openapi: 3.2.0
info:
  title: Drata Users and Roles API
  version: V2
  contact: {}
  description: 'Operations tagged Users and Roles across 2 of this provider''s published API definitions: drata-api-v2-openapi.json, drata-api-v2-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://public-api.drata.com/public/v2
- url: https://public-api.eu.drata.com/public/v2
- url: https://public-api.apac.drata.com/public/v2
tags:
- name: Users and Roles
  description: "**Users** are are people with access to the Drata platform.  \n**Roles** grant permissions to Users. The [help docs](https://help.drata.com/en/collections/5993507) have more information on the default Roles."
paths:
  /roles:
    get:
      description: 'Find Roles matching the provided filters.


        🔒 Requires **Roles: List Roles** permission.'
      operationId: RolesPublicV2Controller_listRoles
      parameters:
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/RoleExpandEnum'
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolesResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Roles
      tags:
      - Users and Roles
      x-drata-permissions:
      - roles-get
      x-product-area:
      - RBAC
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /roles/{roleId}:
    get:
      description: 'Get the full detail of a Role record.


        🔒 Requires **Roles: Get Role** permission.'
      operationId: RolesPublicV2Controller_getRole
      parameters:
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/RoleExpandEnum'
      - name: roleId
        required: true
        in: path
        description: An integer Role ID or name prefixed with `role:`
        schema:
          oneOf:
          - type: number
            description: Role ID
          - type: string
            description: Role name, prefixed with 'role:' e.g. `role:ADMIN`
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Get Role
      tags:
      - Users and Roles
      x-drata-permissions:
      - role-get
      x-product-area:
      - RBAC
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /roles/{roleId}/users:
    get:
      description: 'List all Users that have a specific Role assigned.


        🔒 Requires **Users: List Users** permission.'
      operationId: RolesPublicV2Controller_listUsers
      parameters:
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UserExpandEnum'
      - name: firstName
        required: false
        in: query
        description: Filter users whose first name starts with the provided value (prefix match). For example, `firstName=John` matches users named John, Johnathan, Johnny, etc.
        schema:
          example: John
          type: string
      - name: lastName
        required: false
        in: query
        description: Filter users whose last name starts with the provided value (prefix match). For example, `lastName=Sm` matches users named Smith, Smithson, etc.
        schema:
          example: Doe
          type: string
      - name: roleId
        required: true
        in: path
        description: An integer Role ID or name prefixed with `role:`
        schema:
          oneOf:
          - type: number
            description: Role ID
          - type: string
            description: Role name, prefixed with 'role:' e.g. `role:ADMIN`
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Users with Role
      tags:
      - Users and Roles
      x-drata-permissions:
      - users-get
      x-product-area:
      - RBAC
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /users:
    get:
      description: 'Find Users matching the provided filters.


        🔒 Requires **Users: List Users** permission.'
      operationId: UsersPublicV2Controller_listUsers
      parameters:
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UserExpandEnum'
      - name: firstName
        required: false
        in: query
        description: Filter users whose first name starts with the provided value (prefix match). For example, `firstName=John` matches users named John, Johnathan, Johnny, etc.
        schema:
          example: John
          type: string
      - name: lastName
        required: false
        in: query
        description: Filter users whose last name starts with the provided value (prefix match). For example, `lastName=Sm` matches users named Smith, Smithson, etc.
        schema:
          example: Doe
          type: string
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Users
      tags:
      - Users and Roles
      x-drata-permissions:
      - users-get
      x-product-area:
      - TBD
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
  /users/{userId}:
    get:
      description: 'Get the full detail of a User record.


