Sign in

v1

latestOpenAPI 3.0.1Vanta Terms of Service2026-07-26327517821.8 KB
Audits

List risks for an audit

Retrieves risk population data for an audit.

This endpoint provides access to the risk records visible to auditors during an audit engagement. Risk data is scoped to a specific risk assessment snapshot identified by the snapshotId parameter.

Only Controlled Audit View (CAV) audits are supported. Full Audit View audits are rejected with 403.

Supports filtering by:

  • search: Searches risk scenario descriptions (case-insensitive)

Results are sorted by identified date (newest first) by default. Use orderBy and orderDirection to customize sorting. Sort parameters must remain consistent across paginated requests.

Uses cursor-based pagination. To paginate:

  1. Make initial request with desired pageSize
  2. Check results.pageInfo.hasNextPage
  3. Use results.pageInfo.endCursor as pageCursor for next request

Rate limit: 10 requests / minute.

get/audits/{auditId}/risks/{snapshotId}

Path parameters

auditIdstring required

The audit ID

snapshotIdstring required

The risk assessment snapshot ID

Query parameters

pageSizeinteger

Controls the maximum number of items returned in one response from the API.

Maximum number of results per page (1-100, default 10)

pageCursorstring

A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.

Pagination cursor from previous response

searchstring

Search term for filtering by risk scenario description

orderBy'inherentRisk' | 'riskId' | 'riskScenario' | 'treatment' | 'residualRisk' | 'reviewStatus' | 'owner' | 'categories' | 'ciaCategories' | 'identified'

Field to sort results by. Allowed: "riskId", "riskScenario", "inherentRisk", "treatment", "residualRisk", "reviewStatus", "owner", "categories", "ciaCategories", "identified". Default: "identified"

orderDirection'asc' | 'desc'

"asc" for ascending, "desc" for descending.

Sort direction: "asc" or "desc". Default: "desc"

Response

Paginated list of risks with pagination metadata

Example response

{
  "results": {
    "data": [
      {
        "id": "5f2c939a52855e725c8d5824",
        "riskId": "RISK-001",
        "riskScenario": "Unauthorized access to production database",
        "likelihood": 4,
        "impact": 5,
        "inherentRisk": 20,
        "residualRisk": 6,
        "owner": {
          "displayName": "Jane Doe",
          "imageUrl": "https://app.vanta.com/avatar.png"
        },
        "categories": [
          "Cryptography",
          "Privacy"
        ],
        "ciaCategories": [
          "CONFIDENTIALITY",
          "INTEGRITY"
        ],
        "linkedControlIds": [
          "control-1",
          "control-2"
        ],
        "identified": "2023-01-15T10:00:00.000Z"
      }
    ]
  }
}