> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vendexlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Drata

> Push assessment decisions, risk, and notes from VendexLabs to your Drata vendors automatically.

If your compliance program runs on Drata, VendexLabs can keep Drata's vendor records up to date for you. When you save an assessment, VendexLabs pushes the decision, risk level, renewal date, and notes to the matching vendor in Drata. The sync is one way: VendexLabs never reads your audit data or changes anything else in Drata.

![Diagram: saving an assessment in VendexLabs queues a sync that updates the linked vendor in Drata](https://mintcdn.com/vendex-labs/TaraXYWE2PbpKXO9/images/drata-sync.svg?fit=max\&auto=format\&n=TaraXYWE2PbpKXO9\&q=85\&s=7145909433a564d34c5fd29684a292f4)

> [!NOTE]
>
> You need a Drata plan with Third-Party Risk Management, and an **Admin** or **Owner** role in VendexLabs to set it up.

## Connect Drata

**1. Open Connected apps**

Go to **Settings → Connected apps**. Under **Send data to**, choose **Connect** next to **Drata**.

![Settings, Connected apps tab, with Drata under Send data to and Claude connections under Apps with access to VendexLabs](https://mintcdn.com/vendex-labs/CoyCkSVFgoJE5Vl7/images/connected-apps.png?fit=max\&auto=format\&n=CoyCkSVFgoJE5Vl7\&q=85\&s=0f686a5e8546e5731bd25e1eef57bf9d)

**2. Create credentials in Drata**

Pick how VendexLabs connects:

* **OAuth application** (recommended, not tied to a person). In Drata, go to **Settings → OAuth Applications → Create**, choose custom scopes, and turn on the scopes VendexLabs lists.
* **API key** (quicker, expires after 12 months by default). In Drata, go to **Settings → API Keys → Create API Key**, choose custom access, and turn on the same scopes.

VendexLabs needs **Vendors: List, Search, Get, Create, Update** and **Vendors: Create Security Review**.

![Connect Drata panel with OAuth app and API key options, the required Drata scopes, credential fields, vendor list, and risk level source](https://mintcdn.com/vendex-labs/CoyCkSVFgoJE5Vl7/images/drata-connect.png?fit=max\&auto=format\&n=CoyCkSVFgoJE5Vl7\&q=85\&s=cdacf8106843a19d21bd577dc34c1ec1)

**3. Set region and options**

Change the Drata API URL if your workspace is in the EU or APAC region. Choose which vendor list to sync and where the Drata risk level comes from: **your vendor tier** (Core → High, Standard → Moderate, Minimal → Low), the **VendexLabs risk score**, or **don't send risk**.

VendexLabs checks the credentials with Drata before saving. They're stored encrypted and never shown again.

**4. Review matches**

Nothing is sent yet. VendexLabs looks through your Drata workspace and shows how each vendor matches:

| Match | What happens |
| - | - |
| **Linked** | Same name, and the website matches or is missing on one side. Synced automatically. |
| **Possible match** | A similar Drata vendor, but not certain. You choose to link it, create a new one, or decide later. |
| **New** | Nothing similar exists in Drata. VendexLabs creates the vendor. |

Undecided vendors are skipped and wait in **Needs attention**. When the list looks right, approve it to start syncing.

## What syncs

* The **risk level** and **renewal date** on the Drata vendor, while VendexLabs still owns them.
* A **VendexLabs notes** section on the vendor with the assessment summary.
* A completed **security review** in the vendor's Drata history each time an assessment is approved, conditionally approved, or rejected.

Syncs run shortly after each save, with a daily catch-up so nothing is missed.

## Keep an eye on it

The Drata page in **Connected apps** shows:

* **Needs attention**: vendors waiting for a match decision, or whose Drata vendor was deleted.
* **Recent activity**: each sync and what happened, for example *Created vendor in Drata and linked it* or *Added a completed security review*.

Adding vendors to the synced list later puts the new matches back up for review before anything is sent.

## Disconnect

Choose **Disconnect Drata**. VendexLabs stops syncing and forgets the credentials. Nothing already in Drata is deleted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.