Drata Integration

Feed Herd's training completions and policy attestations into Drata — a daily write-only push into your Drata Custom Connection, plus pull-based evidence feeds.

Overview

If Drata is your compliance platform, Herd can keep it supplied with evidence automatically, two ways:

• Push (built-in) — a write-only daily push: Herd upserts training framework completions and policy attestations into your Drata Custom Connection resources. Nothing is ever read back from Drata.

• Pull (API) — authenticated evidence feeds your GRC tooling can read from Herd on its own schedule.

Drata Custom Connections require a Drata Advanced or Enterprise plan (a Drata-side requirement).

---

Setting up the push

Under Settings → Integrations, open the Drata card (in the Dev & Compliance section) and expand Drata Connection Settings:

• Drata API Key — stored encrypted and never displayed again.

• Custom Connection ID (conn_…) — from Drata under Connections → Custom Connection.

• Framework Completions Resource ID (res_…) — the Drata resource to receive training framework completions.

• Policy Attestations Resource ID (res_…) — the Drata resource to receive policy attestations.

• Drata API Base URL — defaults to https://public-api.drata.com.

Click Save Drata Configuration. Herd pushes daily from then on; Sync now pushes immediately. The tile reports the last push with counts for Completions, Attestations, Created, Updated, and Errors.

To stop pushing, click Disable — evidence already in Drata is untouched.

---

Pull-based evidence feeds

For GRC tools that prefer to pull, Herd exposes evidence feeds on the platform API (authenticated with a Herd API key):

• GET /api/v1/integration/frameworks — your frameworks, each with a link to its completions feed.

• GET /api/v1/integration/frameworks/{framework}/completions — per-user, per-item completion evidence for a framework: user, item, status, completion date, due date, and an evidence URL. Append ?format=csv for an auditor-ready CSV download.

• GET /api/v1/integration/policy-attestations — policy-attestation evidence: who acknowledged which policy version, when, and over which delivery channel (SLACK, TEAMS, or EMAIL). For policies that require an evidence file, each row also carries evidence_file_count and evidence_file_names, so an auditor can see that a certificate was supplied alongside the acknowledgement.

The daily push carries the same delivery-channel and evidence-file fields into your Policy Attestations resource.

The same attestation evidence is available as a one-click Audit Export on the Policy Report (Reports → Policies).