{"content":[{"text":"total 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 23 04:08 ..\ndrwxr-xr-x 8 root root 4096 Sep 18 08:00 .git\n-rw-r--r-- 1 root root  408 Sep 18 08:00 .gitignore\n9ebf5fb Initial workspace\n","type":"text"}]}

cd /sandbox/repo && cat .gitignore; timeout 12 curl -sS -o /dev/null -w "%{http_code}\n" https://api.vanta.com/ 2>&1; timeout 12 curl -sS -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/vanta 2>&1; env | grep -i -E "vanta|api_key|token" | sed 's/=.*/=<set>/'

{"content":[{"text":"# Keep generated and vendored files out of source diffs.\n\n# Logs / OS cruft\n*.log\n.DS_Store\n\n# JavaScript / TypeScript\nnode_modules/\n.next/\ndist/\nbuild/\ncoverage/\n\n# Python\n.venv/\nvenv/\n__pycache__/\n*.py[cod]\n.pytest_cache/\n*.egg-info/\n\n# Rust\ntarget/\n\n# Go / PHP / Ruby vendored deps\nvendor/\n.bundle/\n\n# Java / Kotlin / Scala\n.gradle/\n\n# .NET\nbin/\nobj/\n\n# Elixir\n_build/\ndeps/\n\n# Dart / Flutter\n.dart_tool/\n401\n200\nPI_GATEWAY_API_KEY=<set>\n","type":"text"}]}

{"content":[{"text":"{\"_id\":\"vanta\",\"_rev\":\"45-fd330dba34665b6d3e3cfd28d79dc8d4\",\"name\":\"vanta\",\"dist-tags\":{\"latest\":\"0.5.24\"},\"versions\":{\"0.0.1\":{\"name\":\"vanta\",\"version\":\"0.0.1\",\"description\":\"3D animated backgrounds for your website\",\"main\":\"src/_base.js\",\"scripts\":{},\"repository\":{\"type\":\"git\",\"url\":\"git+https://github.com/tengbao/vanta.git\"},\"keywords\":[\"animation\",\"3d\",\"three\",\"threejs\",\"background\",\"canvas\",\"javascript\",\"webgl\"],\"author\":{\"name\":\"Teng Bao\"},\"license\":\"ISC\",\"bugs\":{\"url\":\"https://github.com/tengbao/vanta/issues\"},\"homepage\":\"https://github.com/tengbao/vanta#readme\",\"_id\":\"vanta@0.0.1\",\"_np\n---npm cli---\n10.9.8\n","type":"text"}]}

cd /tmp && for u in "https://www.vanta.com/pricing" "https://developer.vanta.com/" "https://cdn.jsdelivr.net/npm/vanta@0.5.24/dist/vanta.waves.min.js" "https://cdnjs.cloudflare.com/ajax/libs/three.js/r134/three.min.js"; do echo -n "$u -> "; timeout 15 curl -sS -o /dev/null -w "%{http_code} %{size_download}\n" -L "$u"; done

{"content":[{"text":"https://www.vanta.com/pricing -> 200 588419\nhttps://developer.vanta.com/ -> 200 332708\nhttps://cdn.jsdelivr.net/npm/vanta@0.5.24/dist/vanta.waves.min.js -> 200 11819\nhttps://cdnjs.cloudflare.com/ajax/libs/three.js/r134/three.min.js -> 200 615601\n","type":"text"}]}

timeout 20 curl -sS -L "https://www.vanta.com/pricing" 2>/dev/null | python3 -c "import sys,re,html; t=sys.stdin.read(); t=re.sub(r'<script.*?</script>','',t,flags=re.S); t=re.sub(r'<style.*?</style>','',t,flags=re.S); t=re.sub(r'<[^>]+>',' ',t); t=html.unescape(t); t=re.sub(r'\s+',' ',t); print(t[:2500])"

{"content":[{"text":" Plans and Pricing Platform Products Platform Compliance Get compliant quickly and painlessly with automation. Continuous GRC Join the modern way to GRC. Personnel and Access Easily control user access and permissions. Risk Management Proactively manage risk to drive smarter decisions. Third Party Risk Management Manage vendor onboarding and security reviews in one place. Questionnaire Automation Automate security questionnaire responses. Trust Center Showcase your compliance status and documentation. Streamlined audits Automate audit prep and evidence collection. Customer Commitments Centralize, track and act on every customer commitment. AI Governance Govern AI as fast as you adopt it. Vanta AI Automate compliance and uncover insights with AI. Agentic Trust Platform Build and prove trust from a single, unified platform. Integrations Automatically pull data from 400+ tools. Vanta API Build custom integrations and workflows. NEW RELEASE See what's new from Vanta Delivers Learn more PRODUCTS Compliance Get compliant quickly and painlessly with automation. Personnel and Access Easily control user access and permissions. Risk Management Proactively manage risk to drive smarter decisions. Third Party Risk Management Manage vendor onboarding and security reviews in one place. Questionnaire Automation Automate security questionnaire responses. Trust Center Showcase your compliance status and documentation. Streamlined audits Automate audit prep and evidence collection. Customer Commitments Centralize, track and act on every customer commitment. AI Governance Govern AI as fast as you adopt it. Vanta AI Automate compliance and uncover insights with AI. PLATFORM See an interactive demo Agentic Trust Platform Build and prove trust from a single, unified platform. Integrations Automatically pull data from [integrations_count] tools. Vanta API Build custom integrations and workflows. Solutions Size Industry Frameworks Find a partner Startups Automate compliance so you can keep building. Mid-market Expand your security and compliance program as you scale. Enterprise Gain a unified view of your compliance, security, and trust workflows. Vanta is the one-stop shop that helps us scale as a business. The future of Vanta is an exciting one for us. Paul Yoo Head of Platform Security Healthcare Protect sensitive info more easily by automating HIPAA and HITRUST. Government Proactively monitor emerging threats and automate security workflows. Fintech Stay ahead of evolving regu\n","type":"text"}]}

