Integration

Drata integration

Drata is a compliance automation platform for frameworks such as SOC 2, ISO 27001 and HIPAA. Read and manage controls (notes, owners, tickets), evidence and its artifacts, policies, their versions, languages and approval actions, risk registers and risks, vendors with their security reviews, documents and questionnaires, personnel, users, roles, devices, assets, monitoring tests, tasks, audits, frameworks and the event log, and upload compliance documents for users, devices, risks and vendors. Not exposed: AWS, Azure, GCP, GitLab and custom connections with their data ingestion (custom records, HRIS identities, devices, procurement mappings), infrastructure and version control identity linking, workspace personnel scoping, policy approval tier settings, custom framework and custom test recipe editing, control template mapping resets, vendor type editing, security questionnaire file uploads, pre-signed upload URLs and the superseded evidence library and legacy framework requirement routes. Workspace-scoped tools (controls, evidence, tasks, monitoring tests, audits, frameworks) take a workspaceId: it is 1 unless the account has Multiple Product Support, in which case list_workspaces returns the ids. Authentication is a Drata API key (created under Settings, API Keys; its scopes decide which tools answer) sent as a Bearer token, plus the API host of your account's region: public-api.drata.com (US), public-api.eu.drata.com (EU) or public-api.apac.drata.com (APAC).

Connect Drata How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Drata.Built from the 165 Drata tools below, on the connection you add once.

What you can do with Drata

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Document, 10 operations

delete_device_documentDelete device documentDELETEDeletes a Document from a Device.
delete_risk_documentDelete risk documentDELETEDeletes a Document attached to a Risk.
delete_user_documentDelete user documentDELETEDeletes a compliance Document from a user.
get_device_documentGet device documentGETGets one Device Document: type, name, file URL and a signed download URL.
get_risk_documentGet risk documentGETGets one Document attached to a Risk, with its download URL.
get_user_documentGet user documentGETGets one user Document: type, name, file URL, renewal date and a signed download URL.
get_vendor_documentGet vendor documentGETGets one Vendor Document: name, type, dates and a signed download URL.
list_device_documentsList device documentsGETLists the compliance Documents uploaded for a Device (password manager, auto updates, disk encryption, antivirus or lock screen evidence), optionally filtered by document type.
list_risk_documentsList risk documentsGETLists the Documents attached to a Risk, each with a download URL. Needs the Risk Management Pro feature.
list_user_documentsList user documentsGETLists the compliance Documents uploaded for a user (security training, MFA evidence, HIPAA training, offboarding evidence and more), filterable by name and type.

Note, 8 operations

create_control_noteCreate control notePOSTAdds a Note (a comment) to a Control.
create_risk_noteCreate risk notePOSTAdds a Note (a comment) to a Risk.
delete_control_noteDelete control noteDELETEDeletes a Note from a Control.
delete_risk_noteDelete risk noteDELETEDeletes a Note from a Risk.
get_control_noteGet control noteGETGets one Note of a Control, with its author.
get_risk_noteGet risk noteGETGets one Note of a Risk, with its author.
list_control_notesList control notesGETLists the Notes written on a Control, with their author.
list_risk_notesList risk notesGETLists the Notes written on a Risk, with their author.

Ticket, 6 operations

link_control_ticketLink control ticketPOSTLinks an existing Ticket to a Control by its URL. The ticketing provider is read from the URL, so a Drata connection to that provider must already exist.
link_monitoring_test_ticketLink monitoring test ticketPOSTLinks an existing Ticket to a Monitoring Test by its URL. The ticketing provider is read from the URL, so a Drata connection to that provider must already exist.
link_risk_ticketLink risk ticketPOSTLinks an existing Ticket to a Risk by its URL. The ticketing provider is read from the URL, so a Drata connection to that provider must already exist.
list_control_ticketsList control ticketsGETLists the remediation Tickets linked to a Control, optionally only done or open ones. The state is what Drata holds, not a live read of the ticketing system.
list_monitoring_test_ticketsList monitoring test ticketsGETLists the remediation Tickets linked to a Monitoring Test, optionally only done or open ones, as Drata last recorded them.
list_risk_ticketsList risk ticketsGETLists the remediation Tickets linked to a Risk, optionally only done or open ones. The state is what Drata holds, not a live read of the ticketing system.

