For audit firms · API preview

Pull evidence and status straight into your workpapers.

The Auditor Pull API gives your firm programmatic, read-only access to the Screenata engagements you already audit: evidence files with content hashes, test statuses, controls, and policies — from your own scripts and workpaper tooling instead of a browser portal.

Download the OpenAPI spec

The contract is published ahead of general availability so your engineers can review it and build against it. The API itself is rolling out with pilot firms — the spec is additive-only once live. Prefer to browse? Open the interactive reference.

How access works

Scoped to the access you already have. Visible to your client.

The token is your seat, nothing more

You mint a personal API token from the Auditor Center. It's bound to your auditor seat in the customer's workspace, and every request re-checks your per-cycle access. It can never see more than your login can — and when the engagement access is revoked, the token's reach dies with it.

Every read is logged for the customer

Each API call lands in the customer's auditor access log — which resources, which token, when. Your client sees exactly what your tooling pulled. Transparency is the feature, not an afterthought.

Read-only by design

There are no write endpoints in v1. Comments, evidence requests, and review actions stay in the Auditor Center. Your scripts can't change anything — so your firm's security review has very little to review.

Verifiable pulls

Evidence files carry a SHA-256 content hash in listings and an X-Content-Sha256 header on download. Audit packages carry a manifest hash. What you pulled is provably what the platform holds.

The surface

Eleven read endpoints. That's the whole API.

Everything is GET, everything is JSON in a versioned envelope (audit-api/1.0), and control identity is always the citation your report uses — CC6.1, not an internal id.

Endpoint	Returns
/v1/cycles	Every audit cycle your seat can access
/v1/cycles/{id}	Cycle detail + status rollup (tests by state, evidence counts)
/v1/cycles/{id}/controls	Controls tree with test-level statuses, by domain
/v1/cycles/{id}/evidence	Paginated evidence — submissions and files, filterable by review status
/v1/cycles/{id}/evidence/{kind}/{itemId}	One evidence item with linked files and hashes
/v1/cycles/{id}/evidence/file/{fileId}/content	File bytes, with X-Content-Sha256 for verification
/v1/cycles/{id}/submissions/{submissionId}	Submission detail with review-status history
/v1/cycles/{id}/policies	Policies submitted for the cycle
/v1/cycles/{id}/policies/{slug}	One policy with rendered content
/v1/cycles/{id}/packages	Prepared audit packages with manifestHash
/v1/cycles/{id}/packages/{packageId}/content	Package zip download

Three curl commands

If your team can write a script, they can integrate.

Terminal

# List the audits your seat can access
curl -H "Authorization: Bearer sk_audit_..." \
  https://api.screenata.com/api/audit/v1/cycles

# Pull evidence pending your review for one cycle
curl -H "Authorization: Bearer sk_audit_..." \
  "https://api.screenata.com/api/audit/v1/cycles/{cycleId}/evidence?reviewStatus=pending&limit=50"

# Download one evidence file and verify its hash
curl -OJ -H "Authorization: Bearer sk_audit_..." \
  "https://api.screenata.com/api/audit/v1/cycles/{cycleId}/evidence/file/{fileId}/content"
# → X-Content-Sha256 response header matches contentSha256 from the listing

Preview program

Auditing a Screenata customer? Get pilot access.

We're onboarding audit firms to the preview now. Review the spec with your engineers, tell us what your workflow needs, and we'll wire you in — your feedback shapes v1 before the contract freezes.

OpenAPI spec (JSON)

Your client stays in control: they grant and revoke your access, and see a log of every pull. Learn how the portal side works on the Auditor portal page.