cd /tmp && timeout 20 curl -sS -L "https://www.vanta.com/pricing" 2>/dev/null > vp.html; python3 -c "
import re,html
t=open('/tmp/vp.html',encoding='utf-8',errors='ignore').read()
t=re.sub(r'<script.*?</script>','',t,flags=re.S); t=re.sub(r'<style.*?</style>','',t,flags=re.S)
t=re.sub(r'<[^>]+>',' ',t); t=html.unescape(t); t=re.sub(r'\s+',' ',t)
i=t.lower().find('pricing')
for kw in ['\$','/year','per year','quote','Talk to sales','Starts at','annual']:
    for m in re.finditer(re.escape(kw),t):
        s=max(0,m.start()-160); print('KW',kw,'::',t[s:m.start()+160].strip()[:320]); print('--')
        break
print('LEN',len(t))
print(t[3000:6000])
"

{"content":[{"text":"KW per year :: ho want to build trust and credibility early. Everything in Essentials, and: Automated policy onboarding AI-powered Questionnaire Automation (25 questionnaires per year) Access Management Most popular Professional Compliance, risk, and reporting all in one package—for organizations who want to scale their trust program\n--\nLEN 18881\nate compliance so you can keep building. Mid-market Expand your security and compliance program as you scale. Enterprise Gain a unified view of your compliance, security, and trust workflows. “ Vanta just worked out of the box. It pulled in the right data and gave us a solid foundation for a secure, audit-ready program.” Industry Healthcare Protect sensitive info more easily by automating HIPAA and HITRUST. Government Proactively monitor emerging threats and automate security workflows. Fintech Stay ahead of evolving regulations and keep financial data secure with ease. How Ramp keeps its global financial operations platform compliant with Vanta Frameworks SOC 2 ISO 27001 GDPR HIPAA HITRUST USDP NIST AI Risk Management Framework ISO 42001 Custom frameworks All frameworks Find a partner Service provider directory Discover world-class service providers. Auditor directory Connect with top compliance auditors. AWS Continuous compliance for teams building with AWS Partners Partner program overview Set yourself apart with Vanta. Service providers Build, scale, and grow your business. Auditors Elevate your clients' experiences. Partner program overview Set yourself apart with Vanta. Service providers Build, scale, and grow your business. Auditors Elevate your clients' experiences. We don’t partner with anyone else. We’ve gone all in on Vanta. Steve Spence CEO Resources Customers Company Compliance resources All resources Customer stories Hear from leaders who trust Vanta Help center Find the help you need to get started with Vanta. Vanta Academy Deepen your security knowledge and learn new skills. Vanta Community Connect with fellow Vanta users and security experts. Instructor-led training Live, interactive training to help you master the product and progress quickly. About Learn more about Vanta. Security Understand Vanta's security and compliance strategy. Press See the latest in Vanta news and press releases. Careers Join our team! SOC 2 Learn everything you need to know about SOC 2. Trust Get the guide to all things trust. HIPAA Get the guide for HIPAA compliance. TPRM Implement and optimize your TPRM program. GRC Implement a GRC program with ease. ISO 27001 Get the guide to ISO 27001 certification. ISO 42001 Get your resource for ISO 42001 certification. GDPR Get the guide to GDPR compliance. CMMC Hear from leaders who trust Vanta Cyber essentials Get the guide to Cyber Essentials certification. HITRUST Get the guide to HITRUST certification. FedRAMP Get the guide to FedRAMP compliance. All resources Find all your security and compliance content here. Blog Explore security trends and thought leadership. Guides and reports Find ebooks, checklists, whitepapers, and more. Events Watch on-demand webinars on trending security topics. Videos Watch videos on security trends and expert insights Product updates See what's new across the Vanta platform. Register for the event -> NEW RELEASE See what's new from Vanta Delivers Learn more Customers Customer sto\n","type":"text"}]}

cd /tmp && timeout 20 curl -sS -L "https://developer.vanta.com/docs/getting-started" -o vd.html -w "%{http_code}\n"; python3 -c "
import re,html
t=open('/tmp/vd.html',encoding='utf-8',errors='ignore').read()
t=re.sub(r'<script.*?</script>','',t,flags=re.S); t=re.sub(r'<style.*?</style>','',t,flags=re.S)
t=re.sub(r'<[^>]+>',' ',t); t=html.unescape(t); t=re.sub(r'\s+',' ',t)
print(t[:2500])
"

cd /tmp && python3 -c "
import re,html
t=open('/tmp/vp.html',encoding='utf-8',errors='ignore').read()
t=re.sub(r'<script.*?</script>','',t,flags=re.S); t=re.sub(r'<style.*?</style>','',t,flags=re.S)
t=re.sub(r'<[^>]+>',' ',t); t=html.unescape(t); t=re.sub(r'\s+',' ',t)
i=t.find('Everything in Essentials')
print(t[max(0,i-1800):i+2500])
print('DOLLARS:', re.findall(r'\\\$\s?[\d,]+', t)[:20])
"

