---
title: "Evidence status changed"
method: POST
path: "/v1.evidence.status-changed"
tags: ["Evidence"]
---

# Evidence status changed

`POST /v1.evidence.status-changed`

Fires when an existing audit evidence item changes status. This is a status-change event, not a creation event — there is no separate "created" event for audit evidence, so `oldStatus` and `newStatus` always describe a transition of an item that already exists.

**Ready-to-review signal:** a `newStatus` of `READY_FOR_AUDIT` means the customer has provided evidence for the item and it is ready for the auditor to review.

**When it fires:** once per evidence item, each time its status changes. Status can also change on its own as the customer's compliance posture changes, so an item may move from `READY_FOR_AUDIT` back to `NOT_READY_FOR_AUDIT` without an explicit auditor action.

**Status values:**
- `NOT_READY_FOR_AUDIT` — the item is not yet ready for the auditor; required evidence is missing or does not meet the requirement.
- `READY_FOR_AUDIT` — the customer has provided the evidence and it is ready for the auditor to review.
- `ACCEPTED` — the auditor reviewed the item and accepted it.
- `FLAGGED` — the auditor reviewed the item and flagged an issue for the customer to address; once the customer addresses it the item returns to `READY_FOR_AUDIT`.
- `NA` — the item is not applicable to this audit.

A typical lifecycle is `NOT_READY_FOR_AUDIT → READY_FOR_AUDIT → ACCEPTED` (or `→ FLAGGED`, which returns to `READY_FOR_AUDIT` once the customer addresses the issue). `INITIALIZED` is an internal status and is never delivered — `oldStatus` and `newStatus` are always one of the values above.

## Request body

- object
  - `evidence` object, required
    - `id` string, required — The unique identifier of the evidence.
    - `auditId` string, required — The unique identifier of the audit the evidence belongs to.
    - `oldStatus` 'ACCEPTED' | 'FLAGGED' | 'INITIALIZED' | 'NA' | 'NOT_READY_FOR_AUDIT' | 'READY_FOR_AUDIT', required — The status the evidence item was in before the change. `INITIALIZED` is an internal status and is never delivered.
    - `newStatus` 'ACCEPTED' | 'FLAGGED' | 'INITIALIZED' | 'NA' | 'NOT_READY_FOR_AUDIT' | 'READY_FOR_AUDIT', required — The status the evidence item is in after the change. A value of `READY_FOR_AUDIT` means the customer has provided evidence for the item and it is ready for the auditor to review. `INITIALIZED` is an internal status and is never delivered.

## Response `200`

Return any 2xx status within 15 seconds to acknowledge receipt.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)