---
title: "List information requests for an audit"
method: GET
path: "/audits/{auditId}/information-requests"
tags: ["Audits"]
---

# List information requests for an audit

`GET /audits/{auditId}/information-requests`

Retrieves a paginated list of all information requests for an audit, enabling
external audit management systems to display and track evidence requests.

This endpoint always includes soft-deleted records (where `deletionDate !== null`).
Clients should check the `deletionDate` field to identify and handle deleted records
appropriately in their systems.

This endpoint supports delta synchronization via the `changedSinceDate` parameter,
allowing efficient polling for changes without retrieving the entire dataset.

Pagination usage:
1. Make initial request with desired `pageSize`
2. Check `results.pageInfo.hasNextPage` to see if more data exists
3. If true, use `results.pageInfo.endCursor` as `pageCursor` in next request
4. Repeat until `hasNextPage` is false

Delta sync usage:
1. Store the timestamp of your last sync
2. Pass that timestamp as `changedSinceDate`
3. Only requests created, modified, or deleted since that timestamp are returned
4. Process updates and soft-deletes by checking the `deletionDate` field
5. Update your last sync timestamp to the current time

Rate limit: 50 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `changedSinceDate` string, date-time

## Response `200`

Ok

- PaginatedResponseInformationRequest
  - `results` object, required
    - `data` InformationRequest[], required
      - `id` string, required — The unique identifier for the information request within Vanta's system. This is the primary identifier used in all API endpoints. Format: ObjectId as a string (e.g., "6890e473dce1da5d8406f5e7")
      - `uniqueId` string, required — External unique ID to prevent duplicates across different audit systems. Used for idempotency when syncing data between external audit management systems and Vanta. Unlike `id`, this value is provided by the external system.
      - `additionalControlIds` string[], required — Additional control IDs beyond those automatically mapped from framework codes. Allows manual association with specific controls when automatic mapping is insufficient. Each ID should reference a valid control in your audit framework.
      - `approvalStatus` 'NEEDS_EVIDENCE' | 'READY_FOR_AUDIT' | 'AUDITOR_APPROVED' | 'AUDITOR_FLAGGED', required — Current approval status of the information request, tracking its lifecycle through the audit process. The status progresses through the workflow: initial state → awaiting review → approved or flagged. Status can move between awaiting review and flagged states as evidence is reviewed and resubmitted.
      - `cadence` 'ANNUALLY' | 'BIANNUALLY' | 'MONTHLY' | 'QUARTERLY', required — Frequency cadence for the information request, indicating how often it recurs.
      - `frameworkCodes` string[], required — The framework codes this request addresses. Links the request to specific compliance requirements. Can be an empty array if no framework codes are associated. These codes correspond to standards like SOC 2, ISO 27001, etc.
      - `description` string, nullable, required — Detailed description explaining what evidence is needed and why. Should provide clear instructions to help the customer understand what to submit.
      - `dueDate` string, date-time, nullable, required — The deadline by which the customer must fulfill this request. Null if no specific deadline is set. Format: ISO 8601 UTC timestamp.
      - `evidenceCaptureDate` string, date-time, nullable, required — The earliest date for which evidence should be captured. Evidence dated before this date may not be accepted. Null if not restricted. Format: ISO 8601 UTC timestamp.
      - `requestId` string, nullable, required — Non-unique external reference ID for this request. Unlike `uniqueId` which must be unique, `requestId` is for display/reference purposes only (e.g., "REQ-123"). Null if not provided.
      - `requestType` 'POINT_IN_TIME' | 'POPULATION' | 'SAMPLE', required — Type of information request, defining what scope of evidence is needed. - POINT_IN_TIME: Evidence for a specific moment (e.g., current state of a policy) - POPULATION: Evidence covering all items in a category (e.g., all employees) - SAMPLE: Evidence for a representative sample (e.g., 10 random customer records)
      - `title` string, required — Short, descriptive title summarizing what is being requested.
      - `creationDate` string, date-time, required — Timestamp when the request was created in the system. Format: ISO 8601 UTC timestamp.
      - `modificationDate` string, date-time, required — Timestamp when the request was last modified. Format: ISO 8601 UTC timestamp.
      - `deletionDate` string, date-time, nullable, required — Timestamp when the request was soft-deleted. Null if the request has not been deleted. Soft deletes allow retaining history while hiding the request from normal operations. Format: ISO 8601 UTC timestamp.
      - `ownerAssignment` union, required — Represents either a user or a team owning a resource.
        - object
          - `displayName` string, required
          - `id` string, required
          - `type` 'user', required
        - object
          - `displayName` string, required
          - `id` string, required
          - `type` 'team', required
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)