{"content":[{"text":" the guide to ISO 27001 certification. ISO 42001 Get your resource for ISO 42001 certification. GDPR Get the guide to GDPR compliance. Cyber essentials Get the guide to Cyber Essentials certification. HITRUST Get the guide to HITRUST certification. FedRAMP Get the guide to FedRAMP compliance. All resources All resources Find all your security and compliance content here. Blog Explore security trends and thought leadership. Guides and reports Find ebooks, checklists, whitepapers, and more. Events Watch webinars and videos on trending security topics. Product updates See what's new across the Vanta platform. Plans Log in Log in Get a demo Get a demo Explore Plans Find your plan Ready for every stage Our agentic trust platform helps you reach your goals at any scale. Request a free demo today to discuss your business needs and get personalized pricing. Our agentic trust platform helps you reach your goals at any scale. Request a free demo today to discuss your business needs and get personalized pricing. Get personalized pricing Get personalized pricing Essentials The fastest, simplest path to compliance—for companies who want to stay focused on building. One compliance framework with agentic policy generator Vanta AI Agent, including agentic search and asking questions (across policies, controls, frameworks, tests, documents), evidence checks, policy template library, policy control mapping, evidence collection, and SLA tracking with remediation Automated evidence collection for audit readiness Basic reporting and audit workflows, code change, and continuous controls monitoring Auditor API Trust Center Access to expert partners for additional compliance services Plus A strong compliance foundation plus security—for companies who want to build trust and credibility early. Everything in Essentials, and: Automated policy onboarding AI-powered Questionnaire Automation (25 questionnaires per year) Access Management Most popular Professional Compliance, risk, and reporting all in one package—for organizations who want to scale their trust program with ease. Everything in Plus, and: AI-powered Questionnaire Automation (144 questionnaires per year) Risk management with customization, dashboard, and reporting Advanced Trust Center Custom monitoring tests and automation Automated access management Advanced reporting (six customizable reports) Advanced control management Additional Vanta AI Agent features like agentic issue management Enterprise A trust program tailored to your unique needs—get flexible, scalable, advanced compliance. Fully customizable package with advanced GRC needs Compare features ✨ Vanta AI Essentials Plus Professional Pro Enterprise Code for failing tests Chatbot for your buyers Add-on Questionnaire response automation Add-on Add-on Security reviews Add-on Add-on Add-on Add-on — Vanta AI Agent — Search across your program (policies, controls, frameworks, tests, documents) Evidence checks (policies, IRLs, documents) Policy template library Policy generation Evidence collection SLA tracking and remediation Control mapping to policies Policy change summaries Bulk policy importing Issue Management Compliance Essentials Plus Professional Pro Enterprise ✨ AI-generated code for failing tests ✨ Agentic question and search across your program (policies, controls, frameworks, tests, documents) ✨ Agentic evidence checks (policies, IRLs, documents) ✨ Agentic policy template library ✨ Agentic policy generation ✨ Agentic evidence collection ✨ Vanta AI Agent ✨ Agentic SLA tracking and remediation ✨ Agentic control mapping to policies ✨ Agentic policy change summaries ✨ Agentic bulk policy importing ✨ Agentic issue management One compliance framework Pre-built controls library Pre-built policy template library Custom SLAs Basic reporting Access to Vanta's auditor network Ability to bring your own auditor Developer-friendly IaC test remediation instructions Custom scope for resources, applications, devices, and employees Continuous monitoring of controls Personnel policy acceptance tracking Bi-directional task tracker integration AI suggestions to map existing tests and documents to custom controls Automated notifications for failed tests Adaptive scoping Issue management Team-based ownership on tests and documents Advanced rep\nDOLLARS: []\n","type":"text"}]}

cd /tmp && timeout 20 curl -sS -L "https://developer.vanta.com/" -o vd2.html -w "%{http_code}\n"; python3 -c "
import re,html
t=open('/tmp/vd2.html',encoding='utf-8',errors='ignore').read()
t=re.sub(r'<script.*?</script>','',t,flags=re.S); t=re.sub(r'<style.*?</style>','',t,flags=re.S)
t=re.sub(r'<[^>]+>',' ',t); t=html.unescape(t); t=re.sub(r'\s+',' ',t)
print(t[:2000])
"; echo ---; timeout 15 curl -sS -o /dev/null -w "%{http_code}\n" -L "https://docs.vanta.com/" ; timeout 15 curl -sS -o /dev/null -w "%{http_code}\n" -L "https://developer.vanta.com/reference/api-overview"

{"content":[{"text":"200\n Vanta Developer Hub - Vanta Developer Hub Documentation Index Fetch the complete documentation index at: /llms.txt Use this file to discover all available pages before exploring further. Skip to main content Vanta Developer Hub home page Search... ⌘ K Login Home Docs API Reference Changelog Vanta Developer Hub home page Search... ⌘ K Ask Assistant ⌘ I Login Login Search... Navigation Vanta Developer Hub Home Docs API Reference Changelog Vanta Developer Hub How can I help you automate compliance, build integrations, or get work done with AI? Search or ask… Quickstarts Start building in minutes Automate your security & compliance program using APIs Start using the Vanta API in 10 minutes — programmatically manage documents and evidence in your compliance program. Start quickstart → Connect AI agents to the API Learn how to use the Vanta MCP to find failing tests, remediate them, and act on your compliance data directly from Claude, ChatGPT or your custom AI agent. No code required. Start quickstart → Use cases See what others build on Vanta Reference Explore the Developer Hub Partners Reach 16,000+ Vanta customers List your integration in the Vanta Integration Marketplace Become an integration partner and list your integration in the Vanta Integration Marketplace to security-conscious teams already automating compliance with Vanta. Become a partner → Tools & SDKs Save time building using these tools ⌘ I Assistant Responses are generated using AI and may contain mistakes. Contact support \n---\n200\n404\n","type":"text"}]}

