Connects your application to your customers' Governance, Risk, and Compliance (GRC) platforms. Synqly supports reading compliance frameworks, controls, tests, evidence, and the compliance state of devices and personnel from the GRC platform.
The GRC Connector connects your application to your customers' compliance platforms, such as Secureframe and Vanta. It normalizes each vendor's compliance data into a single API so your integration works the same way regardless of which platform your customer uses.
A framework is a compliance standard the organization is tracking (SOC 2, ISO 27001, and so on). A control is a specific requirement within one or more frameworks. A test is an automated check that validates a control and carries a current pass/fail status. Controls carry their framework mappings in the standards field.
The /devices and /personnel operations return the compliance state of every device and person the platform tracks — compliant entities included — as OCSF Compliance Findings. Each finding carries the per-control verdicts in compliance.checks, with the device or person as the finding's subject.
A check the platform did not report is not reported as a failure. OCSF reserves status_id 2 (Warning) for a check that "did not yield a result due to missing information", which is exactly an unevaluated control, while 3 (Fail) asserts that a control was evaluated and failed. Such a check therefore appears in compliance.checks as Warning, and the finding's overall compliance.status_id is Fail if any check actually failed, otherwise Warning if any check was unevaluated, otherwise Pass.
The GRC connector implements pagination using a cursor. Responses return a cursor field which can be included in the next request to retrieve the next page of results. When the end is reached, an empty string is returned. The number of results is controlled with the limit query parameter, defaulting to 100.
Not every provider supports every field. For example, control status is available on the control detail endpoint but not always on the list endpoint, and requirement-level mapping is exposed by some providers but not others. Consult the capabilities API to determine what a given provider supports.
For full API documentation see the GRC API Reference.
To create an integration with the GRC connector, use the Create Integration API endpoint, using one of the provider configs below.
- Secureframe (
grc_secureframe)
| API | Secureframe |
|---|---|
| get_control | ✅ |
| query_controls | ✅ |
| get_device | ✅ |
| query_devices | ✅ |
| query_evidence | ✅ |
| query_frameworks | ✅ |
| get_personnel | ✅ |
| query_personnel | ✅ |
| get_test | ✅ |
| query_tests | ✅ |