Vendor Security Reviews

Vendor Security Reviews track the status of security reviews for Vendors. You can create a security review, upload questionnaires, and track the progress of the review. Each review produces Assessments, the per-criterion findings that carry an analysis summary, status, and severity. The help docs have more information.

List Assessments 🧪

Get a paginated list of Assessments for a given Vendor Security Review.

🧪 Note: This endpoint is in beta and may change.

🔒 Requires Vendors: List Assessments permission.

💎 Requires your account have the TPRM Agentic Assessment, AI Data Share feature. Contact your Account Manager for help upgrading.

Securitybearer or oauth2
Request
path Parameters
vendorId
required
number

The numeric ID of the Vendor.

securityReviewId
required
number

The numeric ID of the Vendor Security Review.

query Parameters
cursor
string

This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results

size
number [ 1 .. 500 ]
Default: 50

Number of results to return

sort
string (SortTypeLimitedEnum)

Which field to sort by

Enum: "createdAt" "updatedAt"
sortDir
string (SortDirectionEnum)

The direction to sort the data

Enum: "ASC" "DESC"
includeTotalCount
boolean

Include total count of all matching records in response. Only honored on first page (when cursor is null).

Example: includeTotalCount=false
criteriaName
string

Filters by criteria name prefix: returns Assessments whose criteria name starts with this text.

Example: criteriaName=security criteria
statuses[]
Array of strings (VendorAssessmentStatusEnum)

Filter Assessments by one or more current statuses.

Items Enum: "MET" "NOT_MET" "INCONCLUSIVE" "N_A" "PARTIALLY_MET"
severities[]
Array of strings (VendorAssessmentCriterionSeverityEnum)

Filter Assessments by one or more criterion severities.

Items Enum: "LOW" "MEDIUM" "HIGH"
Responses
200

Successful

400

Malformed data and/or validation errors

401

Invalid Authorization

402

You must upgrade your plan to use this feature

403

You are not allowed to perform this action

404

The Vendor has no Vendor Security Review with the given securityReviewId

412

You must accept the Drata terms and conditions to use the API

500

Internal server error

get/vendors/{vendorId}/security-reviews/{securityReviewId}/assessments
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "vendorSecurityReviewId": 5,
      • "vendorAssessmentCriteriaId": 123,
      • "criteriaName": "My Criteria",
      • "analysisSummary": "Analysis summary content",
      • "originalAgentStatus": "MET",
      • "currentStatus": "MET",
      • "severity": "HIGH",
      • "createdAt": "2025-07-01T16:45:55.246Z",
      • "updatedAt": "2025-07-01T16:45:55.246Z"
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Get Assessment 🧪
Get one Assessment of a Vendor Security Review, including the Vendor Document excerpts the agent cited and the criterion requirements it tested.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: Get Assessment permission.


💎 Requires your account have the TPRM Agentic Assessment, AI Data Share feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
The numeric ID of the Vendor.


 
securityReviewId
required
number
The numeric ID of the Vendor Security Review.


 
assessmentId
required
number
The numeric ID of the Assessment.


 
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
The Vendor has no Vendor Security Review with the given securityReviewId, or the review has no Assessment with the given assessmentId


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}/assessments/{assessmentId}
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "vendorSecurityReviewId": 5,
  • "vendorAssessmentCriteriaId": 123,
  • "criteriaName": "My Criteria",
  • "analysisSummary": "Analysis summary content",
  • "originalAgentStatus": "MET",
  • "currentStatus": "MET",
  • "severity": "HIGH",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "sources": [
    • {
      • "documentId": 42,
      • "documentName": "SOC 2 Type II Report.pdf",
      • "documentExcerpt": "All customer data is encrypted at rest using AES-256.",
      • "pageNumber": 12,
      • "referencedOn": "2025-07-01T16:45:55.246Z"
      }
    ],
  • "requirements": [
    • {
      • "question": "Is customer data encrypted at rest?",
      • "explanation": "The SOC 2 report states that customer data is encrypted at rest with AES-256.",
      • "status": "MET",
      • "sources": [
        • {
          • "documentId": 42,
          • "documentName": "SOC 2 Type II Report.pdf",
          • "documentExcerpt": "All customer data is encrypted at rest using AES-256.",
          • "pageNumber": 12,
          • "referencedOn": "2025-07-01T16:45:55.246Z"
          }
        ]
      }
    ]
}
Get Assessments Stats 🧪
Count the Assessments of a Vendor Security Review by current status: met, not met, partially met, inconclusive and not applicable.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: Get Assessments Statistics permission.