        🔒 Requires **Users: Get User** permission.'
      operationId: UsersPublicV2Controller_getUser
      parameters:
      - name: expand[]
        required: false
        in: query
        description: List of subcollections and sub-objects to expand
        schema:
          type: array
          items:
            $ref: '#/components/schemas/UserExpandEnum'
      - name: userId
        required: true
        in: path
        description: A Drata integer ID or an email address of the form 'email:value'.
        schema:
          oneOf:
          - type: number
          - type: string
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Get User
      tags:
      - Users and Roles
      x-drata-permissions:
      - user-get
      x-product-area:
      - TBD
    servers:
    - url: https://public-api.drata.com/public/v2
    - url: https://public-api.eu.drata.com/public/v2
    - url: https://public-api.apac.drata.com/public/v2
components:
  schemas:
    ExceptionResponseDto:
      type: object
      properties:
        statusCode:
          type: number
        message:
          type: string
        code:
          type: number
        debugInfo:
          type: object
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
          required:
          - name
          - message
      required:
      - statusCode
      - message
      - code
    UserResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: 1
          description: User ID
        email:
          type: string
          example: email@example.com
          description: User email
        firstName:
          type:
          - string
          - 'null'
          example: Sally
          description: User first name
        lastName:
          type:
          - string
          - 'null'
          example: Smith
          description: User last name
        createdAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User created at
        updatedAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User last updated at
        jobTitle:
          type:
          - string
          - 'null'
          example: CEO
          description: User job title
        avatarUrl:
          type:
          - string
          - 'null'
          example: https://cdn-prod.imgpilot.com/avatar.png
          description: User avatar URL
        drataTermsAgreedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User agreed to the Drata terms date timestamp
        roles:
          example:
          - ROLE
          - ANOTHER_ROLE
          description: User roles, only returned when `expand[]=roles` is passed.
          type: array
          items:
            type: string
        backgroundChecks:
          description: The Background Checks array DTO, only returned when `expand[]=backgroundChecks` is passed.
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/BackgroundCheckResponsePublicV2Dto'
        documents:
          description: Full list of user documents, only returned when `expand[]=documents` is passed.
          type: array
          items:
            $ref: '#/components/schemas/UserDocumentResponsePublicV2Dto'
        identities:
          description: User identities, only returned when `expand[]=identities` is passed.
          type: array
          items:
            $ref: '#/components/schemas/UserIdentityResponsePublicV2Dto'
      required:
      - id
      - email
      - createdAt
      - updatedAt
    ConnectionCompactResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: '1'
          description: The Connection ID
        clientType:
          type: string
          enum:
          - GOOGLE
          - OKTA
          - MICROSOFT_365
          - AWS
          - GCP
          - AZURE
          - HEROKU
          - GITHUB
          - GITLAB
          - BITBUCKET
          - SHORTCUT
          - JIRA
          - ASANA
          - GUSTO
          - KARMACHECK
          - GITHUB_ISSUES
          - RIPPLING
          - CERTN
          - MERGEDEV_ADP_WORKFORCE_NOW
          - MERGEDEV_BAMBOO_HR
          - MERGEDEV_HR_PARTNER
          - MERGEDEV_HI_BOB
          - MERGEDEV_HUMAANS
          - MERGEDEV_PERSONIO
          - MERGEDEV_SAGE
          - DIGITAL_OCEAN
          - MERGEDEV_KALLIDUS
