Vendor Security Reviews

Vendor Security Reviews track the status of security reviews for Vendors. You can create a security review, upload questionnaires, and track the progress of the review. The help docs have more information.

List Vendor Security Reviews

Get a paginated list of all Security Reviews for a given Vendor.

🔒 Requires Vendors: List Vendors permission.

Securitybearer
Request
path Parameters
vendorId
required
number
query Parameters
cursor
string

This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results

size
number [ 1 .. 500 ]
Default: 50

Number of results to return

sort
string (SortTypeLimitedEnum)

Which field to sort by

Enum: "createdAt" "updatedAt"
sortDir
string (SortDirectionEnum)

The direction to sort the data

Enum: "ASC" "DESC"
includeTotalCount
boolean
Default: false

Include total count of all matching records in response. Only honored on first page (when cursor is null).

Example: includeTotalCount=false
status[]
Array of strings (VendorSecurityReviewStatusEnum)

Filter by security review status

Items Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"
type[]
Array of strings (VendorSecurityReviewTypeEnum)

Filter by security review type

Items Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"
decision[]
Array of strings (VendorSecurityReviewDecisionEnum)

Filter by security review decision

Items Enum: "PENDING" "APPROVED" "APPROVED_WITH_CONDITIONS" "REJECTED"
expand[]
Array of strings (VendorSecurityReviewExpandEnum)

List of subcollections and sub-objects to expand

Items Enum: "user" "requesterUser"
createdAtFrom
string <date>

Filter to Security Reviews created on or after this value (inclusive).

Example: createdAtFrom=2020-07-06
createdAtTo
string <date>

Filter to Security Reviews created on or before this value (inclusive).

Example: createdAtTo=2020-07-06
updatedAtFrom
string <date>

Filter to Security Reviews last updated on or after this value (inclusive)

Example: updatedAtFrom=2020-07-06
updatedAtTo
string <date>

Filter to Security Reviews last updated on or before this value (inclusive).

Example: updatedAtTo=2020-07-06
Responses
200

Successful

400

Malformed data and/or validation errors

401

Invalid Authorization

403

You are not allowed to perform this action

404

Not Found

412

You must accept the Drata terms and conditions to use the API

500

Internal server error

get/vendors/{vendorId}/security-reviews
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "requestedAt": "2025-07-01T16:45:55.246Z",
      • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
      • "decision": "APPROVED",
      • "title": "string",
      • "note": "string",
      • "status": "NOT_YET_STARTED",
      • "type": "SECURITY",
      • "createdAt": "2025-07-01T16:45:55.246Z",
      • "updatedAt": "2025-07-01T16:45:55.246Z",
      • "vendorId": 1,
      • "vendor": {
        • "id": 1,
        • "name": "Acme"
        },
      • "userId": 0,
      • "requesterUserId": 0,
      • "user": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "requesterUser": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "_links": {},
      • "socReviewForm": {
        • "readyToFinalize": false,
        • "reviewerInformation": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reviewer": "Jane Doe",
          • "reportIssueDate": "2020-07-06"
          },
        • "complianceScope": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "certification": "SOC_2",
          • "scopeType": "TYPE_2",
          • "auditPeriod": "2020-07-06",
          • "auditPeriodRange": {
            • "start": "2020-07-06",
            • "end": "2020-07-06"
            },
          • "trustServiceCriteria": [
            • "AVAILABILITY"
            ]
          },
        • "reportOpinion": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reportOpinion": "UNQUALIFIED",
          • "encompassBusinessNeeds": true,
          • "followUpActivity": "Schedule a follow-up review in 90 days."
          },
        • "findings": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "findings": [
            • {
              • "description": "Control objective was not met during the audit period."
              }
            ],
          • "hasMaterialImpact": false
          },
        • "endUserControls": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "userControls": [
            • {
              • "description": "Users must enforce strong password policies.",
              • "inPlace": true
              }
            ]
          },
        • "servicesAndLocations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "services": [
            • {
              • "name": "Cloud Hosting"
              }
            ],
          • "locations": [
            • {
              • "city": "Austin",
              • "stateOrCountry": "TX"
              }
            ]
          },
        • "cpaFirm": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "cpaFirm": "Deloitte",
          • "cpaProcedurePerformed": "Assessed reputation via public records."
          },
        • "subserviceOrganizations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "subserviceOrganization": "SubCo Inc.",
          • "subserviceOrganizationUsingInclusiveMethod": true,
          • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
          }
        }
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Create Vendor Security Review
Create a new Security Review for a given Vendor.


