Drata is a compliance automation platform. It tracks the frameworks your organization is certifying against and the controls within them. It also tracks the tests that monitor those controls and the evidence supporting them. This guide shows you how to create a Drata API key, find your data region, and configure the integration.
Before you begin, ensure that you have:
- Access to a Drata account with administrator permissions for the organization you are integrating
- Permission to create and manage API keys in Drata
Drata asks you to choose an access level when you create the key.
| Access level | Purpose |
|---|---|
| All read | Read everything the integration needs, including resources Drata adds later. The integration only reads |
| Custom | Read only the resources you select |
| All read and write | More access than the integration uses |
If you choose Custom, grant read access to each of these resources:
- Workspaces
- Controls
- Monitors
- Devices
- Personnel
- Evidence Library
- Frameworks
Leaving one of these out of a Custom key produces a permission error that names the failing request but not the missing scope. You can add scopes to an existing key without creating a new one, as long as it has not expired or been revoked.
Create the key in Drata's settings, following the Drata public API help article. Four things about that process affect the integration:
- Copy the key and store it in a safe location before you close the dialog. Drata shows it once and cannot retrieve it afterwards
- Choose an expiration you will track, or set it to
Never. The default is 12 months, and the integration stops authenticating when the key expires - Leave Allowed IP Addresses empty unless you have a reason to restrict it. Drata only accepts requests from the addresses listed there, and a list that leaves out the integration's addresses blocks every request
- Select the access level from the section above titled Required Permissions
An expired or revoked key cannot be returned to use. You have to create a new one and configure the integration with it.
Drata hosts tenants in three regions. Read yours from your Drata dashboard address. It carries the region code directly after /main/:
| Dashboard address | Region |
|---|---|
app2.drata.com/main/NA/... | NA |
app2.drata.com/main/EU/... | EU |
app2.drata.com/main/APAC/... | APAC |
NA covers North America, EU the European Union, and APAC Asia-Pacific.
A key issued for one region is not valid in another. A region that does not match your tenant fails to authenticate even when the key is correct. Check the region first if authentication fails.
To configure a new Drata integration, provide each of the values as defined below:
| Integration Parameter | Description |
|---|---|
| Credential | This is the API key you created and stored above |
| Data Region | This is the region you found in the previous section |