💎 Requires your account have the TPRM Agentic Assessment, AI Data Share feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
The numeric ID of the Vendor.


 
securityReviewId
required
number
The numeric ID of the Vendor Security Review.


 
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
The Vendor has no Vendor Security Review with the given securityReviewId


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}/assessments-stats
Request samples 
Response samples 
application/json
{
  • "met": 30,
  • "notMet": 5,
  • "partiallyMet": 4,
  • "inconclusive": 3,
  • "notApplicable": 1,
  • "total": 44
}
List Vendor Security Reviews
Get a paginated list of all Security Reviews for a given Vendor.


🔒 Requires Vendors: List Vendors permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
query Parameters
cursor
string
This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results


 
size
number  [ 1 .. 500 ] 
 Default:  50
Number of results to return


 
sort
string (SortTypeLimitedEnum) 
Which field to sort by


 Enum: "createdAt" "updatedAt"  
sortDir
string (SortDirectionEnum) 
The direction to sort the data


 Enum: "ASC" "DESC"  
includeTotalCount
boolean
Include total count of all matching records in response. Only honored on first page (when cursor is null).


 
 Example:  includeTotalCount=false
status[]
Array of strings (VendorSecurityReviewStatusEnum) 
Filter by security review status


Items Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
type[]
Array of strings (VendorSecurityReviewTypeEnum) 
Filter by security review type


Items Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
decision[]
Array of strings (VendorSecurityReviewDecisionEnum) 
Filter by security review decision


Items Enum: "PENDING" "APPROVED" "APPROVED_WITH_CONDITIONS" "REJECTED"  
expand[]
Array of strings (VendorSecurityReviewExpandEnum) 
List of subcollections and sub-objects to expand


Items Enum: "user" "requesterUser"  
createdAtFrom
string <date> 
Filter to Security Reviews created on or after this value (inclusive).


 
 Example:  createdAtFrom=2020-07-06
createdAtTo
string <date> 
Filter to Security Reviews created on or before this value (inclusive).


 
 Example:  createdAtTo=2020-07-06
updatedAtFrom
string <date> 
Filter to Security Reviews last updated on or after this value (inclusive)


 
 Example:  updatedAtFrom=2020-07-06
updatedAtTo
string <date> 
Filter to Security Reviews last updated on or before this value (inclusive).


