source": "DRATA",
"reportData": "string",
"user": { },
"outOfScopeReason": "abc123",
"outOfScopeAt": "2020-07-06 12:00:00.000000",
"invitationEmail": "[email protected]",
"linkedAt": "2020-07-06 12:00:00.000000",
"createdAt": "2020-07-06 12:00:00.000000",
"updatedAt": "2020-07-06 12:00:00.000000"
}
],
"identities": [{"id": 1,
"identityId": "1a2b3c",
"username": "Username",
"connectedAt": "2020-07-06 12:00:00.000000",
"disconnectedAt": "2020-07-06 12:00:00.000000",
"hasMfa": true,
"user": { },
"connection": {"id": "1",
"clientType": "GOOGLE",
"state": "ACTIVE",
"connected": false,
"connectedAt": "2020-07-06 12:00:00.000000",
"failedAt": "2020-07-06 12:00:00.000000",
"companyId": "12341234",
"assignmentId": "FLk12AsS",
"user": { },
"accountId": "string",
"clientId": "drata.com",
"clientAlias": "My-connection-alias-1",
"manuallyUpdatedAt": "2020-07-06 12:00:00.000000",
"aliasUpdatedAt": "2020-07-06 12:00:00.000000",
"deletedAt": "2020-07-06 12:00:00.000000",
"requestorId": "328d3016-71f3-4485-af20-06ce8044da18",
"product": "",
"writeAccessEnabled": false,
"sourcePreference": "LABEL",
"securityLabel": "Jira Security Label",
"jqlQuery": "project = IT AND type = \"Offboarding\"",
"authorized": true,
"workspaces": [{"id": 1,
"name": "Drata",
"description": "Platform to track SOC 2 compliance within the organization",
"howItWorks": null,
"url": "https://app.drata.com",
"logo": "https://cdn.drata.com/icon/icon_fwhite_bblue_256.png",
"primary": true
}
],
"providerTypes": [5
],
"code": 10010,
"groupLabel": "Everyone"
},
"hasIdp": true,
"secondaryEmail": "[email protected]",
"firstName": "John",
"lastName": "Doe",
"startedAt": "Wed Jan 29 2025",
"separatedAt": "Wed Jan 29 2025",
"isContractor": true,
"jobTitle": "Engineer",
"managerId": "x00jk12-2312",
"managerName": ""
}
]
},
"user": {"id": 1,
"email": "[email protected]",
"firstName": "Sally",
"lastName": "Smith",
"jobTitle": "CEO",
"avatarUrl": "https://cdn-prod.imgpilot.com/avatar.png",
"drataTermsAgreedAt": "2020-07-06 12:00:00.000000",
"createdAt": "2020-07-06 12:00:00.000000",
"updatedAt": "2020-07-06 12:00:00.000000",
"roles": ["ROLE",
"ANOTHER_ROLE"
],
"backgroundChecks": [{"id": 1,
"userId": 1,
"status": "OK",
"caseId": "abc123",
"caseInvitationId": "abc123",
"url": "https://app-stage.karmacheck.com/background_check/aaaaaaaa-bbbb-0000-cccc-dddddddddddd",
"manualCheckDate": "2020-07-06",
"manuallyCheckUrl": "url.com",
"type": "CERTN",
"source": "DRATA",
"reportData": "string",
"user": { },
"outOfScopeReason": "abc123",
"outOfScopeAt": "2020-07-06 12:00:00.000000",
"invitationEmail": "[email protected]",
"linkedAt": "2020-07-06 12:00:00.000000",
"createdAt": "2020-07-06 12:00:00.000000",
"updatedAt": "2020-07-06 12:00:00.000000"
}
],
"identities": [{"id": 1,
"identityId": "1a2b3c",
"username": "Username",
"connectedAt": "2020-07-06 12:00:00.000000",
"disconnectedAt": "2020-07-06 12:00:00.000000",
"hasMfa": true,
"user": { },
"connection": {"id": "1",
"clientType": "GOOGLE",
"state": "ACTIVE",
"connected": false,
"connectedAt": "2020-07-06 12:00:00.000000",
"failedAt": "2020-07-06 12:00:00.000000",
"companyId": "12341234",
"assignmentId": "FLk12AsS",
"user": { },
"accountId": "string",
"clientId": "drata.com",
"clientAlias": "My-connection-alias-1",
"manuallyUpdatedAt": "2020-07-06 12:00:00.000000",
"aliasUpdatedAt": "2020-07-06 12:00:00.000000",
"deletedAt": "2020-07-06 12:00:00.000000",
"requestorId": "328d3016-71f3-4485-af20-06ce8044da18",
"product": "",