Asset, 4 operations

create_assetCreate assetPOSTManually adds an Asset to the inventory. Name, description, class types, type (PHYSICAL or VIRTUAL) and the owner user id are required; notes, an associated id, external ids for virtual Assets and custom fields are optional.
delete_assetDelete assetDELETERemoves a virtual or manually added Asset from the inventory. This cannot be undone.
get_assetGet assetGETGets one Asset by id: name, description, type, provider, class types, owner, notes and removal date.
list_assetsList assetsGETFinds Assets in the Drata inventory with filters on asset class, type (PHYSICAL or VIRTUAL), provider, owner user and the owner's employment status. Returns one page; pass pagination.cursor back as cursor for the next one.

Control, 4 operations

create_controlCreate controlPOSTCreates a custom Control in a workspace with a name, description and code, and optionally its question, activity, linked policies, requirements, tests, owners and custom fields.
get_controlGet controlGETGets one Control, by id or as code:<control code>: name, code, description, question, activity and archive state. expand[] adds flags, owners, requirements, framework tags and more.
list_controlsList controlsGETLists the Controls of a workspace, filterable by monitoring, readiness, evidence, policy, passing test, ticket status, policy id, enabled, archived and approval status.
list_framework_requirement_controlsList framework requirement controlsGETLists every Control mapped to a Framework Requirement, ordered by Control id.

Evidence, 4 operations

create_evidenceCreate evidencePOSTCreates an Evidence item with one or more artifacts (a file uploaded with upload_evidence_file and referenced by fileKey, a URL, or a ticket), plus optional owner, controls and renewal schedule.
delete_evidenceDelete evidenceDELETEPermanently deletes an Evidence item and all of its artifacts. To remove one artifact only, use delete_evidence_artifact.
get_evidenceGet evidenceGETGets one Evidence item: name, description, guidance, renewal date and schedule, status, owners and artifacts.
list_evidenceList evidenceGETLists the Evidence items of a workspace, filterable by name, owners, frameworks, evidence status and artifact type.

Owner, 4 operations

add_control_ownersAdd control ownersPOSTAdds a user as an owner of a Control.
assign_policy_ownerAssign policy ownerPUTMakes a user (by id, from list_users) the owner of a Policy. The user must hold a role allowed to own policies. Returns no content.
delete_control_ownerDelete control ownerDELETERemoves one owner (a user id) from a Control.
list_control_ownersList control ownersGETLists the users who own a Control.

Risk, 4 operations

create_riskCreate riskPOSTCreates a custom Risk in a Risk Register. Title and description are required; impact, likelihood, treatment plan, dates, residual scores, status, vendor, categories, owners, reviewers, controls and custom fields are optional.
delete_riskDelete riskDELETEDeletes a Risk from its Risk Register.
get_riskGet riskGETGets one Risk, by numeric id or by its risk identifier (such as RISK-001): scores, treatment plan and details, dates, status, owners, categories and controls.
list_risksList risksGETLists the Risks of a Risk Register, filterable by title, status, treatment plan, score range and vendor.

Risk register, 4 operations

create_risk_registerCreate risk registerPOSTCreates a Risk Register with a unique name and optional description, owner user ids and workspace ids. Needs the Risk Management Pro feature.
delete_risk_registerDelete risk registerDELETEDeletes a Risk Register. Needs the Risk Management Pro feature.
get_risk_registerGet risk registerGETGets one Risk Register with its description, owners and workspaces.
list_risk_registersList risk registersGETLists the account's Risk Registers with their owners and workspaces, filterable by name, owner and workspace.

Custom field definition, 3 operations

create_custom_field_definitionCreate custom field definitionPOSTCreates a Custom Field definition: a unique name, a field type, required and hidden flags, and where it appears. FORMULA fields cannot be created this way. Answers 400 once the account's Custom Field placement limit is reached.
get_custom_field_definitionGet custom field definitionGETGets one Custom Field definition by its numeric id, or by its name prefixed with name: (for example name:Regulatory Owner). Prefer the numeric id for anything you store.
list_custom_field_definitionsList custom field definitionsGETLists the Custom Field definitions of the account (name, type, required and hidden flags, entity types they apply to), optionally filtered by entity type or hidden state. Needs the Custom Fields and Formulas feature.

Device, 3 operations

get_deviceGet deviceGETGets one Device: OS version, serial number, model, MAC address, last check time, app count and whether it is compliant. expand[] adds asset, complianceChecks, documents, identifiers or deviceApps.
list_devicesList devicesGETLists the employee Devices known to Drata (OS version, serial number, model, MAC address, last check, source), filterable by serial number, MAC address, external id, source type or personnel.
list_personnel_devicesList personnel devicesGETLists the Devices of one Personnel record, with the same filters as list_devices (serial number, MAC address, external id, source type).

Policy, 3 operations

create_policyCreate policyPOSTCreates a Policy with a first draft version: name, description, owner user, renewal date and source type. UPLOADED needs the policy file, EXTERNAL needs externalFileId. Can require acknowledgement from everyone or from groups.
get_policyGet policyGETGets one published Policy: status, current version, renewal date, publish and approval dates, and owner.
list_policiesList policiesGETLists published Policies, filterable by name, status, reviewer user and reviewer status.

Policy version, 3 operations

create_policy_versionCreate policy versionPOSTCreates a new version of a Policy from an uploaded file or an external file. A non-material change without required approval is published at once; otherwise it awaits approval. The Policy needs a published version first.
get_policy_versionGet policy versionGETGets one Policy Version: status, version numbers, change summary and explanation, approval, publish and renewal dates. expand[] can add its language variants.
list_policy_versionsList policy versionsGETLists the versions of a Policy, filterable by version number, current flag and status. Language variants are not included: use list_policy_language_versions for those.

Task, 3 operations

create_taskCreate taskPOSTCreates a Task with a title, due date and optional description, assignee, type and linked controls, risks and policies; or creates one occurrence of a recurring Task from its configurationId and dueDate.
get_taskGet taskGETGets one Task: title, description, status, type, due and completion dates, assignee and creator.
list_tasksList tasksGETLists the Tasks of a workspace, filterable by status, assignee, creator, due date range, control, task type, title and description.

User, 3 operations

get_userGet userGETGets one user, by id or as email:<address>: email, names, job title and terms acceptance date. expand[] adds backgroundChecks, documents, personnel, identities or roles.
list_role_usersList role usersGETLists the users who hold a given role, filterable by first or last name.
list_usersList usersGETLists Drata users (people with an account in the app), filterable by first or last name.

Vendor, 3 operations

create_vendorCreate vendorPOSTCreates a Vendor. Only name is required; category, risk, status, criticality, owner, URLs, data handled, password policy, contacts, renewal, impact levels, cost and custom fields are optional.
delete_vendorDelete vendorDELETERemoves a Vendor and its record from the account.
get_vendorGet vendorGETGets one Vendor with its category, risk, type, criticality, status, URLs, services, data handled, password policy, contacts and renewal details.

Action, 2 operations

list_policy_actionsList policy actionsGETLists the actions the API key may perform on a Policy in its current state (such as submit for approval, approve, publish or discard), each with the payload it expects. Check it before perform_policy_action.
list_security_review_actionsList security review actionsGETLists the actions available on a Security Review in its current state, such as finalize or reopen (beta).

Action create, 2 operations

create_monitoring_test_ticketCreate monitoring test ticketPOSTCreates a Ticket in a connected ticketing system (through its Drata connection id) and links it to a Monitoring Test, optionally filled from the failing test result.
create_risk_ticketCreate risk ticketPOSTCreates a Ticket in a connected ticketing system (through its Drata connection id) and links it to a Risk. The fields the ticket needs depend on the destination project and issue type.

Artifact, 2 operations

delete_evidence_artifactDelete evidence artifactDELETEPermanently deletes one artifact of an Evidence item, with its whole version history.
list_evidence_artifactsList evidence artifactsGETLists the artifacts of one Evidence item, one entry per artifact (not per version), filterable by name, artifact type and archived state.

