---

name: drata-api description: Drata compliance automation API integration for managing controls, evidence, personnel, assets, risks, vendors, and devices. Use when interacting with Drata's public API for compliance automation tasks including uploading evidence, managing personnel security training, querying controls, handling background checks, device compliance, vendor management, or any GRC (Governance, Risk, Compliance) automation workflows.

Drata API Skill

Base URLs

Authentication

The API key is stored in environment variable DRATA_API_KEY.

Important: Always use bash -c '...' wrapper when making API calls - environment variables may not inherit properly in direct commands:

Copybash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" "https://public-api.drata.com/public/controls"'

API keys created in Drata Settings > API Keys. Scope read/write per endpoint.

Rate Limits

500 requests/minute per IP.

API Versions

Drata has two API versions with different behaviors:

v1 Pagination (Page-based)

Copy# Fetch all pages
for p in 1 2 3 4 5; do
  bash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
    "https://public-api.drata.com/public/controls?limit=50&page='$p'"'
done

v2 Pagination (Cursor-based)

Copyasync function fetchAll(endpoint) {
  let cursor;
  const results = [];
  do {
    const params = cursor ? `?cursor=${cursor}` : "";
    const resp = await fetch(
      `https://public-api.drata.com/public/v2/${endpoint}${params}`,
      {
        headers: { Authorization: `Bearer ${API_KEY}` },
      },
    );
    const data = await resp.json();
    results.push(...data.data);
    cursor = data?.pagination?.cursor;
  } while (cursor);
  return results;
}

Endpoints

See references/endpoints.md for complete endpoint documentation.

Common Queries

Get ISO 27001 Control Status

Copybash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/controls?limit=50" | \
  jq "[.data[] | select(.frameworkTags | index(\"ISO 27001:2022\"))]"'

Get Non-Ready Controls

Copybash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/controls?limit=100" | \
  jq "[.data[] | select(.isReady == false) | {name, code}]"'

Get Personnel Compliance Summary

Copybash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/personnel" | \
  jq "{
    total: .data | length,
    compliant: [.data[] | select(.complianceChecks[] |
      select(.type == \"FULL_COMPLIANCE\" and .status == \"PASS\"))] | length
  }"'

Get Devices with Compliance Issues

Copybash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/v2/devices" | \
  jq "[.data[] | select(.firewallEnabled == false or .encryptionEnabled == false)]"'

Get High Risk Vendors

Copybash -c 'curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/vendors" | \
  jq "[.data[] | select(.risk == \"HIGH\")]"'

Filtering by Framework

Controls are tagged with frameworks. Common tags:

• "SOC 2"
• "ISO 27001:2022"
• "HIPAA"
• "GDPR"
• "PCI DSS"

Filter with jq:

Copyjq '[.data[] | select(.frameworkTags | index("ISO 27001:2022"))]'

Control Status Fields

Personnel Compliance Check Types

Common Workflows

Upload Evidence for Personnel

Copy// 1. Find personnel by email
const resp = await fetch(
  `https://public-api.drata.com/public/personnel?q=user@company.com`,
  {
    headers: { Authorization: `Bearer ${API_KEY}` },
  },
);
const userId = (await resp.json()).data[0].user.id;

// 2. Upload evidence
const form = new FormData();
form.append("type", "SEC_TRAINING"); // or HIPAA_TRAINING, BACKGROUND_CHECK, etc.
form.append("file", fs.createReadStream("evidence.pdf"));

await fetch(`https://public-api.drata.com/public/users/${userId}/documents`, {
  method: "POST",
  headers: { Authorization: `Bearer ${API_KEY}` },
  body: form,
});

Evidence Types

Upload Control Evidence

Copyconst form = new FormData();
form.append("file", fs.createReadStream("evidence.pdf"));

await fetch(
  `https://public-api.drata.com/public/controls/${controlId}/external-evidence`,
  {
    method: "POST",
    headers: { Authorization: `Bearer ${API_KEY}` },
    body: form,
  },
);

Full Compliance Report Script

Copy#!/bin/bash
# Generate compliance summary report

echo "=== DRATA COMPLIANCE REPORT ==="
echo ""

# Controls summary
echo "CONTROLS:"
for p in 1 2 3 4 5 6; do
  curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
    "https://public-api.drata.com/public/controls?limit=50&page=$p"
done | jq -s '[.[].data[]] | {
  total: length,
  ready: [.[] | select(.isReady)] | length,
  with_owner: [.[] | select(.hasOwner)] | length,
  with_evidence: [.[] | select(.hasEvidence)] | length,
  monitored: [.[] | select(.isMonitored)] | length
}'

echo ""
echo "PERSONNEL:"
curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/personnel" | jq '{
  total: .data | length,
  compliant: [.data[] | select(.complianceChecks[] |
    select(.type == "FULL_COMPLIANCE" and .status == "PASS"))] | length
}'

echo ""
echo "VENDORS:"
curl -s -H "Authorization: Bearer $DRATA_API_KEY" \
  "https://public-api.drata.com/public/vendors" | jq '{
  total: .data | length,
  high_risk: [.data[] | select(.risk == "HIGH")] | length,
  with_pii: [.data[] | select(.hasPii == true)] | length
}'

Error Handling

Python Example

Copyimport requests
import os

API_KEY = os.environ.get("DRATA_API_KEY")
BASE_URL = "https://public-api.drata.com/public"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

def get_all_v1(endpoint, limit=50):
    """Fetch all pages from v1 endpoint (page-based)"""
    results, page = [], 1
    while True:
        resp = requests.get(f"{BASE_URL}/{endpoint}", headers=HEADERS,
                          params={"limit": limit, "page": page})
        data = resp.json()
        if not data.get("data"):
            break
        results.extend(data["data"])
        page += 1
    return results

def get_all_v2(endpoint):
    """Fetch all pages from v2 endpoint (cursor-based)"""
    results, cursor = [], None
    while True:
        params = {"cursor": cursor} if cursor else {}
        resp = requests.get(f"{BASE_URL}/v2/{endpoint}", headers=HEADERS, params=params)
        data = resp.json()
        results.extend(data.get("data", []))
        cursor = data.get("pagination", {}).get("cursor")
        if not cursor:
            break
    return results

# Get all controls (v1)
controls = get_all_v1("controls")

# Get all personnel (v1 recommended)
personnel = get_all_v1("personnel")

# Get all devices (v2)
devices = get_all_v2("devices")