Sign in

v1

latestOpenAPI 3.0.1Vanta Terms of Service2026-07-26327517821.8 KB
Audits

Duplicate an IRL audit

Duplicates an existing IRL audit into a new audit engagement with the supplied displayName, audit dates, early access date, and auditor roster. Company, audit type, and framework are copied from the source audit and cannot be changed.

Each email in allowAuditorEmails must match an active user in the authenticated audit firm's domain. Provision auditors via POST /auditors before referencing them here, or copy emails from GET /audits/{sourceAuditId} → allowAuditorEmails when duplicating with the same roster.

Information requests are copied from the source audit. After duplication:

  • Requests with Vanta evidence will be pre-filled and marked as internal review.

    Review them before sharing with your customer.

  • Requests where evidence was not available or was uploaded externally will need

    evidence added manually.

  • Evidence capture dates and due dates can be modified after duplication.

Rate limit: 10 requests / minute.

post/audits/duplicate

Request body

sourceAuditIdstring required

ID of the source IRL audit to duplicate.

displayNamestring required

Display name for the new audit engagement.

auditStartDatestring date-time required

Start of the audit window for the new audit.

auditEndDatestring date-time required

End of the audit window for the new audit.

earlyAccessStartsAtstring date-time required

When auditors gain access to the new audit.

allowAuditorEmailsstring[] required

Emails of auditors who may access the new audit. Minimum one entry required. Each email must match an active user in the authenticated audit firm's domain.

Response

Ok

idstring required

The unique identifier for the audit.

customerOrganizationNamestring required

The domain name of the customer organization being audited (e.g. vanta.com)

customerDisplayNamestring nullable required

The human readable name of the customer organization being audited (e.g. Vanta)

customerOrganizationIdstring required

The uuid of the customer organization being audited

auditStartDatestring date-time required

The start of the audit window. This is also when data collection for audit starts.

auditEndDatestring date-time required

The end of the audit window.

earlyAccessStartsAtstring date-time nullable required

Timestamp at which auditors gain access to the audit. Occurs before the audit window begins

frameworkstring required

The name of the framework for the audit

displayNamestring required

The display name for the audit. Returns the custom audit name if set, otherwise returns the framework name.

allowAuditorEmailsstring[] required

Emails of auditors with access to audit

allowAllAuditorsboolean required

Set to true if all auditors in audit firm have access

deletionDatestring date-time nullable required

Timestamp when the audit was deleted

creationDatestring date-time required

Timestamp when the audit was created

modificationDatestring date-time nullable required

Timestamp when the audit was updated

completionDatestring date-time nullable required

Timestamp when the audit was marked completed, and report was uploaded

auditFocus'EXTERNAL' | 'INTERNAL' required