Drata API – Beta

Name: Drata API – Beta API
Brand: Drata API – Beta
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityCompliancebearer110 EndpointsREST

For Agents

Manage Drata workspaces, controls, vendors, risk registers, and personnel so an agent can keep continuous compliance state synchronised with external systems.

Install Jentic One Beta

Connect the Drata API – Beta to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Drata API – Beta, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Drata API – Beta API.

Manage Drata workspaces and inspect their compliance scope

List, create, modify, and remove controls within a workspace

Add control notes and assign control owners across the workspace surface

GET STARTED

Start building with Drata API – Beta API

Explore with Jentic

View OpenAPI Document

Drata is a continuous compliance automation platform that monitors security controls across SOC 2, ISO 27001, HIPAA, and other frameworks. The V2 public API exposes 110 operations covering workspaces, controls, control notes and owners, vendors and vendor types, risk registers, personnel, policies, devices, assets, users, roles, and custom connections. Authentication is via a bearer token, suitable for headless ingestion of evidence and synchronisation of compliance state across systems. The spec is currently published as a public beta.

Use Cases

Patterns agents use Drata API – Beta API for, with concrete tasks.

★ Vendor Risk Register Sync

Mirror the company's source-of-truth vendor list into Drata's vendor register so each vendor is reflected against compliance frameworks. The agent calls the workspaces vendor endpoints to upsert vendors and vendor types, keeping risk classifications aligned with procurement state. This avoids drift between Drata and the vendor management spreadsheet.

For each vendor in procurement, upsert a Drata vendor record under the relevant workspace and set its vendor type and risk classification.

Control Ownership Reviews

Run quarterly control ownership reviews by listing controls per workspace, attaching review notes, and updating control owners where ownership has rotated. The agent uses the workspace controls and control owners endpoints to record the review outcome alongside any compensating-control commentary, keeping audit trails inside Drata rather than in scattered spreadsheets.

List controls in workspace 'wsp_42', and for each control with an outdated owner, modify the owners and add a review note dated this quarter.

Personnel and Device Hygiene

Keep Drata's personnel and device evidence current by syncing HRIS leavers and MDM device retirements through the personnel and devices endpoints. The agent removes off-boarded personnel and retires decommissioned devices so compliance evidence reflects the current population, preventing stale findings from blocking SOC 2 readiness.

Pull HRIS leavers, remove their Drata personnel records, and mark associated devices retired through the devices endpoints.

Risk Register Maintenance

Maintain the Drata risk register from incident management or GRC source data so risks are added, updated, and retired in lockstep. The agent uses the risk-registers endpoints to mirror the latest risk state, attach notes from triage reviews, and close out remediated items, giving auditors a current view at any time.

Read the latest risk triage outcomes and update each Drata risk register entry with the new status and remediation note.

AI Agent Compliance Operator

Through Jentic, an AI agent can take 'add this vendor to Drata as high risk' and resolve it to the appropriate Drata vendor creation operation without browsing docs. Jentic injects the bearer token from the vault and validates the input payload against the operation schema. End-to-end setup is under an hour from sign-up versus several days of Drata API plumbing.

Use Jentic search for 'add a Drata vendor', load the matching workspace vendor operation, and execute it with the vendor name, type, and risk classification.

Key Endpoints

110 endpoints — drata is a continuous compliance automation platform that monitors security controls across soc 2, iso 27001, hipaa, and other frameworks.

METHOD

PATH

DESCRIPTION

GET

/workspaces/{workspaceId}/controls

List controls in a workspace

POST

/workspaces/{workspaceId}/controls

Create a control

PUT

/workspaces/{workspaceId}/controls/{controlId}/owners

Modify control owners

POST

/workspaces/{workspaceId}/controls/{controlId}/notes

Create a control note

GET

/assets

List assets

POST

/custom-connections

Create a custom connection

POST

/background-checks

Create a manual background check

GET

/workspaces/{workspaceId}/controls

List controls in a workspace

POST

/workspaces/{workspaceId}/controls

Create a control

PUT

/workspaces/{workspaceId}/controls/{controlId}/owners

Modify control owners

POST

/workspaces/{workspaceId}/controls/{controlId}/notes

Create a control note

GET

/assets

List assets

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Drata bearer tokens are stored encrypted in the Jentic vault and injected into the Authorization header at execution time. Agents receive a scoped reference, never the raw token.

Intent-based discovery

Agents search by intent (e.g. 'add a Drata vendor' or 'list Drata controls') and Jentic returns the matching V2 operation with its input schema. The agent calls the right endpoint without browsing 110-operation docs.

Time to first call

Direct Drata integration: several days for token onboarding, workspace traversal, and idempotent sync logic. Through Jentic: under an hour from sign-up to first vendor or control write.

FAQs

Specific to using Drata API – Beta API through Jentic.

What authentication does the Drata API use?

Drata uses a bearer token in the Authorization header. Through Jentic, that token is stored encrypted in the vault and injected at execution time, so it never appears in the agent's prompt or response.

Can I manage controls programmatically with the Drata API?

Yes. The /workspaces/{workspaceId}/controls endpoints support listing, creating, retrieving, and modifying controls within a workspace. Companion endpoints handle control notes and control owners for review workflows.

How do I add a vendor to Drata through Jentic?

Run pip install jentic, search for 'add a Drata vendor', load the matching vendor creation operation, and execute it with the vendor name, vendor type, and risk classification. Jentic returns the input schema so the agent assembles a valid request without reading docs.

Can I sync personnel and devices into Drata?

Yes. The personnel and devices endpoints allow you to mirror HRIS and MDM data into Drata so its evidence engine sees the current population. This keeps SOC 2 and ISO readiness aligned with the live workforce.

Is the Drata API stable?

The V2 surface is published as a public beta. Track the source-url in the spec and validate changes before relying on the schema in production. Treat schema changes as breaking until the surface graduates from beta.

What are the rate limits for the Drata API?

The published spec does not declare explicit per-endpoint limits. Build retry-with-backoff into the client and treat 429 responses as the signal to slow down. For high-volume sync jobs, contact Drata to confirm thresholds.

Drata API – Beta

Connect the Drata API – Beta to your agent

Capabilities

Start building with Drata API – Beta API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs