# GRC Connector

Connects your application to your customers' Governance, Risk, and Compliance (GRC) platforms. Synqly supports reading compliance frameworks, controls, tests, evidence, and the compliance state of devices and personnel from the GRC platform.

The GRC Connector connects your application to your customers' compliance
platforms, such as Secureframe and Vanta. It normalizes each vendor's
compliance data into a single API so your integration works the same way
regardless of which platform your customer uses.

## Frameworks, controls, and tests

A **framework** is a compliance standard the organization is tracking (SOC 2,
ISO 27001, and so on). A **control** is a specific requirement within one or
more frameworks. A **test** is an automated check that validates a control and
carries a current pass/fail status. Controls carry their framework mappings in
the `standards` field.

## Devices and personnel

The `/devices` and `/personnel` operations return the compliance *state* of
every device and person the platform tracks — compliant entities included — as
OCSF Compliance Findings. Each finding carries the per-control verdicts in
`compliance.checks`, with the device or person as the finding's subject.

A check the platform did not report is **not** reported as a failure. OCSF
reserves `status_id` `2` (`Warning`) for a check that "did not yield a result
due to missing information", which is exactly an unevaluated control, while
`3` (`Fail`) asserts that a control was evaluated and failed. Such a check
therefore appears in `compliance.checks` as `Warning`, and the finding's
overall `compliance.status_id` is `Fail` if any check actually failed,
otherwise `Warning` if any check was unevaluated, otherwise `Pass`.

## Pagination

The GRC connector implements pagination using a cursor. Responses return a
`cursor` field which can be included in the next request to retrieve the next
page of results. When the end is reached, an empty string is returned. The
number of results is controlled with the `limit` query parameter, defaulting
to 100.

## Provider coverage

Not every provider supports every field. For example, control status is
available on the control detail endpoint but not always on the list endpoint,
and requirement-level mapping is exposed by some providers but not others.
Consult the [capabilities API](https://docs.synqly.com/api-reference/management/capabilities)
to determine what a given provider supports.

## API Reference

For full API documentation see the [GRC API Reference](/api-reference/connectors/grc).

To create an integration with the GRC connector, use the [Create Integration API](/api-reference/management/integrations/integrations_create) endpoint, using one of the provider configs below.

## Supported Providers

- Secureframe (`grc_secureframe`)


## Supported Operators by Provider

| API | Secureframe |
|  --- | --- |
| get_control | ✅ |
| query_controls | ✅ |
| get_device | ✅ |
| query_devices | ✅ |
| query_evidence | ✅ |
| query_frameworks | ✅ |
| get_personnel | ✅ |
| query_personnel | ✅ |
| get_test | ✅ |
| query_tests | ✅ |


## APIs with Filters

| API | Secureframe |
|  --- | --- |
| query_controls | ✅ [[docs](/guides/connectors/grc/query-filters#secureframe-filters-for-query_controls)] |
| query_devices | ✅ [[docs](/guides/connectors/grc/query-filters#secureframe-filters-for-query_devices)] |
| query_evidence | ✅ [[docs](/guides/connectors/grc/query-filters#secureframe-filters-for-query_evidence)] |
| query_personnel | ✅ [[docs](/guides/connectors/grc/query-filters#secureframe-filters-for-query_personnel)] |
| query_tests | ✅ [[docs](/guides/connectors/grc/query-filters#secureframe-filters-for-query_tests)] |