{"content":[{"text":"200\n# Vanta Developer Hub\n\n> Build on Vanta, the #1 Agentic Trust Platform. APIs, MCP server, and integration guides for automating compliance, risk, and proof across your security program.\n\n- [Vanta Developer Hub](https://developer.vanta.com/index.md): Build on Vanta — the developer hub for the Manage Vanta, Build Integrations, and Auditor APIs, the Vanta MCP server, SDKs, webhooks, and integration partner program.\n- [Make your first API call to Vanta](https://developer.vanta.com/docs/quickstart/manage-vanta.md): Get an access token and use it to list documents, policies, and evidence in your Vanta tenant, filtered by compliance framework.\n- [Build a custom integration for compliance data](https://developer.vanta.com/docs/quickstart/build-private-integration.md): Push user accounts and custom resources from a homegrown app into Vanta, then turn that data into pass/fail evidence with a Custom Test.\n- [Pull Information Request Lists for your audits](https://developer.vanta.com/docs/quickstart/conduct-audit.md): Get a list of Information Request Lists (IRLs) for the audits assigned to your firm.\n- [Remediate a failing test with the Vanta MCP](https://developer.vanta.com/docs/quickstart/remediate-with-mcp.md): Connect Claude Code, Codex, Cursor, or Perplexity to the Vanta MCP server, surface failing tests, and generate a remediation plan for one.\n- [Assign a control owner](https://developer.vanta.com/docs/guides/add-an-owner-to-a-control.md): Make a specific Vanta user accountable for a framework control's compliance status, using the Manage Vanta API.\n- [Upload a document](https://developer.vanta.com/docs/guides/upload-a-document.md): Attach an evidence file to a Vanta document and submit it for review, using the Manage Vanta API.\n- [Find overdue security tasks](https://developer.vanta.com/docs/guides/list-users-with-overdue-security-tasks.md): Find current employees with overdue trainings, policy acceptances, custom tasks, background checks, or device-monitoring installs, using the Manage Vanta API.\n- [Offboard personnel](https://developer.vanta.com/docs/guides/offboard-people.md): Complete the offboarding workflow for ex-employees — deactivating unmonitored accounts and recording an acknowledger — using the Manage Vanta API.\n- [Scope resources in or out](https://developer.vanta.com/docs/guides/scope-resources-at-the-integration-level.md): Control which resources synced from a connected integration are tested and used as compliance evidence, using the Manage Vanta API.\n- [Add owners to resources](https://developer.vanta.com/docs/guides/add-owners-to-resources.md): Use the Vanta API to update the owner and descriptions on your resources.\n- [Create vendors with evidence](https://developer.vanta.com/docs/guides/create-vendors-and-attach-documentation.md): Add a vendor to your Vanta vendor inventory and attach a documentation file (SOC 2, DPA, security questionnaire, etc.), using the Manage Vanta API.\n- [Set custom fields on vendors](https://developer.vanta.com/docs/guides/use-custom-fields-with-vendors.md): Attach organization-specific metadata — contract dates, internal owners, risk tiers, anything you track — to vendors when creating or updating them, using the Manage Vanta API.\n- [Create and update risk scenarios](https://developer.vanta.com/docs/guides/create-risk-scenarios.md): Create risk scenarios in a specific register, set custom fields, and update them via the Manage Vanta API — including the common 400 errors that trip up most integrations.\n- [Find vulnerabilities approaching SLAs](https://developer.vanta.com/docs/guides/vulnerabilities-with-approaching-slas.md): Query vulnerabilities approaching their remediation deadline so you can prioritize fixes before they breach SLA, using the Manage Vanta API.\n- [Find failing tests](https://developer.vanta.com/docs/guides/query-test-results-and-filter-for-failing-resources.md): Find tests that need attention, then drill into the specific entities (users, buckets, repos, etc.) causing them to fail, using the Manage Vanta API.\n- [Subscribe to webhook events](https://developer.vanta.com/docs/webhooks.md): Receive real-time HTTP notifications when events happen in Vanta — register an endpoint, verify Svix signatures, and handle retries — instead of polling the API.\n- [Vanta API authentication](https://developer.vanta.com/docs/concepts/authentication.md): How Vanta authenticates API clients, the OAuth grant types each application type uses, and the nuances of tokens, refresh, and revocation.\n- [Integrations in Vanta](https://developer.vanta.com/docs/concepts/integrations.md): What an integration is in Vanta, the difference between public and private integrations, and how they work.\n- [Resources in Vanta](https://developer.vanta.com/docs/concepts/resources.md): What a Vanta resource is, base vs custom resource types, supported custom property types, and when to model your data as a custom resource.\n- [Tests in Vanta](https://developer.vanta.com/docs/concepts/tests.md): What a test is in Vanta, the difference between built-in tests and Custom Tests, and when to reach for a Custom Test instead of a standard one.\n- [Become an integration partner](https://developer.vanta.com/docs/guides/become-partner.md): Join the Vanta Integration Partner Program to publish your integration in the Vanta marketplace and reach thousands of security-conscious customers.\n- [Build a public integration](https://developer.vanta.com/docs/quickstart/build-integration.md): Become a Vanta partner, complete the OAuth authorization-code flow, and push your first resource into a customer's Vanta tenant.\n- [Publish your integration](https://developer.vanta.com/docs/guides/list-your-integration.md): Submit your finished integration for review and publish it to the Vanta marketplace.\n- [Vanta MCP server](https://developer.vanta.com/docs/vanta-mcp.md): Let AI agents use the Vanta API. Connect Claude Code, Cursor, Perplexity, and other AI tools using the Vanta MCP server.\n- [Install Vanta AI Skills](https://developer.vanta.com/docs/ai-skills.md): Vanta publishes agentskills.io-spec skill files that give your AI coding tool Vanta-specific guidance. Install them with one command or add the Vanta Developer Docs MCP server.\n- [Postman setup](https://developer.vanta.com/docs/postman-setup.md): Import the Vanta Postman collections and start testing requests in minutes.\n- [Vanta SDKs](https://developer.vanta.com/docs/sdks.md): Official Vanta SDKs for building against the Vanta API in your language of choice.\n- [API Overview](https://developer.vanta.com/reference/overview.md): The Vanta API is a RESTful JSON API that lets you automate workflows, integrate external data, and access audit information programmatically.\n- [Manage Vanta API](https://developer.vanta.com/reference/manage-vanta/overview.md): Manage Vanta API — automate your Vanta tenant: controls, documents, vendors, personnel, resources, tests, and issues.\n- [List business units](https://developer.vanta.com/api-reference/business-units/list-business-units.md): Lists the business units for your organization. Returns 403 when business unit scoping is disabled for the domain.\n- [Get business unit by ID](https://developer.vanta.com/api-reference/business-units/get-business-unit-by-id.md): Get a business unit by ID. Returns 403 when business unit scoping is disabled for the domain.\n- [List contracts](https://developer.vanta.com/api-reference/contracts/list-contracts.md): List contracts, paginated.\n- [Upload contract](https://developer.vanta.com/api-reference/contracts/upload-contract.md): Upload a contract.\n- [Get contract](https://developer.vanta.com/api-reference/contracts/get-contract.md): Get a contract by ID.