          - MERGEDEV_TRINET
          - MERGEDEV_TRINET_HR
          - MERGEDEV_FRESHTEAM
          - MERGEDEV_SAP_SUCCESSFACTORS
          - TRELLO
          - GITLAB_ISSUES
          - MERGEDEV_JUSTWORKS
          - LINEAR
          - PIVOTAL_TRACKER
          - WORK_OS
          - MERGEDEV_PAYLOCITY
          - MONGO_DB_ATLAS
          - TARGET_PROCESS
          - CLICKUP
          - CHECKR
          - MERGEDEV_WORKDAY
          - ZOHO
          - CLOUDFLARE
          - JAMF
          - AZURE_BOARDS
          - AZURE_REPOS
          - MERGEDEV_HR_CLOUD
          - INTUNE
          - OKTA_IDENTITY
          - GOODHIRE
          - KANDJI
          - AWS_CODECOMMIT
          - FIBERY
          - CURRICULA
          - JUMPCLOUD
          - HEXNODE_UEM
          - RIPPLING_MDM
          - AWS_ORG_UNITS
          - KNOWBE4
          - MERGEDEV_UKG_PRO
          - MERGEDEV_UKG_READY
          - DATADOG
          - SLACK
          - DOCUSIGN
          - MICROSOFT_TEAMS
          - AWS_INSPECTOR
          - MERGEDEV_ONELOGIN
          - MERGEDEV_JUMPCLOUD
          - CONFLUENCE
          - WORKSPACE_ONE
          - NEW_RELIC
          - MERGEDEV_SERVICENOW
          - RAPID7
          - MERGEDEV_AHA
          - MERGEDEV_BASECAMP
          - MERGEDEV_BITBUCKET
          - MERGEDEV_FRESHDESK
          - MERGEDEV_FRESHSERVICE
          - MERGEDEV_HEIGHT
          - MERGEDEV_HIVE
          - MERGEDEV_TEAMWORK
          - MERGEDEV_WRIKE
          - MERGEDEV_ZENDESK
          - CSV_IDP
          - APIDECK
          - AWS_GOV_CLOUD
          - SENTINEL_ONE
          - MERGEDEV_NAMELY
          - MERGEDEV_INSPERITY_PREMIER
          - MERGEDEV_DAYFORCE
          - MERGEDEV_ALEXISHR
          - MERGEDEV_BREATHE
          - MERGEDEV_CHARLIE
          - MERGEDEV_CHARTHOP
          - MERGEDEV_DEEL
          - MERGEDEV_FACTORIAL
          - MERGEDEV_INTELLIHR
          - MERGEDEV_KEKA
          - MERGEDEV_LUCCA
          - MERGEDEV_OFFICIENT
          - MERGEDEV_PAYCHEX
          - MERGEDEV_PEOPLE_HR
          - MERGEDEV_OYSTERHR
          - MERGEDEV_PAYCOR
          - HUBSPOT
          - ZOOM
          - AUTH0
          - SENTRY
          - ZAPIER
          - SNOWFLAKE
          - MIRO
          - MERGEDEV_EMPLOYMENT_HERO
          - SEGMENT
          - WIZ
          - XERO
          - GITHUB_CODE
          - ATLASSIAN
          - PAGER_DUTY
          - STACKONE_SMARTRECRUITERS
          - STACKONE_TEAMTAILOR
          - CROWDSTRIKE
          - GITHUB_ENTERPRISE
          - NOTION
          - STACKONE_KLAVIYO
          - STACKONE_LASTPASS
          - STACKONE_LEAPSOME
          - STACKONE_LEVER
          - STACKONE_ORACLEHCM
          - STACKONE_PINPOINT
          - STACKONE_PIPEDRIVE
          - STACKONE_RECRUITEE
          - STACKONE_WEBEX
          - STACKONE_WORKABLE
          - STACKONE_ZELT
          - STACKONE_BITWARDEN
          - STACKONE_SALESLOFT
          - STACKONE_DIXA
          - STACKONE_FRESHSALES
          - STACKONE_CANVA
          - STACKONE_GREENHOUSE
          - STACKONE_ASHBY
          - STACKONE_ATTIO
          - STACKONE_CONTENTFUL
          - COVERDASH
          - MERGEDEV_FRONT
          - SALESFORCE
          - STACKONE_ELASTIC
          - STACKONE_RENDER
          - STACKONE_TERRAFORM
          - STACKONE_DOMO
          - STACKONE_ENVOY
          - STACKONE_SCALEWAY
          - STACKONE_JETBRAINS
          - STACKONE_FIVETRAN
          - STACKONE_INTERCOM
          - STACKONE_AUTODESK
          - GITHUB_ACTIONS
          - AZURE_ORG_UNITS
          - MICROSOFT_365_GCC_HIGH
          - STACKONE_AIRCALL
          - STACKONE_15FIVE
          - STACKONE_ROLLBAR
          - STACKONE_EGNYTE
          - STACKONE_QLIK
          - STACKONE_BULLHORN
          - STACKONE_OPENVPN
          - STACKONE_SOPHOS
          - STACKONE_MEISTERTASK
          - STACKONE_TALENTLMS
          - STACKONE_ONEFLOW
          - STACKONE_RING_CENTRAL
          - STACKONE_ARTICULATE
          - STACKONE_DIALPAD
          - STACKONE_TABLEAU
          - AZURE_DEVOPS
          - STACKONE_1PASSWORD
          - STACKONE_MIXPANEL
          - STACKONE_SONARCLOUD
          - STACKONE_TWILIO
          - STACKONE_ANSIBLE
          - STACKONE_LATTICE
          - STACKONE_WEBFLOW
          - STACKONE_LACEWORK
          - STACKONE_DATABRICKS