"writeAccessEnabled": false,
"sourcePreference": "LABEL",
"securityLabel": "Jira Security Label",
"jqlQuery": "project = IT AND type = \"Offboarding\"",
"authorized": true,
"workspaces": [{"id": 1,
"name": "Drata",
"description": "Platform to track SOC 2 compliance within the organization",
"howItWorks": null,
"url": "https://app.drata.com",
"logo": "https://cdn.drata.com/icon/icon_fwhite_bblue_256.png",
"primary": true
}
],
"providerTypes": [5
],
"code": 10010,
"groupLabel": "Everyone"
},
"hasIdp": true,
"secondaryEmail": "[email protected]",
"firstName": "John",
"lastName": "Doe",
"startedAt": "Wed Jan 29 2025",
"separatedAt": "Wed Jan 29 2025",
"isContractor": true,
"jobTitle": "Engineer",
"managerId": "x00jk12-2312",
"managerName": ""
}
]
},
"vendor": {"id": 1,
"name": "Acme",
"category": "ENGINEERING",
"risk": "MODERATE",
"type": "CONTRACTOR",
"critical": false,
"location": "USA",
"url": "https://acme.com",
"privacyUrl": "https://acme.com",
"termsUrl": "https://acme.com",
"servicesProvided": "Perform security scans once a month",
"dataStored": "Resulting reports of security scans",
"hasPii": true,
"passwordPolicy": "USERNAME_PASSWORD",
"passwordRequiresMinLength": true,
"passwordMinLength": 8,
"passwordRequiresNumber": true,
"passwordRequiresSymbol": true,
"passwordMfaEnabled": true,
"contactAtVendor": "John Doe",
"contactsEmail": "[email protected]",
"notes": "Meeting once a month to adjust contract",
"logoUrl": "https://cdn-prod.imgpilot.com/logo.png",
"createdAt": "2020-07-06 12:00:00.000000",
"updatedAt": "2020-07-06 12:00:00.000000",
"user": { },
"documents": [{"id": 1,
"name": "AWS SOC 2 2018",
"fileUrl": "http://localhost:5000/download/vendors/1",
"createdAt": "2020-07-06 12:00:00.000000",
"updatedAt": "2020-07-06 12:00:00.000000"
}
],
"lastQuestionnaire": { },
"isSubProcessor": false,
"isSubProcessorActive": false,
"archivedAt": "2020-07-06 12:00:00.000000",
"status": "ACTIVE",
"renewalDate": "2020-07-06",
"renewalScheduleType": "ONE_YEAR",
"renewalDateStatus": "COMPLETED",
"confirmedAt": "2020-07-06 12:00:00.000000",
"reviews": [{"id": 1,
"updatedAt": "2025-01-29",
"reviewer": "John Doe",
"reviewDate": "2025-01-29",
"reportIssueDate": "2025-01-29",
"socReport": "SOC_1",
"socReportType1": true,
"socReportType2": true,
"socType1StartDate": "2025-01-29",
"socType1EndDate": "2025-01-29",
"socType2StartDate": "2025-01-29",
"socType2EndDate": "2025-01-29",
"reportOpinion": "UNQUALIFIED",
"encompassBusinessNeeds": true,
"followUpActivity": "User must proceed to...",
"hasMaterialImpact": true,
"cpaFirm": "CPA firm name",
"cpaProcedurePerformed": "The following procedures were performed...",
"subserviceOrganization": "Subservice Inc.",
"subserviceOrganizationUsingInclusiveMethod": true,
"subserviceOrganizationProcedurePerformed": "The following procedures were performed...",
"trustServiceCategories": [{"id": 1,
"category": "AVAILABILITY"
}
],
"userControls": [{"id": 1,
"name": "End User Control 1",
"inPlace": true
}
],
"services": [{"id": 1,
"name": "Service 1"
}
],
"locations": [{"id": 1,
"city": "San Diego",
"stateCountry": "CA"
}
],
"findings": [{"id": 1,
"description": "Finding 1"
}
]
}
],
"sharedAccountId": "aaaaaaaa-bbbb-0000-cccc-dddddddddddd",
"isDrataUser": false,
"events": 4,
"integrations": [{ }
],
"cost": "1088",
"operationalImpact": "CRITICAL",
"environmentAccess": "READ_ONLY",
"impactLevel": "INSIGNIFICANT",
"dataAccessedOrProcessedList": [{ }
],
"latestSecurityReviews": [{ }
],
"riskCount": 0
}
}