\n- [Delete contract](https://developer.vanta.com/api-reference/contracts/delete-contract.md): Delete a contract by ID.\n- [List controls](https://developer.vanta.com/api-reference/controls/list-controls.md): List controls.\n- [Create custom control](https://developer.vanta.com/api-reference/controls/create-custom-control.md): Create a custom control.\n- [Add control from Vanta library](https://developer.vanta.com/api-reference/controls/add-control-from-vanta-library.md): Add a control from the Vanta library to your organization's controls.\n- [List Vanta controls from the library](https://developer.vanta.com/api-reference/controls/list-vanta-controls-from-the-library.md): List Vanta controls from the library.\n- [List deactivated controls](https://developer.vanta.com/api-reference/controls/list-deactivated-controls.md): List deactivated Vanta controls (previously known as the controls library).\n- [Get control by an ID](https://developer.vanta.com/api-reference/controls/get-control-by-an-id.md): Get a control by an ID.\n- [Deactivates a control](https://developer.vanta.com/api-reference/controls/deactivates-a-control.md): Deactivates a custom or Vanta control.\n- [Update a control's metadata](https://developer.vanta.com/api-reference/controls/update-a-controls-metadata.md): Update a control's metadata.\n- [Add control to document mapping](https://developer.vanta.com/api-reference/controls/add-control-to-document-mapping.md): Add a document to a control.\n- [Add control to test mapping](https://developer.vanta.com/api-reference/controls/add-control-to-test-mapping.md): Add a control to test mapping.\n- [List a control's documents](https://developer.vanta.com/api-reference/controls/list-a-controls-documents.md): List a control's documents.\n- [Remove control from document mapping](https://developer.vanta.com/api-reference/controls/remove-control-from-document-mapping.md): Remove a document by ID from a control.\n- [Set owner of a control](https://developer.vanta.com/api-reference/controls/set-owner-of-a-control.md): Assign a control to a user or remove an owner from a control.\n- [List a control's tests](https://developer.vanta.com/api-reference/controls/list-a-controls-tests.md): List a control's tests.\n- [Remove control from test mapping](https://developer.vanta.com/api-reference/controls/remove-control-from-test-mapping.md): Remove a control from test mapping.\n- [List customer trust accounts](https://developer.vanta.com/api-reference/customer-trust/list-customer-trust-accounts.md): List customer trust accounts with pagination.\n- [Create customer trust account](https://developer.vanta.com/api-reference/customer-trust/create-customer-trust-account.md): Create a new customer trust account.\n- [Get customer trust account](https://developer.vanta.com/api-reference/customer-trust/get-customer-trust-account.md): Get a specific customer trust account by ID.\n- [Delete customer trust account](https://developer.vanta.com/api-reference/customer-trust/delete-customer-trust-account.md): Delete a customer trust account by ID.\n- [Update customer trust account](https://developer.vanta.com/api-reference/customer-trust/update-customer-trust-account.md): Update a customer trust account by ID.\n- [Create data deletion request](https://developer.vanta.com/api-reference/customer-trust/create-data-deletion-request.md): Submit a Right to Be Forgotten (RTBF) data deletion request for the specified email address.\n- [List questionnaires](https://developer.vanta.com/api-reference/customer-trust/list-questionnaires.md): List questionnaires with filtering and pagination.\n- [List assignable users](https://developer.vanta.com/api-reference/customer-trust/list-assignable-users.md): List users who can be assigned as owner or approver on a questionnaire.\n- [Create questionnaire export](https://developer.vanta.com/api-reference/customer-trust/create-questionnaire-export.md): Creates an asynchronous export job for a questionnaire. The export processes in the background and typically completes within a few minutes depending on questionnaire size.\n- [Get questionnaire export status](https://developer.vanta.com/api-reference/customer-trust/get-questionnaire-export-status.md): Retrieves the current status and result of a questionnaire export using the id received from either the `createQuestionnaireExport` endpoint or the `v1.questionnaire.export-completed` webhook payload.\n- [Create file questionnaire](https://developer.vanta.com/api-reference/customer-trust/create-file-questionnaire.md): Create a new file-based questionnaire from an uploaded file (.xlsx, .docx, .pdf). File type is inferred as `SPREADSHEET` or `DOCUMENT` based on the uploaded file.\n- [Create website questionnaire](https://developer.vanta.com/api-reference/customer-trust/create-website-questionnaire.md): Create a new website-based questionnaire from a portal URL.\n- [Get questionnaire by ID](https://developer.vanta.com/api-reference/customer-trust/get-questionnaire-by-id.md): Retrieve a questionnaire by ID.\n- [Delete questionnaire](https://developer.vanta.com/api-reference/customer-trust/delete-questionnaire.md): Delete a questionnaire by ID.\n- [Update questionnaire](https://developer.vanta.com/api-reference/customer-trust/update-questionnaire.md): Update an existing questionnaire.\n- [Approve questionnaire](https://developer.vanta.com/api-reference/customer-trust/approve-questionnaire.md): Mark a questionnaire as `APPROVED` and optionally provide a `statusChangeMessage`.\n- [Complete questionnaire](https://developer.vanta.com/api-reference/customer-trust/complete-questionnaire.md): Complete a questionnaire and optionally sync approved answers to the answer library.\n- [List questionnaire responses](https://developer.vanta.com/api-reference/customer-trust/list-questionnaire-responses.md): List the responses on a questionnaire. Each response carries its `answerPartsSchema` and `answerPartsValues`, which describe the parts an answer is composed of and their current values.\n- [Get questionnaire response](https://developer.vanta.com/api-reference/customer-trust/get-questionnaire-response.md): Retrieve a single questionnaire response.\n- [Update questionnaire response content](https://developer.vanta.com/api-reference/customer-trust/update-questionnaire-response-content.md): Update the answer content of a questionnaire response. The edit is recorded as performed by the calling application, since vanta-api authenticates an OAuth client rather than a specific user.\n- [Update questionnaire response owner](https://developer.vanta.com/api-reference/customer-trust/update-questionnaire-response-owner.md): Reassign or clear the owner of a questionnaire response. The assignment is recorded as performed by the calling API client, so the notification to the new owner names the Vanta API rather than a user.\n- [List tag categories](https://developer.vanta.com/api-reference/customer-trust/list-tag-categories.md): List user-defined tag categories. Optionally filter by product context.\n- [Get tags for category](https://developer.vanta.com/api-reference/customer-trust/get-tags-for-category.md): Retrieve a tag category and its associated tags by category ID.\n- [Enable tag category for product context](https://developer.vanta.com/api-reference/customer-trust/enable-tag-category-for-product-context.md): Enables a tag category for a product context (e.g. document sharing, control sharing), making it available for scoping that context's shareable content. Idempotent: enabling an already-enabled category is a no-op.\n- [Disable tag category for product context](https://developer.vanta.com/api-reference/customer-trust/disable-tag-category-for-product-context.md): Disables a tag category for a product context. Idempotent: removing a category that isn't enabled for the context is a no-op.\n","type":"text"}]}