 
 Example:  updatedAtTo=2020-07-06
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "requestedAt": "2025-07-01T16:45:55.246Z",
      • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
      • "decision": "APPROVED",
      • "title": "string",
      • "note": "string",
      • "status": "NOT_YET_STARTED",
      • "type": "SECURITY",
      • "createdAt": "2025-07-01T16:45:55.246Z",
      • "updatedAt": "2025-07-01T16:45:55.246Z",
      • "vendorId": 1,
      • "vendor": {
        • "id": 1,
        • "name": "Acme"
        },
      • "userId": 0,
      • "requesterUserId": 0,
      • "user": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "requesterUser": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "_links": {},
      • "socReviewForm": {
        • "readyToFinalize": false,
        • "reviewerInformation": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reviewer": "Jane Doe",
          • "reportIssueDate": "2020-07-06"
          },
        • "complianceScope": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "certification": "SOC_2",
          • "scopeType": "TYPE_2",
          • "auditPeriod": "2020-07-06",
          • "auditPeriodRange": {
            • "start": "2020-07-06",
            • "end": "2020-07-06"
            },
          • "trustServiceCriteria": [
            • "AVAILABILITY"
            ]
          },
        • "reportOpinion": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reportOpinion": "UNQUALIFIED",
          • "encompassBusinessNeeds": true,
          • "followUpActivity": "Schedule a follow-up review in 90 days."
          },
        • "findings": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "findings": [
            • {
              • "description": "Control objective was not met during the audit period."
              }
            ],
          • "hasMaterialImpact": false
          },
        • "endUserControls": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "userControls": [
            • {
              • "description": "Users must enforce strong password policies.",
              • "inPlace": true
              }
            ]
          },
        • "servicesAndLocations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "services": [
            • {
              • "name": "Cloud Hosting"
              }
            ],
          • "locations": [
            • {
              • "city": "Austin",
              • "stateOrCountry": "TX"
              }
            ]
          },
        • "cpaFirm": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "cpaFirm": "Deloitte",
          • "cpaProcedurePerformed": "Assessed reputation via public records."
          },
        • "subserviceOrganizations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "subserviceOrganization": "SubCo Inc.",
          • "subserviceOrganizationUsingInclusiveMethod": true,
          • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
          }
        }
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Create Vendor Security Review
Create a new Security Review for a given Vendor.


🔒 Requires Vendors: Create Security Review permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
Request Body schema: application/json
required
reviewDeadlineAt
required
string <date-time> 
Vendor Security Review deadline date


 
securityReviewStatus
required
string
The status of the Security Review


 Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
securityReviewType
required
string
The type of the Security Review


 Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
requestedAt
string <date-time> 
Vendor Security Review requested date


 
note
string or null  <= 1000 characters 
Vendor Security Review note


 
requesterUserId
number or null  <= 1000000000 
Optional. The user ID of the person that requested the Security Review. If not provided, defaults to: (1) the vendor's security owner if assigned and active, or (2) the platform admin user.


 
title
string or null  <= 191 characters 
Vendor Security Review title


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-reviews
Request samples 
application/json
{
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "securityReviewStatus": "NOT_YET_STARTED",
  • "securityReviewType": "SECURITY",
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "note": "Security Review note",
  • "requesterUserId": 1,
  • "title": "Security Review title"
}
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
Create Vendor Security Review with File
Create a new Security Review for a given Vendor with file upload in a single atomic operation.


🔒 Requires Vendors: Create Security Review permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
Request Body schema: application/json
required
title
required
string  <= 255 characters 
The title of the security review


 
reviewDeadlineAt
required
string <date-time> 
Vendor Security Review deadline date


 
requestedAt
string
The date when the security review was requested


 
securityReviewStatus
required
string
The status of the security review


 Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
securityReviewType
required
string
The type of security review


 Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
requesterUserId
number
Optional. The ID of the user requesting the security review. If not provided, defaults to: (1) the vendor's security owner if assigned and active, or (2) the platform admin user.


 
note
string  <= 1000 characters 
Optional notes for the security review


 
documentType
required
string
The type of document being uploaded


 Enum: "COMPLIANCE_REPORT" "COMPLIANCE_REPORT_REVIEW" "BRIDGE_LETTER" "UPLOADED_COMPLIANCE_REPORT_REVIEW" "QUESTIONNAIRE_ATTACHMENT" "SOC_DOCUMENT" "QUESTIONNAIRE_REPORT" "TRUST_CENTER_PAGE"  
file
required
string <binary> 
File to upload. Accepted file extensions: .pdf, .docx, .odt, .doc, .xlsx, .ods, .pptx, .odp, .gif, .jpg, .jpeg, .png, .csv


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-reviews/with-file
Request samples 
application/json
{
  • "title": "Q4 2024 Security Review",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "requestedAt": "2024-01-01T00:00:00.000Z",
  • "securityReviewStatus": 3,
  • "securityReviewType": 1,
  • "requesterUserId": 123,
  • "note": "Additional notes about the security review",
  • "documentType": 1,
  • "file": "string"
}
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
List Vendor Security Reviews Across Vendors
Get a paginated list of Security Reviews across all Vendors in the account, subject to the caller's vendor access. Supports the same filters as the per-vendor list plus optional vendorIds[] narrowing. When the caller has restricted vendor access, results are limited to the intersection of the vendors they are permitted to see and the (optional) vendorIds[] filter.