Audit, 2 operations

get_auditGet auditGETGets one audit: framework, type, status, audit period, completion date and its auditors.
list_auditsList auditsGETLists the audits of a workspace: framework, audit type, internal or external, status and audit period.

Compliance check exclusion, 2 operations

exclude_personnel_compliance_checksExclude personnel compliance checksPOSTExcludes personnel from given compliance check types (such as OFFBOARDING) for a reason and from a start date, optionally until an end date, without taking them out of scope. Reports an outcome per person.
list_compliance_check_exclusionsList compliance check exclusionsGETLists the personnel compliance-check exclusions in force in a workspace, newest first, optionally for one compliance check type.

Download job, 2 operations

create_event_pdf_exportCreate event pdf exportPOSTStarts a job that renders an Event as a PDF and returns its jobId and status. Call get_event_pdf_export with that jobId until status is Completed, then read the PDF link from result.
get_event_pdf_exportGet event pdf exportGETGets an Event PDF export job: status (Pending, Running, Completed or Failed), result (a signed PDF URL, once Completed, that expires 10 minutes after it is generated) and errorMessage when it failed.

Event, 2 operations

get_eventGet eventGETGets one Event: type, category, source, description, status, metadata and the user who caused it.
list_eventsList eventsGETLists Events from Drata's event tracking log, filterable by type, category, source (app, public API, Autopilot and others), connection, user, workspace and creation date range.

Monitoring test, 2 operations

get_monitoring_testGet monitoring testGETGets one Monitoring Test by its testId: result status, check status (TESTING while a run is in flight), source, last pass and failing-since dates, and monitor instances.
list_monitoring_testsList monitoring testsGETLists the Monitoring Tests of a workspace, filterable by result status, check status, type and source.

Personnel, 2 operations

get_personnelGet personnelGETGets one Personnel record by id (or by the user's email as email:<address>): linked user, employment status, start and separation dates and compliance checks.
list_personnelList personnelGETLists Personnel records (the people Drata tracks for compliance) with their user, employment status and compliance checks, filterable by employment and compliance status. For text search use search_personnel.

Policy language version, 2 operations

get_policy_language_versionGet policy language versionGETGets one language variant of a Policy Version by the id from list_policy_language_versions. expand[] with downloadUrl or downloadPdfUrl adds a download link.
list_policy_language_versionsList policy language versionsGETLists language variants of Policy Versions, one row per variant: narrow to one version with policyVersionId or to every version of a Policy with policyId, and by parent version status.

Request, 2 operations

get_audit_requestGet audit requestGETGets one audit request: code, title, description, status, owners, messages and related controls.
list_audit_requestsList audit requestsGETLists the requests auditors raised in an audit, filterable by status and assigned users.

Requirement, 2 operations

list_control_requirementsList control requirementsGETLists the framework Requirements a Control is mapped to, filterable by framework.
list_framework_requirementsList framework requirementsGETLists the Requirements of a Framework, filterable by readiness and scope.

Risk library, 2 operations

get_risk_library_itemGet risk library itemGETGets one Risk Library item, by numeric id or as riskId: , with its mapped controls and categories.
list_risk_library_itemsList risk library itemsGETSearches Drata's Risk Library (template risks with their mapped controls and categories) by risk id, title or description. Needs the Risk Management Pro feature.

Role, 2 operations

get_roleGet roleGETGets one role, by id or as role:<name>, with its permissions.
list_rolesList rolesGETLists the user roles defined in Drata, with their permissions.

Security review, 2 operations

create_vendor_security_reviewCreate vendor security reviewPOSTCreates a Security Review for a Vendor: deadline, status and type (SECURITY, SOC_REPORT or UPLOAD_REPORT) are required; title, note, request date and requester are optional.
get_vendor_security_reviewGet vendor security reviewGETGets one Security Review of a Vendor (beta). SOC_REPORT reviews also carry the SOC review form data.

Action acknowledge, 1 operation

acknowledge_user_policyAcknowledge user policyPOSTRecords that a user acknowledged one of their assigned Policies: the acceptance time (within the last year) and optional details on where it was accepted.