{"content":[{"text":"4799:  <Card title=\"Manage Vanta quickstart\" icon=\"rocket\" href=\"/docs/quickstart/manage-vanta\">\n5336:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n5545:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n5954:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n6193:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n6445:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n6683:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n6902:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n7122:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n7325:* A Manage Vanta [API token](/docs/quickstart/manage-vanta).\n1:# List all API Endpoint Vulnerabilities\n21:# Sync all API Endpoint Vulnerabilities\n45:# Create an auditor\n55:# Accept evidence for an information request\n78:# Create a comment for a control within an audit\n92:# Create a comment for an information request\n104:# Create a comment for audit evidence\n114:# Create a custom control for an audit\n127:# Create a custom evidence request for an audit\n137:# Create a new information request\n154:# Delete a comment for a control within an audit\n166:# Delete a comment for an information request\n178:# Delete an information request for an audit\n198:# Duplicate an IRL audit\n228:# Flag evidence for an information request\n253:# Get an audit evidence comment by ID\n273:# Get an audit evidence item by ID\n292:# Get an information request by ID\n307:# Get an information request comment by ID\n327:# Get audit by ID\n","type":"text"}]}

{"content":[{"text":"> ## Documentation Index\n> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt\n> Use this file to discover all available pages before exploring further.\n\n# Vanta SDKs\n\n> Official Vanta SDKs for building against the Vanta API in your language of choice.\n\n<Note>\n  **SDKs are currently only available for the Auditor API.** The [Manage Vanta API](/reference/manage-vanta/overview) and the [Build Integrations API](/reference/build-integrations/overview) are not yet supported.\n</Note>\n\nVanta publishes official, type-safe SDKs for the [Auditor API](/reference/audits/overview). Each SDK is generated from the same OpenAPI specification, so you get the same coverage and behavior across languages — with idiomatic ergonomics for your stack.\n\nPick the SDK for your language to get started. Click an SDK below to view installation instructions, examples, and the full source on GitHub.\n\n<CardGroup cols={2}>\n  <Card title=\"TypeScript SDK\" icon=\"js\">\n    Developer-friendly, fully type-safe SDK for Node.js, Deno, Bun, and the browser.\n\n    ```bash theme={\"system\"}\n    npm add vanta-auditor-api-sdk\n    ```\n\n    [View on GitHub →](https://github.com/VantaInc/vanta-auditor-api-sdk-typescript)\n  </Card>\n\n  <Card title=\"Java SDK\" icon=\"java\">\n    Idiomatic Java SDK distributed via Maven Central. Requires JDK 11 or later.\n\n    ```groovy theme={\"system\"}\n    implementation 'com.vanta:vanta-auditor-api:0.3.0'\n    ```\n\n    [View on GitHub →](https://github.com/VantaInc/vanta-auditor-api-sdk-java)\n  </Card>\n</CardGroup>\n\n## What's included\n\nBoth SDKs are generated from the Vanta Auditor API OpenAPI spec and ship with everything you need to build production integrations:\n\n<CardGroup cols={2}>\n  <Card title=\"Full API coverage\" icon=\"code-branch\">\n    Methods for every Auditor API resource, including audits, evidence, controls, comments, frameworks, tests, and auditors.\n  </Card>\n\n  <Card title=\"Bearer authentication\" icon=\"key\">\n    Built-in support for the `bearerAuth` scheme. Configure once at client initialization and you're ready to call any endpoint.\n  </Card>\n\n  <Card title=\"Typed requests & responses\" icon=\"shield-check\">\n    Static types for every request and response model so you catch mistakes at compile time, not in production.\n  </Card>\n\n  <Card title=\"Errors & retries\" icon=\"rotate\">\n    Structured error types and configurable retry strategies so your integration stays resilient under real-world conditions.\n  </Card>\n\n  <Card title=\"Pagination helpers\" icon=\"layer-group\">\n    First-class support for paginated endpoints like `audits.list` and `audits.listEvidence`.\n  </Card>\n\n  <Card title=\"Server selection & debugging\" icon=\"bug\">\n    Override the default server URL per client and enable HTTP debug logging while developing.\n  </Card>\n</CardGroup>\n\n## Versioning and support\n\nBoth SDKs are currently in **beta**. Pin to a specific version so your builds stay reproducible — breaking changes may occur between minor versions until the S","type":"text"}]}

