VAvanta
Audits

Create a comment for a control within an audit

Creates a new comment on a control within an IRL audit. The comment author must be an auditor in the audit firm making the request. The comment will be associated with the control and visible to all authorized users.

Returns 404 when the control is not part of the audit.

Rate limit: 50 requests / minute.

post/audits/{auditId}/controls/{controlId}/comments

Request

Path parameters

auditIdstring required
controlIdstring required

Request body

textstring required

The text content of the comment. Must be at least 1 character. Can include questions, clarifications, or explanations related to the control.

emailstring required

Email address of the comment author. Must match an existing Vanta user who belongs to the audit firm making the API request. This email uniquely identifies the author across systems.

creationDatestring date-time required

Timestamp when the comment was created in the external audit management system. This allows synchronizing comment timestamps from external systems. Format: ISO 8601 UTC timestamp.

Response

Ok

idstring required

The unique identifier for the comment within Vanta's system. Format: ObjectId as a string (e.g., "6890e473dce1da5d8406f5e7").

textstring required

The comment message content. Can include explanations, questions, or clarifications about the control.

creationDatestring date-time required

Timestamp when the comment was created. Format: ISO 8601 UTC timestamp.

modificationDatestring date-time nullable required

Timestamp when the comment was last edited. Null if the comment has never been modified. Format: ISO 8601 UTC timestamp.

deletionDatestring date-time nullable required

Timestamp when the comment was soft-deleted. Null if the comment has not been deleted. Soft deletes retain the comment for audit history while hiding it from normal operations. Format: ISO 8601 UTC timestamp.

emailstring nullable required

Email address of the comment author. This email uniquely identifies users between Vanta and external audit systems. Null when the comment author can't be matched to a Vanta user.

authorNamestring nullable required

Human-readable display name of the comment author. Null if the author's name is not available (e.g., user was deleted). This enables correct author attribution in integrations where users cannot be reliably matched across systems by email alone.

Changes

No recorded changes to this operation across all 1 revision of this API.