🔒 Requires Vendors: Create Security Review permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
Request Body schema: application/json
required
reviewDeadlineAt
required
string <date-time> 
Vendor Security Review deadline date


 
securityReviewStatus
required
string
The status of the Security Review


 Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
securityReviewType
required
string
The type of the Security Review


 Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
requestedAt
string <date-time> 
Vendor Security Review requested date


 
note
string or null  <= 1000 characters 
Vendor Security Review note


 
requesterUserId
number or null  <= 1000000000 
Optional. The user ID of the person that requested the Security Review. If not provided, defaults to: (1) the vendor's security owner if assigned and active, or (2) the platform admin user.


 
title
string or null  <= 191 characters 
Vendor Security Review title


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-reviews
Request samples 
application/json
{
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "securityReviewStatus": "NOT_YET_STARTED",
  • "securityReviewType": "SECURITY",
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "note": "Security Review note",
  • "requesterUserId": 1,
  • "title": "Security Review title"
}
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
Create Vendor Security Review with File
Create a new Security Review for a given Vendor with file upload in a single atomic operation.


🔒 Requires Vendors: Create Security Review permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
Request Body schema: application/json
required
title
required
string  <= 255 characters 
The title of the security review


 
reviewDeadlineAt
required
string <date-time> 
Vendor Security Review deadline date


 
requestedAt
string
The date when the security review was requested


 
securityReviewStatus
required
string
The status of the security review


 Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
securityReviewType
required
string
The type of security review


 Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
requesterUserId
number
Optional. The ID of the user requesting the security review. If not provided, defaults to: (1) the vendor's security owner if assigned and active, or (2) the platform admin user.


 
note
string  <= 1000 characters 
Optional notes for the security review


 
documentType
string
The type of document being uploaded


 Enum: "COMPLIANCE_REPORT" "COMPLIANCE_REPORT_REVIEW" "BRIDGE_LETTER" "UPLOADED_COMPLIANCE_REPORT_REVIEW" "QUESTIONNAIRE_ATTACHMENT" "SOC_DOCUMENT" "QUESTIONNAIRE_REPORT"  
file
required
string <binary> 
File to upload. Accepted file extensions: .pdf, .docx, .odt, .doc, .xlsx, .ods, .pptx, .odp, .gif, .jpg, .jpeg, .png, .csv


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-reviews/with-file
Request samples 
application/json
{
  • "title": "Q4 2024 Security Review",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "requestedAt": "2024-01-01T00:00:00.000Z",
  • "securityReviewStatus": 3,
  • "securityReviewType": 1,
  • "requesterUserId": 123,
  • "note": "Additional notes about the security review",
  • "documentType": 1,
  • "file": "string"
}
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
List Vendor Security Reviews Across Vendors
Get a paginated list of Security Reviews across all Vendors in the account, subject to the caller's vendor access. Supports the same filters as the per-vendor list plus optional vendorIds[] narrowing. When the caller has restricted vendor access, results are limited to the intersection of the vendors they are permitted to see and the (optional) vendorIds[] filter.


🔒 Requires Vendors: List Vendors permission.


Securitybearer 
Request 
query Parameters
cursor
string
This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results


 
size
number  [ 1 .. 500 ] 
 Default:  50
Number of results to return


 
sort
string (SortTypeLimitedEnum) 
Which field to sort by


 Enum: "createdAt" "updatedAt"  
sortDir
string (SortDirectionEnum) 
The direction to sort the data


 Enum: "ASC" "DESC"  
includeTotalCount
boolean
 Default:  false
Include total count of all matching records in response. Only honored on first page (when cursor is null).


 
 Example:  includeTotalCount=false
status[]
Array of strings (VendorSecurityReviewStatusEnum) 
Filter by security review status


Items Enum: "NOT_YET_STARTED" "IN_PROGRESS" "COMPLETED" "NOT_REQUIRED"  
type[]
Array of strings (VendorSecurityReviewTypeEnum) 
Filter by security review type


Items Enum: "SECURITY" "SOC_REPORT" "UPLOAD_REPORT"  
decision[]
Array of strings (VendorSecurityReviewDecisionEnum) 
Filter by security review decision


Items Enum: "PENDING" "APPROVED" "APPROVED_WITH_CONDITIONS" "REJECTED"  
expand[]
Array of strings (VendorSecurityReviewsAcrossVendorsExpandEnum) 
List of subcollections and sub-objects to expand


Items Enum: "user" "requesterUser" "vendor"  
createdAtFrom
string <date> 
Filter to Security Reviews created on or after this value (inclusive).