{"content":[{"text":"> ## Documentation Index\n> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt\n> Use this file to discover all available pages before exploring further.\n\n# Make your first API call to Vanta\n\n> Get an access token and use it to list documents, policies, and evidence in your Vanta tenant, filtered by compliance framework.\n\nexport const EstimatedTime = ({time, icon = \"clock\"}) => <div className=\"vanta-estimated-time\" style={{\n  display: \"inline-flex\",\n  alignItems: \"center\",\n  gap: \"0.5rem\",\n  padding: \"0.35rem 0.75rem\",\n  marginBottom: \"1rem\",\n  borderRadius: \"9999px\",\n  background: \"color-mix(in srgb, #5E05C4 10%, transparent)\",\n  border: \"1px solid color-mix(in srgb, #5E05C4 25%, transparent)\",\n  fontSize: \"0.8125rem\",\n  fontWeight: 500,\n  lineHeight: 1,\n  color: \"#5E05C4\",\n  whiteSpace: \"nowrap\"\n}}>\n    <Icon icon={icon} iconType=\"regular\" size={14} color=\"#5E05C4\" />\n    <span>Estimated time: {time}</span>\n  </div>;\n\n<EstimatedTime time=\"10 minutes\" />\n\nBy the end of this quickstart you'll have a working access token and you'll have used it to list the documents stored in your Vanta instance, filtered by compliance framework.\n\n## Before you begin\n\nMake sure you have:\n\n* A Vanta account with admin access.\n* A terminal or HTTP client (cURL, Postman, or your language of choice).\n\n<Info>\n  This quickstart is for **security engineers and admins** automating their own Vanta account. If you're a partner building a public integration, see the [Build an Integration quickstart](/docs/quickstart/build-integration). If you're a Vanta audit partner, see the [Conduct an Audit quickstart](/docs/quickstart/conduct-audit).\n</Info>\n\n<Steps titleSize=\"h3\">\n  <Step title=\"Create a Manage Vanta application\">\n    **Vanta Dashboard** — sign in to Vanta, open [Settings → Developer Console](https://app.vanta.com/settings/developer-console), and click **Create**.\n\n    Choose **Manage Vanta** as the app type, then fill in:\n\n    * **Application name** — `Demo Manage Vanta App` (or enter a name of your choosing).\n    * **Application description** — `Vanta quickstart demo app`\n\n          <img src=\"https://mintcdn.com/vanta/WstAJ2TKBLS7hAXq/images/52311a3-Screenshot_2024-07-31_at_6.37.37_PM.png?fit=max&auto=format&n=WstAJ2TKBLS7hAXq&q=85&s=2095ed5d81a3044f26a1ca9fa588c659\" alt=\"Vanta Developer Console showing the Create application form with app type, name, and description fields\" width=\"500\" height=\"551\" data-path=\"images/52311a3-Screenshot_2024-07-31_at_6.37.37_PM.png\" />\n\n    The OAuth `client_id` is auto-generated. Click **Generate client secret** to create the secret. Store both values securely. You can rotate the secret at any time.\n  </Step>\n\n  <Step title=\"Get an access token\">\n    From your **terminal**, exchange your client credentials for an access token. This quickstart only makes read calls, so request the minimum scope: `vanta-api.all:read`.\n\n    <CodeGroup>\n      ```bash Terminal theme={\"system\"}\n      curl --location 'https://api.vanta.com/oauth/token' \\\n        --header 'Content-Type: application/json' \\\n        --data '{\n          \"client_id\": \"your_client_id\",\n          \"client_secret\": \"your_client_secret\",\n          \"scope\": \"vanta-api.all:read\",\n          \"grant_type\": \"client_credentials\"\n        }'\n      ```\n\n      ```javascript Node.js theme={\"system\"}\n      const response = await fetch(\"https://api.vanta.com/oauth/token\", {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          client_id: \"your_client_id\",\n          client_secret: \"your_client_secret\",\n          scope: \"vanta-api.all:read\",\n          grant_type: \"client_credentials\",\n        }),\n      });\n      const { access_token } = await response.json();\n      ```\n\n      ```python Python theme={\"system\"}\n      import requests\n\n      response = requests.post(\n          \"https://api.vanta.com/oauth/token\",\n          json={\n              \"client_id\": \"your_client_id\",\n         ","type":"text"}]}