🔒 Requires Vendors: List Vendors permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
query Parameters
cursor
string
This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results


 
size
number  [ 1 .. 500 ] 
 Default:  50
Number of results to return


 
sort
string (SortTypeLimitedEnum) 
Which field to sort by


 Enum: "createdAt" "updatedAt"  
sortDir
string (SortDirectionEnum) 
The direction to sort the data


 Enum: "ASC" "DESC"  
includeTotalCount
boolean
Include total count of all matching records in response. Only honored on first page (when cursor is null).


 
 Example:  includeTotalCount=false
status[]
Array of strings (VendorSecurityReviewStatusEnum) 
Filter by security review status


Items Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
type[]
Array of strings (VendorSecurityReviewTypeEnum) 
Filter by security review type


Items Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
decision[]
Array of strings (VendorSecurityReviewDecisionEnum) 
Filter by security review decision


Items Enum: "PENDING" "APPROVED" "APPROVED_WITH_CONDITIONS" "REJECTED"  
expand[]
Array of strings (VendorSecurityReviewsAcrossVendorsExpandEnum) 
List of subcollections and sub-objects to expand


Items Enum: "user" "requesterUser" "vendor"  
createdAtFrom
string <date> 
Filter to Security Reviews created on or after this value (inclusive).


 
 Example:  createdAtFrom=2020-07-06
createdAtTo
string <date> 
Filter to Security Reviews created on or before this value (inclusive).


 
 Example:  createdAtTo=2020-07-06
updatedAtFrom
string <date> 
Filter to Security Reviews last updated on or after this value (inclusive)


 
 Example:  updatedAtFrom=2020-07-06
updatedAtTo
string <date> 
Filter to Security Reviews last updated on or before this value (inclusive).


 
 Example:  updatedAtTo=2020-07-06
vendorIds[]
Array of numbers
Filter to Security Reviews for these Vendor IDs. When the caller has restricted vendor access, the effective set is the intersection of this parameter and their permitted vendors.


 
 Example:  vendorIds[]=1&vendorIds[]=2&vendorIds[]=3
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendor-security-reviews
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "requestedAt": "2025-07-01T16:45:55.246Z",
      • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
      • "decision": "APPROVED",
      • "title": "string",
      • "note": "string",
      • "status": "NOT_YET_STARTED",
      • "type": "SECURITY",
      • "createdAt": "2025-07-01T16:45:55.246Z",
      • "updatedAt": "2025-07-01T16:45:55.246Z",
      • "vendorId": 1,
      • "vendor": {
        • "id": 1,
        • "name": "Acme"
        },
      • "userId": 0,
      • "requesterUserId": 0,
      • "user": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "requesterUser": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "_links": {},
      • "socReviewForm": {
        • "readyToFinalize": false,
        • "reviewerInformation": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reviewer": "Jane Doe",
          • "reportIssueDate": "2020-07-06"
          },
        • "complianceScope": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "certification": "SOC_2",
          • "scopeType": "TYPE_2",
          • "auditPeriod": "2020-07-06",
          • "auditPeriodRange": {
            • "start": "2020-07-06",
            • "end": "2020-07-06"
            },
          • "trustServiceCriteria": [
            • "AVAILABILITY"
            ]
          },
        • "reportOpinion": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reportOpinion": "UNQUALIFIED",
          • "encompassBusinessNeeds": true,
          • "followUpActivity": "Schedule a follow-up review in 90 days."
          },
        • "findings": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "findings": [
            • {
              • "description": "Control objective was not met during the audit period."
              }
            ],
          • "hasMaterialImpact": false
          },
        • "endUserControls": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "userControls": [
            • {
              • "description": "Users must enforce strong password policies.",
              • "inPlace": true
              }
            ]
          },
        • "servicesAndLocations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "services": [
            • {
              • "name": "Cloud Hosting"
              }
            ],
          • "locations": [
            • {
              • "city": "Austin",
              • "stateOrCountry": "TX"
              }
            ]
          },
        • "cpaFirm": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "cpaFirm": "Deloitte",
          • "cpaProcedurePerformed": "Assessed reputation via public records."
          },
        • "subserviceOrganizations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "subserviceOrganization": "SubCo Inc.",
          • "subserviceOrganizationUsingInclusiveMethod": true,
          • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
          }
        }
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Get Vendor Security Review 🧪
Get a specific Security Review for a given Vendor. For SOC_REPORT reviews the response includes a socReview field with the SOC form data.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: List Vendors permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
query Parameters
expand[]
Array of strings (VendorSecurityReviewExpandEnum) 
List of subcollections and sub-objects to expand