 
 Example:  createdAtFrom=2020-07-06
createdAtTo
string <date> 
Filter to Security Reviews created on or before this value (inclusive).


 
 Example:  createdAtTo=2020-07-06
updatedAtFrom
string <date> 
Filter to Security Reviews last updated on or after this value (inclusive)


 
 Example:  updatedAtFrom=2020-07-06
updatedAtTo
string <date> 
Filter to Security Reviews last updated on or before this value (inclusive).


 
 Example:  updatedAtTo=2020-07-06
vendorIds[]
Array of numbers  unique 
Filter to Security Reviews for these Vendor IDs. When the caller has restricted vendor access, the effective set is the intersection of this parameter and their permitted vendors.


 
 Example:  vendorIds[]=1&vendorIds[]=2&vendorIds[]=3
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendor-security-reviews
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "requestedAt": "2025-07-01T16:45:55.246Z",
      • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
      • "decision": "APPROVED",
      • "title": "string",
      • "note": "string",
      • "status": "NOT_YET_STARTED",
      • "type": "SECURITY",
      • "createdAt": "2025-07-01T16:45:55.246Z",
      • "updatedAt": "2025-07-01T16:45:55.246Z",
      • "vendorId": 1,
      • "vendor": {
        • "id": 1,
        • "name": "Acme"
        },
      • "userId": 0,
      • "requesterUserId": 0,
      • "user": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "requesterUser": {
        • "id": 1,
        • "email": "[email protected]",
        • "firstName": "Sally",
        • "lastName": "Smith",
        • "createdAt": "2025-07-01T16:45:55.246Z",
        • "updatedAt": "2025-07-01T16:45:55.246Z"
        },
      • "_links": {},
      • "socReviewForm": {
        • "readyToFinalize": false,
        • "reviewerInformation": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reviewer": "Jane Doe",
          • "reportIssueDate": "2020-07-06"
          },
        • "complianceScope": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "certification": "SOC_2",
          • "scopeType": "TYPE_2",
          • "auditPeriod": "2020-07-06",
          • "auditPeriodRange": {
            • "start": "2020-07-06",
            • "end": "2020-07-06"
            },
          • "trustServiceCriteria": [
            • "AVAILABILITY"
            ]
          },
        • "reportOpinion": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "reportOpinion": "UNQUALIFIED",
          • "encompassBusinessNeeds": true,
          • "followUpActivity": "Schedule a follow-up review in 90 days."
          },
        • "findings": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "findings": [
            • {
              • "description": "Control objective was not met during the audit period."
              }
            ],
          • "hasMaterialImpact": false
          },
        • "endUserControls": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "userControls": [
            • {
              • "description": "Users must enforce strong password policies.",
              • "inPlace": true
              }
            ]
          },
        • "servicesAndLocations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "services": [
            • {
              • "name": "Cloud Hosting"
              }
            ],
          • "locations": [
            • {
              • "city": "Austin",
              • "stateOrCountry": "TX"
              }
            ]
          },
        • "cpaFirm": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "cpaFirm": "Deloitte",
          • "cpaProcedurePerformed": "Assessed reputation via public records."
          },
        • "subserviceOrganizations": {
          • "isComplete": false,
          • "missingRequiredFields": [
            • "reviewerInformation.reviewer"
            ],
          • "subserviceOrganization": "SubCo Inc.",
          • "subserviceOrganizationUsingInclusiveMethod": true,
          • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
          }
        }
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Get Vendor Security Review 🧪
Get a specific Security Review for a given Vendor. For SOC_REPORT reviews the response includes a socReview field with the SOC form data.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: List Vendors permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
query Parameters
expand[]
Array of strings (VendorSecurityReviewExpandEnum) 
List of subcollections and sub-objects to expand


Items Enum: "user" "requesterUser"  
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
Update Vendor Security Review 🧪
Update a Vendor Security Review. The title field applies to all security review types. The socForm field is only processed when securityReviewType is SOC_REPORT.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: Update Security Review permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Request Body schema: application/json
required
title
string  <= 191 characters 
The Security Review name.


 
object or null
SOC review form data. Only processed when securityReviewType is SOC_REPORT.


