---
title: "List people for an audit"
method: GET
path: "/audits/{auditId}/personnel/people"
tags: ["Audits"]
---

# List people for an audit

`GET /audits/{auditId}/personnel/people`

Retrieves people population data for an audit.

This endpoint provides access to the people records visible to auditors
during an audit engagement. Only Controlled Audit View (CAV) audits
are supported. Full Audit View audits are rejected with 403.

Supports filtering by:
- `search`: Searches names and email addresses
- `status`: Filters by employment status
- `groupsMatchesAny`: Filter people by group/role IDs

Results are sorted by name (ascending) by default.
Use `orderBy` and `orderDirection` to customize sorting.
Sort parameters must remain consistent across paginated requests.

Uses cursor-based pagination. To paginate:
1. Make initial request with desired `pageSize`
2. Check `results.pageInfo.hasNextPage`
3. Use `results.pageInfo.endCursor` as `pageCursor` for next request

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `search` string
- `status` 'CURRENTLY_EMPLOYED' | 'INACTIVE_EMPLOYEE' | 'NOT_PEOPLE' | 'ON_LEAVE' | 'PREVIOUSLY_EMPLOYED' | 'UPCOMING_EMPLOYEE' — Employment status filter for people queries.
- `groupsMatchesAny` string[]
- `orderBy` 'name' | 'employmentStatus'
- `orderDirection` 'asc' | 'desc' — `"asc"` for ascending, `"desc"` for descending.

## Response `200`

Paginated list of people with pagination metadata

- PaginatedResponsePersonnelPerson
  - `results` object, required
    - `data` PersonnelPerson[], required
      - `id` string, required — User ID - always present.
      - `name` string, required — Display name of the person - always present.
      - `email` string, required — Email address of the person - always present.
      - `jobTitle` string, nullable — Job title from HR system, or null if not available.
      - `employmentStatus` 'CURRENTLY_EMPLOYED' | 'INACTIVE_EMPLOYEE' | 'NOT_PEOPLE' | 'ON_LEAVE' | 'PREVIOUSLY_EMPLOYED' | 'UPCOMING_EMPLOYEE' — Employment status filter for people queries.
      - `startDate` string, nullable — Start date in ISO 8601 format (YYYY-MM-DD), or null if not available. Timezone depends on source: UTC if from HR system, customer timezone if manually entered.
      - `endDate` string, nullable — End date in ISO 8601 format (YYYY-MM-DD), or null if currently employed.
      - `groups` object[] — Groups (roles) the person belongs to. Present only when the column is in the response; use an empty array when there are no groups.
        - `name` string, required
      - `source` PeopleSourceInfo — Source information for a person's data. Full Audit View only - omitted in Controlled Audit View.
        - `mainSource` string, required — Main source of user data.
        - `supplementarySource` string, nullable, required — Supplementary source, or null if none.
      - `taskStatus` PeopleTaskStatusInfo — Overall task status information for a person. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'OFFBOARDING_COMPLETE' | 'OFFBOARDING_DUE_SOON' | 'OFFBOARDING_OVERDUE' | 'PAUSED' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Overall user task status.
        - `dueDate` string, nullable, required — Due date for the earliest incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date when all tasks are complete in ISO 8601 format, or null if incomplete.
        - `numTasksCompleted` number, double, nullable, required — Count of completed tasks, or null if not available.
        - `numTasksOverdue` number, double, nullable, required — Count of overdue tasks, or null if not available.
        - `numTasksDueSoon` number, double, nullable, required — Count of tasks due soon, or null if not available.
      - `lastReminded` string, nullable — Last date user was sent an onboarding reminder email in ISO 8601 format, or null if never reminded. Full Audit View only - omitted in Controlled Audit View.
      - `policies` PeopleSecurityTaskDetails — Security task details for a specific task category. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Security task status for individual task categories.
        - `dueDate` string, nullable, required — Due date for incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date for completed task in ISO 8601 format, or null if incomplete.
      - `trainings` PeopleSecurityTaskDetails — Security task details for a specific task category. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Security task status for individual task categories.
        - `dueDate` string, nullable, required — Due date for incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date for completed task in ISO 8601 format, or null if incomplete.
      - `backgroundChecks` PeopleSecurityTaskDetails — Security task details for a specific task category. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Security task status for individual task categories.
        - `dueDate` string, nullable, required — Due date for incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date for completed task in ISO 8601 format, or null if incomplete.
      - `deviceMonitoring` PeopleSecurityTaskDetails — Security task details for a specific task category. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Security task status for individual task categories.
        - `dueDate` string, nullable, required — Due date for incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date for completed task in ISO 8601 format, or null if incomplete.
      - `customOnboarding` PeopleSecurityTaskDetails — Security task details for a specific task category. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Security task status for individual task categories.
        - `dueDate` string, nullable, required — Due date for incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date for completed task in ISO 8601 format, or null if incomplete.
      - `customOffboarding` PeopleSecurityTaskDetails — Security task details for a specific task category. Full Audit View only - omitted in Controlled Audit View.
        - `status` 'NO_SECURITY_TASKS' | 'SECURITY_TASKS_COMPLETE' | 'SECURITY_TASKS_DUE_SOON' | 'SECURITY_TASKS_OVERDUE', required — Security task status for individual task categories.
        - `dueDate` string, nullable, required — Due date for incomplete task in ISO 8601 format, or null if none.
        - `completionDate` string, nullable, required — Completion date for completed task in ISO 8601 format, or null if incomplete.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)