Items Enum: "user" "requesterUser"  
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
Update Vendor Security Review 🧪
Update a Vendor Security Review. The title field applies to all security review types. The socForm field is only processed when securityReviewType is SOC_REPORT. The updatedAt field overrides the review's last-updated timestamp (surfaced as the vendor's last review date) and is the only field that may be set on a completed review.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: Update Security Review permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Request Body schema: application/json
required
title
string
The Security Review name.


 
object or null
SOC review form data. Only processed when securityReviewType is SOC_REPORT.


 
updatedAt
string <date-time> 
Overrides the Security Review last-updated timestamp, which is surfaced as the vendor's last review date. Provided to backfill or correct historical review dates. This is the only field that may be set on a completed review. Note that the value is not preserved if the review is edited afterwards.


 
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


put/vendors/{vendorId}/security-reviews/{securityReviewId}
Request samples 
application/json
{
  • "title": "string",
  • "socForm": {
    • "reviewerInformation": {
      • "reviewerUserId": 42,
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "string"
      },
    • "findings": {
      • "findings": [
        • {
          • "description": "string"
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "userControls": [
        • {
          • "description": "string",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "services": [
        • {
          • "name": "string"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "string"
      },
    • "subserviceOrganizations": {
      • "subserviceOrganization": "string",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "string"
      }
    },
  • "updatedAt": "2025-07-01T16:45:55.246Z"
}
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
Upload Security Questionnaire
🔒 Requires Vendors: Upload Security Questionnaire permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
Request Body schema: multipart/form-data
required
files
required
Array of strings <binary> 
Accepted file extensions: .pdf, .docx, .odt, .doc, .xlsx, .ods, .pptx, .odp, .csv


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-questionnaires
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "completedBy": "Acme",
  • "recipientEmail": "[email protected]",
  • "isCompleted": "true",
  • "dateSent": "2025-07-01T16:45:55.246Z",
  • "isManualUpload": "true",
  • "responseId": 1,
  • "title": "Vendor Security Questionnaire",
  • "status": "SENT",
  • "completedAt": "2025-07-01T16:45:55.246Z",
  • "totalQuestions": 10,
  • "totalQuestionsAnswered": 10,
  • "reminderDate": "2025-07-01T16:45:55.246Z"
}
List Security Review Questionnaires 🧪
List the questionnaires that belong to a Vendor Security Review. Cursor-paginated. Archived or soft-deleted questionnaires are excluded from the response.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: List Vendor Questionnaire permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
The numeric ID of the vendor.


 
securityReviewId
required
number
The numeric ID of the security review.


 
query Parameters
cursor
string
This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results


 
size
number  [ 1 .. 500 ] 
 Default:  50
Number of results to return


 
sort
string (SortTypeLimitedEnum) 
Which field to sort by


 Enum: "createdAt" "updatedAt"  
sortDir
string (SortDirectionEnum) 
The direction to sort the data


 Enum: "ASC" "DESC"  
includeTotalCount
boolean
Include total count of all matching records in response. Only honored on first page (when cursor is null).