 
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


put/vendors/{vendorId}/security-reviews/{securityReviewId}
Request samples 
application/json
{
  • "title": "string",
  • "socForm": {
    • "reviewerInformation": {
      • "reviewerUserId": 42,
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "string"
      },
    • "findings": {
      • "findings": [
        • {
          • "description": "string"
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "userControls": [
        • {
          • "description": "string",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "services": [
        • {
          • "name": "string"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "string"
      },
    • "subserviceOrganizations": {
      • "subserviceOrganization": "string",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "string"
      }
    }
}
Response samples 
application/json
{
  • "id": 1,
  • "requestedAt": "2025-07-01T16:45:55.246Z",
  • "reviewDeadlineAt": "2025-07-01T16:45:55.246Z",
  • "decision": "APPROVED",
  • "title": "string",
  • "note": "string",
  • "status": "NOT_YET_STARTED",
  • "type": "SECURITY",
  • "createdAt": "2025-07-01T16:45:55.246Z",
  • "updatedAt": "2025-07-01T16:45:55.246Z",
  • "vendorId": 1,
  • "vendor": {
    • "id": 1,
    • "name": "Acme"
    },
  • "userId": 0,
  • "requesterUserId": 0,
  • "user": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "requesterUser": {
    • "id": 1,
    • "email": "[email protected]",
    • "firstName": "Sally",
    • "lastName": "Smith",
    • "createdAt": "2025-07-01T16:45:55.246Z",
    • "updatedAt": "2025-07-01T16:45:55.246Z"
    },
  • "_links": {},
  • "socReviewForm": {
    • "readyToFinalize": false,
    • "reviewerInformation": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reviewer": "Jane Doe",
      • "reportIssueDate": "2020-07-06"
      },
    • "complianceScope": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "certification": "SOC_2",
      • "scopeType": "TYPE_2",
      • "auditPeriod": "2020-07-06",
      • "auditPeriodRange": {
        • "start": "2020-07-06",
        • "end": "2020-07-06"
        },
      • "trustServiceCriteria": [
        • "AVAILABILITY"
        ]
      },
    • "reportOpinion": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "reportOpinion": "UNQUALIFIED",
      • "encompassBusinessNeeds": true,
      • "followUpActivity": "Schedule a follow-up review in 90 days."
      },
    • "findings": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "findings": [
        • {
          • "description": "Control objective was not met during the audit period."
          }
        ],
      • "hasMaterialImpact": false
      },
    • "endUserControls": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "userControls": [
        • {
          • "description": "Users must enforce strong password policies.",
          • "inPlace": true
          }
        ]
      },
    • "servicesAndLocations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "services": [
        • {
          • "name": "Cloud Hosting"
          }
        ],
      • "locations": [
        • {
          • "city": "Austin",
          • "stateOrCountry": "TX"
          }
        ]
      },
    • "cpaFirm": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "cpaFirm": "Deloitte",
      • "cpaProcedurePerformed": "Assessed reputation via public records."
      },
    • "subserviceOrganizations": {
      • "isComplete": false,
      • "missingRequiredFields": [
        • "reviewerInformation.reviewer"
        ],
      • "subserviceOrganization": "SubCo Inc.",
      • "subserviceOrganizationUsingInclusiveMethod": true,
      • "subserviceOrganizationProcedurePerformed": "Reviewed available SOC reports."
      }
    }
}
Upload Security Questionnaire
🔒 Requires Vendors: Upload Security Questionnaire permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
Request Body schema: multipart/form-data
required
files
required
Array of strings <binary> 
Accepted file extensions: .pdf, .docx, .odt, .doc, .xlsx, .ods, .pptx, .odp, .csv


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-questionnaires
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "completedBy": "Acme",
  • "recipientEmail": "[email protected]",
  • "isCompleted": "true",
  • "dateSent": "2025-07-01T16:45:55.246Z",
  • "isManualUpload": "true",
  • "responseId": 1,
  • "title": "Vendor Security Questionnaire"
}
List Security Review Questionnaires 🧪
List the questionnaires that belong to a Vendor Security Review. Cursor-paginated. Archived or soft-deleted questionnaires are excluded from the response.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: List Vendor Questionnaire permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
The numeric ID of the vendor.


 
securityReviewId
required
number
The numeric ID of the security review.


 
query Parameters
cursor
string
This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results


 
size
number  [ 1 .. 500 ] 
 Default:  50
Number of results to return


 
sort
string (SortTypeLimitedEnum) 
Which field to sort by


 Enum: "createdAt" "updatedAt"  
sortDir
string (SortDirectionEnum) 
The direction to sort the data


 Enum: "ASC" "DESC"  
includeTotalCount
boolean
 Default:  false
Include total count of all matching records in response. Only honored on first page (when cursor is null).