          - STACKONE_IFS
          - STACKONE_TRAVISCI
          - STACKONE_MATILLIONETL
          - STACKONE_OPTIMIZELY
          - UAR_CSV
          - STERLING
          - HIRERIGHT
          - VETTY
          - MERGEDEV_CYBERARK
          - SALESFORCE_UAR
          - GOOGLE_ADMIN_CONSOLE
          - VERCEL
          - STACKONE_DUO
          - STACKONE_GONG
          - STACKONE_IRONCLAD
          - STACKONE_SCORO
          - STACKONE_TEAMVIEWER_REMOTE
          - STACKONE_SPOTDRAFT
          - STACKONE_SPENDESK
          - STACKONE_SENDGRID
          - STACKONE_SMARTSHEET
          - STACKONE_CHECKMK
          - LEEN_TENABLE
          - LEEN_QUALYS
          - LEEN_SEMGREP
          - LEEN_SNYK
          - LEEN_CROWDSTRIKE_VMS
          - LEEN_MS_DEFENDER_VMS
          - LEEN_SENTINELONE_VMS
          - GITLAB_ON_PREM
          - CUSTOM
          - LEEN_RAPID7_VMS
          - BAMBOO_HR
          - GITLAB_ISSUES_ON_PREM
          - GITHUB_ISSUES_ENTERPRISE
          - BITBUCKET_CODE
          - LEEN_ARNICA
          - STACKONE_NETLIFY
          - STACKONE_OPENAI
          - KOLIDE
          - MERGEDEV_JIRA_DATA_CENTER
          - MERGEDEV_PINGONE
          - GOOGLE_ADMIN_CONSOLE_OAUTH
          - GOOGLE_OAUTH
          - STACKONE_ANTHROPIC
          - INTUNE_GCC_HIGH
          - STACKONE_DROPBOX
          - STACKONE_DROPBOX_SIGN
          - STACKONE_HARVEST
          - STACKONE_KAMELEOON
          - STACKONE_MAKE
          - STACKONE_RETOOL
          - STACKONE_TOGGL
          - STACKONE_BOX
          - MERGEDEV_ZOHO_PEOPLE
          - MERGEDEV_ZOHO_DESK
          - LEEN_WIZ_VMS
          - LEEN_WIZ_CODE
          - LEEN_AIKIDO
          - MERGEDEV_LATTICE_HRIS
          - MERGEDEV_DARWINBOX
          - MERGEDEV_PAYCOM
          - AZURE_GCC_HIGH
          - AZURE_MG_GCC_HIGH
          - STACKONE_EASY_LLAMA
          - MERGEDEV_LEAPSOME
          - CUSTOM_XFA
          - LEEN_MS_DEFENDER_VMS_GCC_HIGH
          - STACKONE_CORNERSTONE
          - STACKONE_DOCEBO
          - STACKONE_GO1
          - STACKONE_LINKEDIN_LEARNING
          - STACKONE_SAP_LEARNING
          - STACKONE_WORKDAY_LEARNING
          - STACKONE_360LEARNING
          - STACKONE_BRAINIER
          - STACKONE_COURSERA
          - STACKONE_XYLEME
          - STACKONE_INFOSEC
          - STACKONE_PEOPLE_FLUENT
          - STACKONE_UDEMY
          - AIKIDO
          - AZURE_ENTRA_ID
          - GOOGLE_CLOUD_IDENTITY
          - HYPERCOMPLY
          - INTRUDER
          - IRIS_AI
          - JIT
          - TINES
          - TORQ
          - TRAY
          - SWIF
          - LEEN_ORCA_SECURITY
          - ZIP
          - CUSTOM_MDM
          - LEEN_UPWIND
          - WORK_OS_SCIM
          - LEEN_GITLAB_VMS
          - NINJAONE_MDM
          - FIELDGUIDE
          - OKTA_OAUTH
          - IRONCLAD_VENDOR
          - CUSTOM_HRIS
          - RAMP
          - TROPIC_VENDOR
          - AZURE_BOARDS_ENTRA
          - AZURE_REPOS_ENTRA
          - AZURE_DEVOPS_ENTRA
          - CERTN_CENTRIC
          - DATAGRAIL
          - LEEN_SOCKET
          example: GOOGLE
          description: The client type
        clientId:
          type:
          - string
          - 'null'
          example: drata.com
          description: The client id from the external system associated to this connection
        clientAlias:
          type:
          - string
          - 'null'
          example: My-connection-alias-1
          description: Alias for the connection
        state:
          type: string
          enum:
          - ACTIVE
          - MISCONFIGURED
          example: ACTIVE
          description: The state of the connection
        createdAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When this connection was created
        updatedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When this connection was last updated
        connectedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When this connection was successfully established
        failedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When this connection failed
        deletedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When the connection was deleted
      required:
      - id
      - clientType
      - clientId
      - clientAlias
