---
title: "List code changes for an audit"
method: GET
path: "/audits/{auditId}/assets/code-changes"
tags: ["Audits"]
---

# List code changes for an audit

`GET /audits/{auditId}/assets/code-changes`

Retrieves code changes population data for an audit.

This endpoint provides access to code change records (pull requests)
visible to auditors during an audit engagement.

Supports filtering by:
- `search`: Searches code change titles and repository names (case-insensitive)
- `sourcesMatchesAny`: Filters by version control source (accepted values: github, gitlab, bitbucket, azuredevops)
- `closedAfterDate` / `closedBeforeDate`: Filters by the closed date range

Uses cursor-based pagination. To paginate:
1. Make initial request with desired `pageSize`
2. Check `results.pageInfo.hasNextPage`
3. Use `results.pageInfo.endCursor` as `pageCursor` for next request

Results are sorted by closed date (newest first). This sort order is
fixed and cannot be customized via query parameters.

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `search` string
- `sourcesMatchesAny` ApiCodeChangeSource[]
- `closedAfterDate` string, date-time
- `closedBeforeDate` string, date-time

## Response `200`

Paginated list of code changes with pagination metadata

- PaginatedResponseCodeChange
  - `results` object, required
    - `data` CodeChange[], required
      - `id` string, required — Code change record ID - always present.
      - `codeChange` string, required — Code change title (e.g. PR title) - always present.
      - `identifier` string — Code change identifier (e.g. PR number).
      - `service` string — Version control source where the change originated. Known values are listed in {@link ApiCodeChangeSource}; other strings may appear if a new source is onboarded before this enum is updated.
      - `repository` string — Repository name.
      - `openedAt` string, date-time — Date the code change was opened.
      - `closedAt` string, date-time — Date the code change was merged/closed.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)