canonical: https://jentic.com/apis/drata.com/drata # Drata API - Beta Drata is a continuous compliance automation platform that monitors security controls across SOC 2, ISO 27001, HIPAA, and other frameworks. The V2 public API exposes 110 operations covering workspaces, controls, control notes and owners, vendors and vendor types, risk registers, personnel, policies, devices, assets, users, roles, and custom connections. Authentication is via a bearer token, suitable for headless ingestion of evidence and synchronisation of compliance state across systems. The spec is currently published as a public beta. ## For AI agents Manage Drata workspaces, controls, vendors, risk registers, and personnel so an agent can keep continuous compliance state synchronised with external systems. ## Scope Does not run vulnerability scans, generate the audit report PDF, or replace your HRIS as a system of record - use for compliance state management within Drata only. ## Capabilities - Manage Drata workspaces and inspect their compliance scope - List, create, modify, and remove controls within a workspace - Add control notes and assign control owners across the workspace surface - Maintain a vendor register with vendor types, risk profiles, and lifecycle state - Track risk register entries and supporting documentation - Synchronise personnel, policies, devices, and assets that feed Drata's evidence engine - Configure custom connections so non-native systems become evidence sources ## Use cases ### Vendor Risk Register Sync Mirror the company's source-of-truth vendor list into Drata's vendor register so each vendor is reflected against compliance frameworks. The agent calls the workspaces vendor endpoints to upsert vendors and vendor types, keeping risk classifications aligned with procurement state. This avoids drift between Drata and the vendor management spreadsheet. Example prompt: For each vendor in procurement, upsert a Drata vendor record under the relevant workspace and set its vendor type and risk classification. ### Control Ownership Reviews Run quarterly control ownership reviews by listing controls per workspace, attaching review notes, and updating control owners where ownership has rotated. The agent uses the workspace controls and control owners endpoints to record the review outcome alongside any compensating-control commentary, keeping audit trails inside Drata rather than in scattered spreadsheets. Example prompt: List controls in workspace 'wsp_42', and for each control with an outdated owner, modify the owners and add a review note dated this quarter. ### Personnel and Device Hygiene Keep Drata's personnel and device evidence current by syncing HRIS leavers and MDM device retirements through the personnel and devices endpoints. The agent removes off-boarded personnel and retires decommissioned devices so compliance evidence reflects the current population, preventing stale findings from blocking SOC 2 readiness. Example prompt: Pull HRIS leavers, remove their Drata personnel records, and mark associated devices retired through the devices endpoints. ### Risk Register Maintenance Maintain the Drata risk register from incident management or GRC source data so risks are added, updated, and retired in lockstep. The agent uses the risk-registers endpoints to mirror the latest risk state, attach notes from triage reviews, and close out remediated items, giving auditors a current view at any time. Example prompt: Read the latest risk triage outcomes and update each Drata risk register entry with the new status and remediation note. ### AI Agent Compliance Operator Through Jentic, an AI agent can take 'add this vendor to Drata as high risk' and resolve it to the appropriate Drata vendor creation operation without browsing docs. Jentic injects the bearer token from the vault and validates the input payload against the operation schema. End-to-end setup is under an hour from sign-up versus several days of Drata API plumbing. Example prompt: Use Jentic search for 'add a Drata vendor', load the matching workspace vendor operation, and execute it with the vendor name, type, and risk classification. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /workspaces/{workspaceId}/controls | List controls in a workspace | | POST | /workspaces/{workspaceId}/controls | Create a control | | PUT | /workspaces/{workspaceId}/controls/{controlId}/owners | Modify control owners | | POST | /workspaces/{workspaceId}/controls/{controlId}/notes | Create a control note | | GET | /assets | List assets | | POST | /custom-connections | Create a custom connection | | POST | /background-checks | Create a manual background check | ## Key resources - **Workspaces** — Top-level scope for controls, vendors, risk, and personnel. - **Controls** — Manage controls and their notes and owners within a workspace. - **Vendors** — Maintain a vendor register with vendor types and lifecycle state. - **Risk Registers** — Track risks with status, owner, and supporting notes. - **Personnel** — Sync employee population for compliance evidence. - **Devices and Assets** — Track managed devices and assets relevant to compliance scope. - **Custom Connections** — Configure non-native systems as evidence sources. ## Why Jentic - **Setup:** Wiring the Drata API by hand means handling its bearer auth, picking the right regional host across its US, EU, and APAC endpoints, and threading the workspace id through every path yourself. Through Jentic you install once, import Drata from the API Directory, store the token once, and your agent calls it. - **Permission scoping:** Drata puts the workspace id in the URL path (/workspaces/{workspaceId}/controls/...), so a rule can pin your agent to one workspace and the controls under it. You choose the operations it may call, so you can allow reading controls and adding notes while leaving out creating controls or custom connections unless you add them. - **Credential handling:** Your Drata bearer token is stored once, encrypted, by your own Jentic One instance and injected into the Authorization header at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list Drata controls' or 'add a control note', and Jentic returns the matching V2 operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Secureframe API** — Secureframe is a peer compliance automation platform with similar control and evidence coverage; Drata leans into deeper vendor and risk management. - **Snyk API** — Snyk identifies application and dependency vulnerabilities; Drata records them as evidence for compliance frameworks. - **Tenable Attack Surface Management API** — Tenable surfaces external exposure; Drata records the corresponding control and evidence state. ## FAQ ### What authentication does the Drata API use? Drata uses a bearer token in the Authorization header. Through Jentic, that token is stored encrypted in the vault and injected at execution time, so it never appears in the agent's prompt or response. ### Can I manage controls programmatically with the Drata API? Yes. The /workspaces/{workspaceId}/controls endpoints support listing, creating, retrieving, and modifying controls within a workspace. Companion endpoints handle control notes and control owners for review workflows. ### How do I add a vendor to Drata through Jentic? Run pip install jentic, search for 'add a Drata vendor', load the matching vendor creation operation, and execute it with the vendor name, vendor type, and risk classification. Jentic returns the input schema so the agent assembles a valid request without reading docs. ### Can I sync personnel and devices into Drata? Yes. The personnel and devices endpoints allow you to mirror HRIS and MDM data into Drata so its evidence engine sees the current population. This keeps SOC 2 and ISO readiness aligned with the live workforce. ### Is the Drata API stable? The V2 surface is published as a public beta. Track the source-url in the spec and validate changes before relying on the schema in production. Treat schema changes as breaking until the surface graduates from beta. ### What are the rate limits for the Drata API? The published spec does not declare explicit per-endpoint limits. Build retry-with-backoff into the client and treat 429 responses as the signal to slow down. For high-volume sync jobs, contact Drata to confirm thresholds. ### Can I limit what my agent is allowed to do with the Drata API? Yes. Because Jentic One is self-hosted and enforces your own rules, you decide which Drata operations the agent may call: you can allow it to list controls and add control notes while leaving out creating controls or custom connections. Since Drata puts the workspace id in the URL path, such as /workspaces/{workspaceId}/controls, you can also pin the agent to a single workspace and the controls under it. The token your instance holds is only ever attached to the operations you have permitted.