---
title: "List groups for an audit"
method: GET
path: "/audits/{auditId}/personnel/groups"
tags: ["Audits"]
---

# List groups for an audit

`GET /audits/{auditId}/personnel/groups`

Retrieves groups population data for an audit.

This endpoint provides access to the group records visible to auditors
during an audit engagement. Groups represent organizational units that
contain people, either imported from an identity provider (IDP) or
created manually in Vanta.

Only Controlled Audit View (CAV) audits are supported. Full Audit
View audits are rejected with 403.

Supports filtering by:
- `search`: Searches group names (case-insensitive)
- `sourcesMatchesAny`: Filters by IDP source service names

Results are sorted by name (ascending) by default.
Use `orderBy` and `orderDirection` to customize sorting.
Sort parameters must remain consistent across paginated requests.

Uses cursor-based pagination. To paginate:
1. Make initial request with desired `pageSize`
2. Check `results.pageInfo.hasNextPage`
3. Use `results.pageInfo.endCursor` as `pageCursor` for next request

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `search` string
- `sourcesMatchesAny` string[]
- `orderBy` 'name' | 'members' | 'source' | 'tasksLastUpdated' | 'pointOfContact'
- `orderDirection` 'asc' | 'desc' — `"asc"` for ascending, `"desc"` for descending.

## Response `200`

Paginated list of groups with pagination metadata

- PaginatedResponsePersonnelGroup
  - `results` object, required
    - `data` PersonnelGroup[], required
      - `id` string, required — Unique identifier for the group.
      - `name` string, required — Display name of the group.
      - `members` number, double — Number of people in this group within the audit scope.
      - `source` string — The source of this group. For IDP-synced groups, this is the provider name (e.g., "Okta", "Azure AD"). For manually created groups, this is "Vanta".
      - `tasks` PersonnelGroupTask[] — Security tasks enabled for this group, or empty array if not available.
        - `name` string, required — Task name
      - `tasksLastUpdated` string, nullable — When the group's task configuration was last updated, or null if never updated. ISO 8601 format.
      - `pointOfContact` string, nullable — Display name of the group's designated point of contact, or null if not set.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)