 
 Example:  includeTotalCount=false
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "completedBy": "Acme",
      • "recipientEmail": "[email protected]",
      • "isCompleted": "true",
      • "dateSent": "2025-07-01T16:45:55.246Z",
      • "isManualUpload": "true",
      • "responseId": 1,
      • "title": "Vendor Security Questionnaire",
      • "status": "SENT",
      • "completedAt": "2025-07-01T16:45:55.246Z",
      • "totalQuestions": 10,
      • "totalQuestionsAnswered": 10,
      • "reminderDate": "2025-07-01T16:45:55.246Z"
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Upload Security Questionnaire
Upload a Security Questionnaire to a Vendor for a specific Security Review.


🔒 Requires Vendors: Upload Security Questionnaire permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Request Body schema: multipart/form-data
required
files
required
Array of strings <binary> 
Accepted file extensions: .pdf, .docx, .odt, .doc, .xlsx, .ods, .pptx, .odp, .csv


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "completedBy": "Acme",
  • "recipientEmail": "[email protected]",
  • "isCompleted": "true",
  • "dateSent": "2025-07-01T16:45:55.246Z",
  • "isManualUpload": "true",
  • "responseId": 1,
  • "title": "Vendor Security Questionnaire",
  • "status": "SENT",
  • "completedAt": "2025-07-01T16:45:55.246Z",
  • "totalQuestions": 10,
  • "totalQuestionsAnswered": 10,
  • "reminderDate": "2025-07-01T16:45:55.246Z"
}
List Security Review Actions 🧪
List available actions for a security review based on its current state (e.g. Finalize, Reopen). Supported for all security review types (SECURITY, SOC_REPORT, UPLOAD_REPORT). SOC_REPORT reviews additionally require the linked vendor report review to pass readiness validation before Finalize is offered.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: List Security Review Actions permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Responses 
200
Successful


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}/actions
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "action": "finalize"
      }
    ]
}
Perform Security Review Action 🧪
Execute an action on a security review. Finalize marks the review as complete and records the reviewer decision (PENDING, APPROVED, APPROVED_WITH_CONDITIONS, or REJECTED); decision defaults to APPROVED when omitted, and PENDING completes the review without recording a conclusion. Reopen returns a completed review to in-progress and, when resetDecision is true, also clears the prior decision back to PENDING. Supported for all security review types (SECURITY, SOC_REPORT, UPLOAD_REPORT).


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: Perform Security Review Action permission.


💎 Requires your account have the TPRM Standard, Third Party Risk Management Pro, TPRM Pro Max feature. Contact your Account Manager for help upgrading.


Securitybearer or oauth2 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Request Body schema: application/json
required
action
required
string
Action to perform on the security review.


 Enum: "finalize" "reopen"  
decision
string
Finalization decision. Only valid when action is finalize. Must be one of PENDING, APPROVED, APPROVED_WITH_CONDITIONS, or REJECTED — the same options the review page offers. PENDING completes the review without recording a conclusion; use the reopen action to return it to in-progress. When omitted on finalize, defaults to APPROVED for backward compatibility.


 Enum: "PENDING" "APPROVED" "APPROVED_WITH_CONDITIONS" "REJECTED"  
note
string  <= 1000 characters 
Optional reviewer note captured with the finalization. Only valid when action is finalize.


 
resetDecision
boolean
When true, reset the decision back to PENDING as part of the reopen. Only valid when action is reopen. Defaults to false, which preserves the prior decision on the reopened review.


 
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


402
You must upgrade your plan to use this feature


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


422
The requested action is not available for the current state of this security review.


500
Internal server error


post/vendors/{vendorId}/security-reviews/{securityReviewId}/actions
Request samples 
application/json
{
  • "action": "finalize",
  • "decision": "APPROVED",
  • "note": "string",
  • "resetDecision": true
}
Response samples 
application/json
{
  • "success": true,
  • "newStatus": "COMPLETED",
  • "message": "Security review finalized successfully"
}