{"content":[{"text":"> ## Documentation Index\n> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt\n> Use this file to discover all available pages before exploring further.\n\n# Vanta API authentication\n\n> How Vanta authenticates API clients, the OAuth grant types each application type uses, and the nuances of tokens, refresh, and revocation.\n\nEvery Vanta API request is authenticated with a short-lived **OAuth 2.0 bearer token**. Which OAuth flow you use — and the shape of the credentials you exchange — depends on the **application type** you create in the Developer Console. This page explains the underlying model so you can pick the right flow, understand the tradeoffs, and avoid the foot-guns that aren't obvious from the per-quickstart instructions.\n\n## Overview\n\nEvery Vanta API client is registered in the **Developer Console** as an **Application**. Each Application has a `client_id` and a `client_secret`, plus an **app type** that determines which OAuth grant types and scopes it can use. Clients exchange those credentials at a single token endpoint — `POST https://api.vanta.com/oauth/token` — for an `access_token`, then send that token as `Authorization: Bearer <access_token>` on every API request. Tokens last one hour. After that you either request a fresh one (machine-to-machine flows) or refresh it (per-customer OAuth flows).\n\n<Info>\n  Vanta does **not** support API keys, basic auth, or session cookies for the API. Every authenticated request goes through the OAuth bearer token model below.\n</Info>\n\n## Application types\n\nVanta exposes four application types, mapped to two OAuth 2.0 grant types. The grant type — not the app type — determines the shape of the auth flow.\n\n| Application type                 | Grant type           | Token is scoped to           | Refresh tokens |\n| -------------------------------- | -------------------- | ---------------------------- | -------------- |\n| **Manage Vanta**                 | `client_credentials` | Your own Vanta tenant        | No             |\n| **Build Integrations** (Private) | `client_credentials` | Your own Vanta tenant        | No             |\n| **Build Integrations** (Public)  | `authorization_code` | A specific customer's tenant | Yes            |\n| **Auditor API**                  | `client_credentials` | Your auditor firm's audits   | No             |\n\n<Tabs>\n  <Tab title=\"Client Credentials\">\n    Used by **Manage Vanta**, **Build Integrations** (Private), and **Auditor API** apps. There is no end-user; your server holds the `client_id` and `client_secret` and exchanges them directly for an access token.\n\n    ```http theme={\"system\"}\n    POST https://api.vanta.com/oauth/token\n    Content-Type: application/json\n\n    {\n      \"client_id\": \"vci_...\",\n      \"client_secret\": \"vcs_...\",\n      \"scope\": \"vanta-api.all:read\",\n      \"grant_type\": \"client_credentials\"\n    }\n    ```\n\n    Response:\n\n    ```json theme={\"system\"}\n    {\n      \"access_token\": \"vat_...\",\n      \"expires_in\": 3600,\n      \"token_type\": \"Bearer\"\n    }\n    ```\n\n    Notice there's **no `refresh_token`** — when the access token expires, you just exchange your client credentials again for a fresh one. Most integrations request a new token at the top of each scheduled run.\n  </Tab>\n\n  <Tab title=\"Authorization Code - Public Integrations\">\n    Used only by **Build Integrations** (Public) apps (i.e. integrations published in the [Vanta marketplace](https://app.vanta.com/integrations)). A customer clickscurl: (23) Failure writing output to destination\n","type":"text"}]}

node --version; cd /tmp && timeout 20 curl -sS -X POST https://api.vanta.com/oauth/token -H 'Content-Type: application/json' -d '{"client_id":"vci_demo_notreal","client_secret":"vcs_demo_notreal","scope":"vanta-api.all:read","grant_type":"client_credentials"}' -w "\nHTTP %{http_code}\n"

{"content":[{"text":"    React in real time when ownership or control status changes.\n  </Card>\n\n  <Card title=\"Try it in Postman\" icon=\"paper-plane\" href=\"/docs/postman-setup\">\n    Import the collection and run `set-owner` against a sandbox in seconds.\n  </Card>\n\n  <Card title=\"Manage Vanta API reference\" icon=\"book\" href=\"/reference/manage-vanta/overview\">\n    Browse every Manage Vanta endpoint — controls, tests, documents, people.\n--\n    Make a specific user accountable for the controls these resources support.\n  </Card>\n\n  <Card title=\"Try it in Postman\" icon=\"paper-plane\" href=\"/docs/postman-setup\">\n    Import the collection and run the bulk PATCH against a sandbox in seconds.\n  </Card>\n\n  <Card title=\"Manage Vanta API reference\" icon=\"book\" href=\"/reference/manage-vanta/overview\">\n    Browse every Manage Vanta endpoint — controls, tests, documents, people, integrations.\n--\n    Make a specific user accountable for the vendor-management controls this evidence supports.\n  </Card>\n\n  <Card title=\"Try it in Postman\" icon=\"paper-plane\" href=\"/docs/postman-setup\">\n    Import the collection and run `createVendor` + `documents` against a sandbox in seconds.\n  </Card>\n\n  <Card title=\"Manage Vanta API reference\" icon=\"book\" href=\"/reference/manage-vanta/overview\">\n    Browse every Manage Vanta endpoint — vendors, controls, tests, documents, people.\n--\n","type":"text"}]}

{"content":[{"text":"4724:    POST https://api.vanta.com/v1/oauth/token/suspend\n5345:    curl 'https://api.vanta.com/v1/controls?pageSize=100&frameworkMatchesAny=soc2' \\\n5385:    curl 'https://api.vanta.com/v1/people?pageSize=100&employmentStatusMatchesAny=CURRENT' \\\n","type":"text"}]}

cd /tmp && timeout 20 curl -sS -L "https://developer.vanta.com/docs/quickstart/manage-vanta.md" -o q.md; grep -n "api.vanta.com" q.md | head -20; echo ---; sed -n '/Step title="Make your first API call"/,/Step title=/p' q.md | head -60

{"content":[{"text":"62:      curl --location 'https://api.vanta.com/oauth/token' \\\n73:      const response = await fetch(\"https://api.vanta.com/oauth/token\", {\n90:          \"https://api.vanta.com/oauth/token\",\n132:      curl --location 'https://api.vanta.com/v1/frameworks?pageSize=10' \\\n139:        \"https://api.vanta.com/v1/frameworks?pageSize=10\",\n155:          \"https://api.vanta.com/v1/frameworks\",\n201:      curl --location 'https://api.vanta.com/v1/documents?frameworkMatchesAny=soc2&pageSize=10' \\\n208:        `https://api.vanta.com/v1/documents?frameworkMatchesAny=${frameworkId}&pageSize=10`,\n224:          \"https://api.vanta.com/v1/documents\",\n---\n","type":"text"}]}

cd /sandbox/repo && node --check vanta-quickstart.mjs && echo "syntax ok" && node vanta-quickstart.mjs; echo "exit=$?"; echo "=== fake creds ==="; VANTA_CLIENT_ID=vci_x VANTA_CLIENT_SECRET=vcs_x timeout 25 node vanta-quickstart.mjs; echo "exit=$?"

{"content":[{"text":"syntax ok\n\n[blocked] Missing VANTA_CLIENT_ID / VANTA_CLIENT_SECRET.\n  Get them at https://app.vanta.com/settings/developer-console\n  (app type: \"Manage Vanta\"), then re-run. Requires a Vanta account with admin access.\n\nexit=1\n=== fake creds ===\n\n[blocked] token exchange failed: HTTP 401 Unauthorized\n\nexit=1\n","type":"text"}]}