Action copy, 1 operation

copy_risk_library_itemsCopy risk library itemsPOSTCopies Risk Library items into a Risk Register, either the listed risk ids (COPY_BY_IDS) or whole risk groups (COPY_BY_GROUPS). Needs the Risk Management Pro feature.

Action delete, 1 operation

delete_compliance_check_exclusionsDelete compliance check exclusionsPOSTRemoves personnel exclusions for given compliance check types, putting those people back in scope for those checks. Reports an outcome per person.

App, 1 operation

list_device_appsList device appsGETLists the applications recorded for a Device, one page at a time.

Assessment, 1 operation

list_security_review_assessmentsList security review assessmentsGETLists the criteria Assessments of a Vendor Security Review (status, severity, analysis summary), filterable by criteria name, status and severity (beta).

Assigned policy, 1 operation

list_user_assigned_policiesList user assigned policiesGETLists the Policies assigned to a user for acknowledgement, with when and how each one was accepted.

Background check, 1 operation

create_background_checkCreate background checkPOSTRecords a manual Background Check for a user (user id, URL of the check report, date it was completed) and marks that user compliant for the Background Check requirement.

Company, 1 operation

get_companyGet companyGETGets the company profile: account id, domain, name and legal name, description, logo URL, training and background check settings, and the account's entitlements.

Exclusion, 1 operation

list_monitoring_test_exclusionsList monitoring test exclusionsGETLists the resources excluded from a Monitoring Test, with the reason for each.

Failure, 1 operation

list_monitoring_test_failuresList monitoring test failuresGETLists the resources failing a Monitoring Test. Manually excluded failures are left out unless includeExclusions is true; each item's status is OPEN or EXCLUDED.

Framework, 1 operation

list_frameworksList frameworksGETLists the compliance Frameworks of a workspace (such as SOC 2 or ISO 27001) with their in-scope control and requirement counts, filterable by name, readiness and enabled state.

Group, 1 operation

list_groupsList groupsGETLists personnel groups (teams or departments) of the account, optionally filtered by a case-insensitive name substring (q). A group id can then filter the personnel search tools.

Insight, 1 operation

get_risk_insightsGet risk insightsGETGets dashboard analytics for a Risk Register: risk posture, treatment overview, risk heatmap, category breakdown, scoring progress and risk trend over time, optionally for given owners or statuses.

Language, 1 operation

list_policy_version_languagesList policy version languagesGETLists the language variants of one Policy Version, addressed through its Policy id and version id.

Pass, 1 operation

list_monitoring_test_passesList monitoring test passesGETLists the resources currently passing a Monitoring Test. Tests that do not report passing resources return an empty page.

Policy language setting, 1 operation

list_policy_language_settingsList policy language settingsGETLists the languages configured for Policies in the organization and which one is the default. Answers 400 when Policy languages are not enabled in the organization settings.

Questionnaire, 1 operation

get_vendor_questionnaireGet vendor questionnaireGETGets one Questionnaire sent to a Vendor: title, recipient, completion state, who completed it and when it was sent.

Security questionnaire, 1 operation

list_security_review_questionnairesList security review questionnairesGETLists the questionnaires that belong to a Vendor Security Review, archived ones excluded (beta).

Upcoming task, 1 operation

list_upcoming_tasksList upcoming tasksGETLists upcoming Tasks of a workspace: policy renewals, vendor reviews, evidence due dates, control approvals and custom Tasks, recurring occurrences included (six months ahead unless dueDateTo says otherwise).

Vendor security review, 1 operation

list_all_vendor_security_reviewsList all vendor security reviewsGETLists Security Reviews across all Vendors you can access, with the same filters as list_vendor_security_reviews plus vendorIds[].

Vendors stat, 1 operation

get_vendor_statsGet vendor statsGETGets Vendor statistics for the scopes named in expand[] (at least one, such as status, risk or hasPii), each as key and count. Archived Vendors are left out unless includeArchived is true.

Showing the first 120 of 165 endpoints. The rest are in the product, searchable from the workflow builder and from chat.

Use Drata from Claude Code, Cursor or Codex

Connect Drata in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Drata operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Drata

Create your workspace
Sign up free. Nothing to install.
Connect Drata once
Add your Drata connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.