      - state
      - createdAt
      - updatedAt
      - connectedAt
      - failedAt
      - deletedAt
    RoleResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: 1
          description: Role ID
        role:
          example: ADMIN
          description: Role type
          allOf:
          - $ref: '#/components/schemas/RoleEnum'
        createdAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: Role created at
        updatedAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: Role last updated at
        permissions:
          description: Permissions associated with this Role, only returned when `expand[]=permissions` is passed.
          type: array
          items:
            $ref: '#/components/schemas/PermissionResponsePublicV2Dto'
      required:
      - id
      - role
      - createdAt
      - updatedAt
    PermissionResponsePublicV2Dto:
      type: object
      properties:
        id:
          type:
          - number
          - 'null'
          deprecated: true
          example: null
          description: 'Deprecated: no longer provided. Always returns `null`.'
        action:
          example: READ
          description: Permission action
          allOf:
          - $ref: '#/components/schemas/ActionEnum'
        subject:
          example: Asset
          description: Permission subject
          allOf:
          - $ref: '#/components/schemas/SubjectEnum'
        createdAt:
          type:
          - string
          - 'null'
          format: date-time
          deprecated: true
          description: 'Deprecated: no longer provided. Always returns `null`.'
      required:
      - action
      - subject
    ActionEnum:
      type: string
      enum:
      - READ
      - MANAGE
      - CREATE
      - UPDATE
      - DELETE
    RoleEnum:
      type: string
      enum:
      - EMPLOYEE
      - TECHGOV
      - AUDITOR
      - ADMIN
      - ACT_AS_READ_ONLY
      - APP
      - RISK_MANAGER
      - WORKSPACE_ADMINISTRATOR
      - SERVICE_USER
      - REVIEWER
      - CONTROL_MANAGER
      - PEOPLE_OPS
      - POLICY_MANAGER
      - DEVOPS_ENGINEER
      - KNOWLEDGE_BASE
      - TRUST_CENTER_MANAGER
      - TRUST_CENTER_REVIEWER
      - RISK_REGISTER_OWNER
      - INTERNAL_AUDITOR
      - RESTRICTED_CONTROL_MANAGER
      - RESTRICTED_RISK_MANAGER
      - READONLY_ADMIN
      - READONLY_TECHGOV
      - READONLY_RISK_MANAGER
      - READONLY_CONTROL_MANAGER
      - READONLY_POLICY_MANAGER
      - READONLY_PEOPLE_OPS
      - READONLY_WORKSPACE_ADMINISTRATOR
      - READONLY_RESTRICTED_CONTROL_MANAGER
      - READONLY_RESTRICTED_RISK_MANAGER
      - READONLY_RISK_REGISTER_OWNER
      - READONLY_REVIEWER
      - READONLY_DEVOPS_ENGINEER
      - READONLY_TRUST_CENTER_MANAGER
      - TRUST_USER
    UserExpandEnum:
      type: string
      enum:
      - backgroundChecks
      - documents
      - personnel
      - identities
      - roles
    SortDirectionEnum:
      type: string
      enum:
      - ASC
      - DESC
    UsersResponsePublicV2Dto:
      type: object
      properties:
        data:
          description: Data set based on the pagination limits
          type: array
          items:
            $ref: '#/components/schemas/UserResponsePublicV2Dto'
        pagination:
          $ref: '#/components/schemas/PaginationTotalCountResponsePublicV2Dto'
      required:
      - data
      - pagination
    RoleExpandEnum:
      type: string
      enum:
      - permissions
    SignedUrlResponsePublicV2Dto:
      type: object
      properties:
        signedUrl:
          type: string
          example: https://somedomain.com/filename.pdf?Signature=ABC123
          description: The short lived signed URL to link directly to the private file
        fileBuffer:
          type:
          - object
          - 'null'
          description: The file on buffer format. This only applies for txt files.
          example:
            buffer: RXhhbXBsZSB0ZXh0IGNvbnRlbnQ=
        fileName:
          type:
          - string
          - 'null'
          example: Artifact 3.png
          description: Resolved download filename, extension-repaired server-side. Null when the endpoint does not provide one.
      required:
      - signedUrl
      - fileBuffer
      - fileName
    UserDocumentResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: 1
          description: User document ID
        userId:
          type: number
          description: The User ID the Document belongs to
        downloadUrl:
          description: The signed URL to download the User Document, only returned when `expand[]=downloadUrl` is passed.
          allOf:
          - $ref: '#/components/schemas/SignedUrlResponsePublicV2Dto'
        name:
          type: string
          example: Security Training
          description: The name the file
        type:
          type: string
          enum:
          - SEC_TRAINING
          - PASSWORD_MANAGER_EVIDENCE
          - AUTO_UPDATES_EVIDENCE
          - HARD_DRIVE_ENCRYPTION_EVIDENCE
          - ANTIVIRUS_EVIDENCE
          - LOCK_SCREEN_EVIDENCE
          - MFA_EVIDENCE
          - HIPAA_TRAINING_EVIDENCE
          - OFFBOARDING_EVIDENCE
          - NIST_AI_TRAINING_EVIDENCE
          example: SEC_TRAINING
          description: The User Document type
        fileUrl:
          type:
          - string
          - 'null'
          example: http://localhost:5000/download/documents/1
          description: The secure URL to the user document
        renewalDate:
          type: string
          format: date
          example: '2026-10-27'
          description: Document's renewal date, after which the document is no longer consider valid evidence
        createdAt:
          type: string
          format: date-time
          example: '2020-07-06'
          description: Document created at
        updatedAt:
          type: string
          format: date-time
          example: '2020-07-06'
          description: Document updated at
      required:
      - id
      - userId
      - name
      - type
      - fileUrl
      - renewalDate
      - createdAt
      - updatedAt
    BackgroundCheckResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          description: The Background Check Id
        userId:
          type:
          - number
          - 'null'
          description: The user ID
        status:
          type: string
          enum:
          - PENDING
          - OK
          - ISSUE
          - CANCELED
          - EXPIRED
          - OUT_OF_SCOPE
          example: OK
          description: The status of the background check
        caseId:
          type:
          - string
          - 'null'
          example: abc123
          description: The case ID of the KarmaCheck background check
        caseInvitationId:
          type: string
          example: abc123
          description: The case invitation ID of the KarmaCheck background check
        url:
          type: string
          example: https://app-stage.karmacheck.com/background_check/aaaaaaaa-bbbb-0000-cccc-dddddddddddd
          description: The URL of the background check
        manualCheckDate:
          type:
          - string
          - 'null'
          format: date
          example: '2020-07-06'
          description: The date this background check was manually uploaded
        manuallyCheckUrl:
          type:
          - string
          - 'null'
          example: url.com
          description: The url of manual background check
        type:
          type: string
          enum:
          - KARMACHECK
          - MANUAL
          - CERTN
          - CHECKR
          - HRIS_RIPPLING
          - STERLING
          - HIRERIGHT
          - VETTY
          example: CERTN
          description: The background check type
        source:
          type:
          - string
          - 'null'
          enum:
          - DRATA
          - CHECKR
          - KARMACHECK
          - RIPPLING_CHECKR
          - CERTN
          - STERLING
          - HIRERIGHT
          - VETTY
          example: DRATA
          description: The background check source
        reportData:
          type: string
          description: The background check report data
        outOfScopeReason:
          type:
          - string
          - 'null'
          example: abc123
          description: the reason it was marked out of scope
        outOfScopeAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When it was marked out of scope
        invitationEmail:
          type:
          - string
          - 'null'
          example: email@email.com
          description: Invitation email
        linkedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When the report was linked to a user
        createdAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: Report created date timestamp
        updatedAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: Report updated date timestamp
      required:
      - id
      - userId
      - status
      - caseId
      - caseInvitationId
      - url
      - manualCheckDate
      - manuallyCheckUrl
      - type
      - source
      - reportData
      - outOfScopeReason
      - outOfScopeAt
      - invitationEmail
      - linkedAt
      - createdAt
      - updatedAt
    SubjectEnum:
      type: string
      enum:
      - AdminOnboarding
      - Asset
      - AuditHub
      - Company
      - CompanyDocument
      - Connection
      - Control
      - ControlTestInstance
      - CustomerRequest
      - CustomTask
      - Event
      - Framework
      - Personnel
      - Policy
      - PublicApiKey
      - QuestionnairesVendors
      - Report
      - Risk
      - RiskAssessment
      - ServiceUser
      - Ticket
      - TrustCenter
      - ListAllUsers
      - UserIdentity
      - UserIdentityInfrastructure
      - UserIdentityVersionControl
      - UsersRoles
      - Vendor
      - Vulnerability
      - Note
      - UserFeature
      - Monitors
      - Dashboard
      - UserDocument
      - Autopilot
      - MonitorInstanceExclusion
      - Workspace
      - InternalSecurity
      - ComplianceCheckExclusion
      - UserLanguage
      - SecurityReport
      - Resync
      - UserIdentityObservability
      - SignIn
      - FeatureAnnouncement
      - Wysiwyg
      - RemoteAccess
      - EmployeeOnboarding
      - UserIdentitiesAccess
      - TicketManagement
      - HumanResources
      - UserControls
      - TasksDetails
      - ControlList
      - ControlTicket
      - RiskManagementTicket
      - MonitorTicket
      - CreateTicket
      - DeleteTask
      - UpdateTask
      - CreateTask
      - AssociateRequirements
      - GetGroups
      - WorkspaceConnections
      - TrustCenterInfo
      - GlobalConnection
      - RiskTask
      - GeneralTask
      - ControlTask
      - EvidenceTask
      - PolicyTask
      - VendorTask
      - AccessReview
      - RiskSettings
      - Scan
      - RiskDocument
      - ViewAllControls
      - ViewAllRisks
      - ControlTemplate
      - FrameworkMappingReset
      - ActivateFramework
      - CustomFields
      - CaCConfiguration
      - CaCMonitoring
      - AccessReviewTicket
      - SecurityQuestionnaire
      - Findings
      - ExceptionManagement
      - CustomWorkflows
      - VulnerabilityReport
      - CustomConnections
      - UserSettings
      - KnowledgeBase
      - TrustCenterRequest
      - BulkImportRisk
      - TestLibrary
      - RiskRegisters
      - BulkImportControl
      - BulkImportTraining
      - BulkImportBackgroundCheck
      - BulkImportVendor
      - RiskCategory
      - Audit
      - GroupRoleManagement
      - BulkImportCustomTask
      - UserIdentityHris
      - Requirements
      - BulkImportPolicyAcknowledgment
      - BulkImportAsset
      - Groups
      - Task
      - ExecutiveDashboard
      - PolicyLanguage
      - BulkImportEvidence
      - Webhooks
      - ALL
      - DenyControl
    ExceptionResponsePublicV2Dto:
      type: object
      properties:
        name:
          type: string
        statusCode:
          type: number
        message:
          type: string
        code:
          type: number
        debugInfo:
          type: object
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
          required:
          - name
          - message
      required:
      - name
      - statusCode
      - message
      - code
    UserIdentityResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: 1
          description: User identity ID
        identityId:
          type: string
          example: 1a2b3c
          description: External service unique id
        username:
          type:
          - string
          - 'null'
          example: johndoe
          description: External service username
        connectedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When this external user was linked to an application user
        disconnectedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: When this external user was unlinked to an application user
        hasMfa:
          type:
          - boolean
          - 'null'
          example: true
          description: Indicates the external user MFA status
        userId:
          type:
          - number
          - 'null'
          example: 1
          description: The user ID
        connectionId:
          type:
          - number
          - 'null'
          example: 1
          description: The connection ID
        connection:
          description: Connection details
          allOf:
          - $ref: '#/components/schemas/ConnectionCompactResponsePublicV2Dto'
        email:
          type:
          - string
          - 'null'
          example: johndoe@example.com
          description: Primary email for user identity
        secondaryEmail:
          type:
          - string
          - 'null'
          example: johndoe@test.com
          description: Secondary email for user identity
        firstName:
          type:
          - string
          - 'null'
          example: John
          description: First name
        lastName:
          type:
          - string
          - 'null'
          example: Doe
          description: Last name
        startedAt:
          type:
          - string
          - 'null'
          format: date-time
          example: Thu Aug 27 2026
          description: Start (hire) date for the user.
        separatedAt:
          type:
          - string
          - 'null'
          format: date-time
          description: Separation (termination) date for the user. Null indicates a current employee.
          example: Thu Aug 27 2026
        isContractor:
          type:
          - boolean
          - 'null'
          example: true
          description: Is the user a contractor? Null indicates no information is available.
        jobTitle:
          type:
          - string
          - 'null'
          example: Engineer
          description: Job title
        managerId:
          type:
          - string
          - 'null'
          example: x00jk12-2312
          description: Manager's identity id
        managerName:
          type:
          - string
          - 'null'
          example: Jose Díaz
          description: Manager's full name
        createdAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User identity created at
        updatedAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User identity last updated at
      required:
      - id
      - identityId
      - username
      - connectedAt
      - disconnectedAt
      - hasMfa
      - userId
      - connectionId
      - connection
      - email
      - secondaryEmail
      - firstName
      - lastName
      - startedAt
      - separatedAt
      - jobTitle
      - managerId
      - managerName
      - createdAt
      - updatedAt
    PaginationTotalCountResponsePublicV2Dto:
      type: object
      properties:
        cursor:
          type:
          - string
          - 'null'
          description: When this is not null, it indicates there is additional data. Pass this value in to the `cursor` parameter to fetch the next page of data.
        totalCount:
          type:
          - number
          - 'null'
          description: Total count of all matching items (not limited by page size). Only included when `includeTotalCount=true` is passed on the first page (no cursor).
      required:
      - cursor
    RolesResponsePublicV2Dto:
      type: object
      properties:
        data:
          description: Data set based on the pagination limits
          type: array
          items:
            $ref: '#/components/schemas/RoleResponsePublicV2Dto'
        pagination:
          $ref: '#/components/schemas/PaginationTotalCountResponsePublicV2Dto'
      required:
      - data
      - pagination
    SortTypeLimitedEnum:
      type: string
      enum:
      - createdAt
      - updatedAt
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: API_KEY
      type: http
x-refined-from:
- drata-api-v2-openapi.json
- drata-api-v2-openapi.yml