--- title: "List evidence for an information request" method: GET path: "/audits/{auditId}/information-requests/{requestId}/evidence" tags: ["Audits"] --- # List evidence for an information request `GET /audits/{auditId}/information-requests/{requestId}/evidence` Retrieves a paginated list of all evidence attached to an information request, enabling auditors to review evidence submitted by customers. This endpoint always includes soft-deleted records (where `deletionDate !== null`). Clients should check the `deletionDate` field to identify and handle deleted records appropriately in their systems. This endpoint supports delta synchronization via the `changedSinceDate` parameter, allowing efficient polling for changes without retrieving the entire dataset. Pagination usage: 1. Make initial request with desired `pageSize` 2. Check `results.pageInfo.hasNextPage` to see if more data exists 3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request 4. Repeat until `hasNextPage` is false Delta sync usage: 1. Store the timestamp of your last sync 2. Pass that timestamp as `changedSinceDate` 3. Only evidence created, modified, shared, or deleted since that timestamp is returned 4. Process updates, including soft-deletes (deletionDate !== null) 5. Update your last sync timestamp to the current time Rate limit: 50 requests / minute. ## Path parameters - `auditId` string, required - `requestId` string, required ## Query parameters - `pageSize` integer — Controls the maximum number of items returned in one response from the API. - `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. - `changedSinceDate` string, date-time - `evidenceTypeMatchesAny` InformationRequestSupportedEvidenceType[] ## Response `200` Ok - PaginatedResponseInformationRequestEvidence - `results` object, required - `data` InformationRequestEvidence[], required - `id` string, required — The unique identifier for the evidence within Vanta's system. Format: ObjectId as a string (e.g., "6890e473dce1da5d8406f5e7"). - `evidenceType` 'UPLOADED_DOCUMENT' | 'OBSERVATION' | 'LINK' | 'VANTA_DOCUMENT' | 'VANTA_POLICY' | 'VANTA_TEST' | 'VANTA_TEST_SNAPSHOT', required - `visibleToAuditorDate` string, date-time, nullable — Timestamp when the evidence was made visible to the auditor. Null if the customer has not yet shared this evidence with the auditor. Evidence must be shared before the auditor can review it. Format: ISO 8601 UTC timestamp. - `creationDate` string, date-time, required — Timestamp when the evidence was created/uploaded. Format: ISO 8601 UTC timestamp. - `modificationDate` string, date-time, required — Timestamp when the evidence was last modified. Format: ISO 8601 UTC timestamp. - `deletionDate` string, date-time, nullable — Timestamp when the evidence was soft-deleted. Null if the evidence has not been deleted. Soft deletes retain evidence in the system for audit history while hiding it from normal operations. Format: ISO 8601 UTC timestamp. - `evidence` union, required — Union type representing the different forms of evidence content. The specific type is determined by the `evidenceType` field in InformationRequestEvidence. - UploadedDocumentEvidence — Evidence in the form of an uploaded document file. The URL is a temporary presigned URL that expires after a certain period. - `id` string, required — The unique identifier for the uploaded document in Vanta's system. - `filename` string — The original filename of the uploaded document. Undefined if the filename was not captured during upload. - `mimeType` string, required — The MIME type of the document indicating its file format. Common types: "application/pdf", "image/png", "image/jpeg", "text/plain" - `url` string, required — A presigned URL for downloading the document. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. - LinkEvidence — Evidence in the form of a link to external documentation or resources. - `title` string, required — The title or descriptive name for the link. - `description` string — Optional description providing additional context about the link. - `url` string, required — The URL pointing to the external documentation or resource. - ObservationEvidence — Evidence in the form of a text observation or note. - `observationDetails` string, required — The text content of the observation. - VantaDocumentEvidence — Evidence in the form of a Vanta Document. Vanta Documents are managed documents with metadata like expiration dates and versioning. They can either be uploaded files stored in Vanta or links to external documentation. - `title` string, required — The title of the document as displayed in Vanta. - `description` string — Optional description providing additional context about the document. - `expirationDate` string, date-time — The date when the document version expires and should be renewed. Undefined if no expiration is set. Format: ISO 8601 UTC timestamp. - `addedBy` object — Information about the user who added this file version to the document. Undefined if the user information is not available. - `email` string, required - `name` string, required - `documentVersionId` string, required — The unique identifier of the document version submitted as evidence. - `file` union, required — The file or link associated with this document version. Use the `type` discriminator to determine whether it's an uploaded file or an external link. - VantaDocumentUploadedEvidence — Represents an uploaded file in a Vanta Document. The file is stored in Vanta's system and accessed via a presigned URL. - … - VantaDocumentLinkEvidence — Represents an external link in a Vanta Document. The link points to documentation hosted outside of Vanta's system. - … - VantaPolicyEvidence — Evidence in the form of a Vanta Policy. Vanta Policies are compliance policies with metadata like locale, effective dates, and versioning. Policies are always uploaded files stored in Vanta's system. - `title` string, required — The title of the policy as displayed in Vanta. - `description` string — Optional description providing additional context about the policy. - `expirationDate` string, date-time — The date when the policy version expires and should be renewed. Undefined if no expiration is set. Format: ISO 8601 UTC timestamp. - `lastEditedBy` object — Information about the user who last edited this policy version. Undefined if the user information is not available. - `email` string, required - `name` string, required - `policyId` string, required — The policy type this evidence belongs to (e.g. "information-security-policy-bsi"). Policies prefixed with "custom-" are customer-defined; others are Vanta-provided templates. - `policyVersionId` string, required — The identifier of the approved policy version that was submitted as evidence. A new version is created each time a policy is updated and approved. - `policyVersionFileId` string, required — The identifier of the locale-specific file within the policy version. Each policy version may contain multiple files, one per supported language. - `file` object, required — The uploaded policy file for this version. - `effectiveOrCreationDate` string, date-time, required — The date when this policy version became effective, or when it was created. Format: ISO 8601 UTC timestamp. - `locale` string, required — The locale/language of the policy document. Examples: "EN" for English, "ES" for Spanish, "FR" for French - `url` string, required — A presigned URL for downloading the policy document. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. - `mimeType` string, required — The MIME type of the policy document indicating its file format. Common types: "application/pdf", "application/msword" - `filename` string — The original filename of the uploaded policy document. Undefined if the filename was not captured during upload. - `id` string, required — The unique identifier for the uploaded policy file in Vanta's system. - VantaTestEvidence — Evidence in the form of a Vanta automated test run. Vanta Tests are automated compliance tests with metadata like test status, execution time, and file type. Tests generate evidence files that can be workpapers, raw data, or API request logs. - `title` string, required — The title of the test run as displayed in Vanta. - `testId` string, required — The unique identifier for the test in Vanta's system. - `snapshotId` string, required — The unique identifier for the point-in-time capture of this test run's evidence. A snapshot is an immutable record of all files (workpapers, raw data, etc.) generated during a single test execution. - `testRunStatus` 'NA' | 'IN_PROGRESS' | 'FAIL' | 'PASS' | 'INVALID' | 'DISABLED', required - `executedAt` string, date-time, required — The date and time when the test was executed. Format: ISO 8601 UTC timestamp. - `fileType` 'TEST_EVIDENCE_WORKPAPER' | 'TEST_RAW_DATA' | 'OUT_OF_SCOPE_RESOURCES' | 'API_REQUESTS', required - `file` object, required — The evidence file for this test run. - `mimeType` string, required — The MIME type of the evidence file. Common types: "application/pdf" for workpapers, "text/csv" for raw data - `url` string, required — A presigned URL for downloading the evidence file. This URL is temporary and expires after a limited time. Request a new evidence list to get a fresh URL if expired. - VantaTestSnapshotEvidence — Evidence in the form of a Vanta automated test run snapshot. Unlike VantaTestEvidence (which represents a single file within a test run's evidence packet), a snapshot represents the entire test-run bundle. Use the dedicated snapshot detail endpoint to retrieve the files associated with a snapshot. - `snapshotId` string, required — The unique identifier for the point-in-time capture of this test run's evidence. A snapshot is an immutable record of all files (workpapers, raw data, etc.) generated during a single test execution. - `testId` string, required — The unique identifier for the test in Vanta's system. - `testRunId` string, required — The unique identifier for the test run this snapshot was captured from. - `testRunTitle` string, required — The title of the test run as displayed in Vanta. - `testRunStatus` 'NA' | 'IN_PROGRESS' | 'FAIL' | 'PASS' | 'INVALID' | 'DISABLED', required — The outcome status of the test run. - `testRunExecutedAt` string, date-time, required — The date and time when the test was executed. Format: ISO 8601 UTC timestamp. - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset. - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor. - `hasNextPage` boolean, required — Indicates if there is another page after the current page. - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page. - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor. --- [API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)