Sign in Start free

Push evidence to Drata or Sprinto

Connect Drata or Sprinto, map ApiTraffic's controls to yours, and each month's signed evidence pack is uploaded to the mapped controls.

This page as Markdown

If your compliance program runs in Drata or Sprinto, ApiTraffic can upload each month’s evidence pack to the controls or monitors it backs, so the evidence is there when your auditor looks, without anyone downloading and uploading files.

Before you begin

  • Plan: your plan includes Compliance and Compliance platform push.
  • Roles: account owners and admins connect platforms and map controls, signed in. Everyone on the team can see the connections.
  • Packs: the monthly account-wide packs are pushed, one per framework that is on. Environment packs (see Separate packs for in Compliance settings) stay in ApiTraffic.

Connect Drata

  1. In Drata, open Settings, then API keys, and create a key with these permissions: Workspaces: List Workspaces, Controls (read) and Evidence Library: Create Evidence.
  2. In ApiTraffic, open Compliance in the All buckets menu, then Compliance platforms, and select Connect for Drata.
  3. Paste the key and choose your Drata region (NA, EU or APAC). Leave Workspace empty if you have one workspace.
  4. Select Connect. ApiTraffic checks the key with Drata before saving it. If the key sees several workspaces, choose the one evidence goes to.

The key is stored encrypted and never shown again; the page shows its last four characters. Drata allows 500 requests a minute from one address, so pushes are spread out and retried when Drata is busy.

Connect Sprinto

  1. In Sprinto, open Settings, then Developer API, and create a token as an admin.
  2. In ApiTraffic, select Connect for Sprinto, paste the token and choose your region.
  3. Select Connect. ApiTraffic checks the token by listing your monitors.

Sprinto’s API is in beta. If Sprinto refuses to list monitors with the token, the connection says so.

Map your controls

A connection needs a mapping before anything is pushed: which of your platform’s controls (Drata) or monitors (Sprinto) each ApiTraffic control’s evidence goes to.

  1. On the connection, select Map controls. ApiTraffic lists the controls of the frameworks you have on, each with a suggested match from your platform.
  2. Select Use suggestions to fill in every suggestion, then check each one and change any that is wrong. Leave a control Not mapped to keep its evidence only in the pack.
  3. Select Save mapping.

Every change to the mapping is recorded in the account history.

What is uploaded

On the 2nd of each month, as each framework’s account-wide pack for the month is built, it is pushed to every connected platform. With SOC 2, PCI DSS and HECVAT on, that is three packs a month:

  • Drata: each file is uploaded, then one evidence item is created with every file, linked to every mapped control. Its name carries the pack’s id, so a retry never creates a second one.
  • Sprinto: the files are uploaded to each mapped monitor, ten at a time. Each monitor is recorded as it is done, so a retry never uploads to it twice.

Platforms limit the size of a file (Drata about 25 MB, Sprinto 10 MB). The pack’s summary.pdf, manifest.json and manifest.sig go as they are; its CSV files go byte for byte inside evidence-part-1.zip and on, each under the limit, with an upload-index.json saying which part holds which file. The signed manifest is never rewritten, so your auditor checks every file against it after unzipping.

To push an earlier pack, choose it under Push an account-wide pack now and select Push. A pack that failed to push is tried again.

Connection status

Status Meaning
Connected Monthly packs are pushed to the mapped controls.
Needs mapping No control is mapped, so packs are not pushed. Map controls.
Failing Pushing has failed on three days in a row. The last error is shown.
Credential refused The platform refused the key or token. Nothing is pushed until you connect again with a new one.

Each push, and a connection becoming failing or refused, is recorded in the account history.

Disconnect

Select Disconnect on the connection. The key or token is destroyed, and the mapping and push history are removed. Evidence already in your platform stays there.

Purges

Purging rules and settings removes the mappings: connections then need mapping again. Purging automations and integrations removes the connections. See Account data.