 
 Example:  includeTotalCount=false
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "completedBy": "Acme",
      • "recipientEmail": "[email protected]",
      • "isCompleted": "true",
      • "dateSent": "2025-07-01T16:45:55.246Z",
      • "isManualUpload": "true",
      • "responseId": 1,
      • "title": "Vendor Security Questionnaire"
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}
Upload Security Questionnaire
Upload a Security Questionnaire to a Vendor for a specific Security Review.


🔒 Requires Vendors: Upload Security Questionnaire permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Request Body schema: multipart/form-data
required
files
required
Array of strings <binary> 
Accepted file extensions: .pdf, .docx, .odt, .doc, .xlsx, .ods, .pptx, .odp, .csv


 
Responses 
201
Created


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


post/vendors/{vendorId}/security-reviews/{securityReviewId}/security-questionnaires
Request samples 
Response samples 
application/json
{
  • "id": 1,
  • "completedBy": "Acme",
  • "recipientEmail": "[email protected]",
  • "isCompleted": "true",
  • "dateSent": "2025-07-01T16:45:55.246Z",
  • "isManualUpload": "true",
  • "responseId": 1,
  • "title": "Vendor Security Questionnaire"
}
List Security Review Actions 🧪
List available actions for a security review based on its current state (e.g. Finalize, Reopen). Supported for all security review types (SECURITY, SOC_REPORT, UPLOAD_REPORT). SOC_REPORT reviews additionally require the linked vendor report review to pass readiness validation before Finalize is offered.


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: List Security Review Actions permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Responses 
200
Successful


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


500
Internal server error


get/vendors/{vendorId}/security-reviews/{securityReviewId}/actions
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "action": "finalize"
      }
    ]
}
Perform Security Review Action 🧪
Execute an action on a security review. Finalize marks the review as complete and records the reviewer decision (APPROVED, APPROVED_WITH_CONDITIONS, or REJECTED); decision defaults to APPROVED when omitted. PENDING is not accepted; use Reopen instead if the reviewer needs to return the review to in-progress. Reopen returns a completed review to in-progress and, when resetDecision is true, also clears the prior decision back to PENDING. Supported for all security review types (SECURITY, SOC_REPORT, UPLOAD_REPORT).


🧪 Note: This endpoint is in beta and may change.


🔒 Requires Vendors: Perform Security Review Action permission.


Securitybearer 
Request 
path Parameters
vendorId
required
number
 
securityReviewId
required
number
 
Request Body schema: application/json
required
action
required
string
Action to perform on the security review.


 Enum: "finalize" "reopen"  
decision
string
Finalization decision. Only valid when action is finalize. Must be one of APPROVED, APPROVED_WITH_CONDITIONS, or REJECTED. PENDING is intentionally not accepted; use the reopen action if the reviewer needs to return the review to in-progress. When omitted on finalize, defaults to APPROVED for backward compatibility.


 Enum: "APPROVED" "APPROVED_WITH_CONDITIONS" "REJECTED"  
note
string  <= 1000 characters 
Optional reviewer note captured with the finalization. Only valid when action is finalize.


 
resetDecision
boolean
When true, reset the decision back to PENDING as part of the reopen. Only valid when action is reopen. Defaults to false, which preserves the prior decision on the reopened review.


 
Responses 
200
Successful


400
Malformed data and/or validation errors


401
Invalid Authorization


403
You are not allowed to perform this action


404
Not Found


412
You must accept the Drata terms and conditions to use the API


422
The requested action is not available for the current state of this security review.


500
Internal server error


post/vendors/{vendorId}/security-reviews/{securityReviewId}/actions
Request samples 
application/json
{
  • "action": "finalize",
  • "decision": "APPROVED",
  • "note": "string",
  • "resetDecision": true
}
Response samples 
application/json
{
  • "success": true,
  • "newStatus": "COMPLETED",
  • "message": "Security review finalized successfully"
}