Skip to main content
Connect Drata to let CloudThinker agents review failing tests, control readiness, and personnel compliance, and change records after you approve. Drata authenticates with an API key that you create in Drata.

​
Prerequisites

  • A Drata Admin account. Only Admins can open Settings → API Keys.
  • Your Drata region: North America, Europe, or Asia-Pacific.
  • A Drata admin who has accepted Drata’s terms for your account. Drata refuses API requests until they do.

​
Setup

1

Create an API key in Drata

In Drata, select your account at the bottom left, then Settings → API Keys, and click Create API Key. Set:
  • Name: cloudthinker. You cannot change the name later.
  • Expiration date: 12 months (the default), a custom date, or Never.
  • Allowed IP addresses: leave empty. A key limited to other addresses fails the connection test.
  • Access: All read to investigate only, or All read and write to let agents make approved changes.
Save the key and copy it. Drata shows the full key only once.
2

Add the connection in CloudThinker

Navigate to Connections → Drata and enter:
  • API key: the key you copied
  • Region: the region of your Drata account
Click Connect. CloudThinker calls Drata and shows a Connected status with your company name and region.
Drata shows the full key only once. If you lose it, create a new key. An expired or revoked key cannot be made active again.

​
Connection details

Each region uses its own Drata API address. Choose the region that matches your Drata account.

​
Required permissions

All read and All read and write also cover scopes that Drata adds later.
Start with All read. You can edit a key’s scopes at any time while it is active, so you can add write access later without a new key. A Custom key works only if it grants every area the agents read. A missing area fails with the 403 message below.

​
Agent capabilities

Agents report only what they read in the current conversation, because tests and people change often. When your plan does not include a section, agents say so instead of reporting it as empty.

​
Verify the connection

​
Example prompts

​
Write access

A key with All read and write lets agents change evidence, policies, controls and control owners, personnel, vendors, risks, tasks, notes, and custom data. Reads run without approval. Every change waits for your approval. Before it asks, CloudThinker reads the current record and tells you what will change. It warns you when the change cannot be undone, such as deletes, background checks, retests, personnel and policy actions, and imports. After the change, CloudThinker reads the record back to confirm it. Agents make one change per approval, and do not retry a change that times out. Agents cannot upload files, or change your AWS, Azure, GCP, or GitLab connections in Drata. Make those changes in the Drata app.

​
Troubleshooting

Drata answered with an authentication error. Check that you copied the whole key, that its status in Settings → API Keys is Active, and that Region matches the region of your account. Create a new key if it expired or was revoked.
The key is valid but cannot make this request. Open the key in Settings → API Keys, check that its scopes cover what you ask for, and clear Allowed IP addresses.
A Drata Admin must sign in to Drata and accept the terms shown there. Then click Connect again.
Drata allows 500 requests per minute from each source IP address. Wait one minute and test again. If the message repeats, other tools may share the limit. Pause them first.
CloudThinker could not connect to the Drata address for your region. Check Region, then test again.
The key worked, but Drata returned no company name. Create a new key with All read or All read and write, and update the connection.
Region is empty or not one of the three options. Choose US, EU, or APAC and connect again.
Your Drata plan does not include that area, such as vendors or risks. The connection works. Ask your Drata account owner about the plan.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Use a dedicated key — name it cloudthinker, so you can see its last use in Settings → API Keys and revoke it without affecting other tools.
  • Rotate before expiry — keys expire after 12 months by default. Create a new key and update the connection before then.

Prowler Connection

Failed security findings and cloud compliance status

Wazuh Connection

Alert and agent investigation with approved changes