> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Drata

> Connect Drata to CloudThinker to review failing tests, control readiness, and personnel gaps, and to make approved changes

Connect Drata to let CloudThinker agents review failing tests, control readiness, and personnel compliance, and change records after you approve. Drata authenticates with an **API key** that you create in Drata.

***

## Prerequisites

* A Drata **Admin** account. Only Admins can open **Settings → API Keys**.
* Your Drata region: North America, Europe, or Asia-Pacific.
* A Drata admin who has accepted Drata's terms for your account. Drata refuses API requests until they do.

***

## Setup

<Steps>
  <Step title="Create an API key in Drata">
    In Drata, select your account at the bottom left, then **Settings → API Keys**, and click **Create API Key**. Set:

    * **Name**: `cloudthinker`. You cannot change the name later.
    * **Expiration date**: 12 months (the default), a custom date, or **Never**.
    * **Allowed IP addresses**: leave empty. A key limited to other addresses fails the connection test.
    * **Access**: **All read** to investigate only, or **All read and write** to let agents make approved changes.

    Save the key and copy it. Drata shows the full key only once.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Drata** and enter:

    * **API key**: the key you copied
    * **Region**: the region of your Drata account

    Click **Connect**. CloudThinker calls Drata and shows a **Connected** status with your company name and region.
  </Step>
</Steps>

<Warning>
  Drata shows the full key only once. If you lose it, create a new key. An expired or revoked key cannot be made active again.
</Warning>

***

## Connection details

| Field | Description | Example |
| - | - | - |
| **API key** | The key from **Settings → API Keys** | `<your-api-key>` |
| **Region** | **US**, **EU**, or **APAC**. Default **US**. | **EU** |

Each region uses its own Drata API address. Choose the region that matches your Drata account.

| Region | Drata API address |
| - | - |
| **US** | `public-api.drata.com` |
| **EU** | `public-api.eu.drata.com` |
| **APAC** | `public-api.apac.drata.com` |

***

## Required permissions

| Goal | Drata key access |
| - | - |
| Investigate only | **All read** |
| Investigate and make approved changes | **All read and write** |

**All read** and **All read and write** also cover scopes that Drata adds later.

<Tip>
  Start with **All read**. You can edit a key's scopes at any time while it is active, so you can add write access later without a new key. A **Custom** key works only if it grants every area the agents read. A missing area fails with the 403 message below.
</Tip>

***

## Agent capabilities

| Capability | Description |
| - | - |
| **Overview** | Your company, plan, workspaces, and the frameworks you have enabled, with how ready each one is |
| **Failing tests** | Failing monitoring tests, the oldest first, the resources behind them, and the controls they block |
| **Controls and evidence** | Controls that are not ready or have no evidence, plus framework requirements, policies, and audits |
| **Personnel** | Who misses training, a background check, policy acceptance, MFA, or a device check |
| **Vendors and risks** | Vendors, security reviews, and the risk register, if your Drata plan includes them |
| **Integrations** | Health of your Drata integrations, with the ones that are not healthy |

Agents report only what they read in the current conversation, because tests and people change often. When your plan does not include a section, agents say so instead of reporting it as empty.

### Verify the connection

```text theme={null}
Summarize my Drata account: workspaces, framework readiness, and the oldest failing tests
```

### Example prompts

```text theme={null}
Which Drata tests have been failing the longest, and which controls do they block?
List the people who have not finished security training or a background check
Which Drata controls have no evidence in my SOC 2 framework?
```

***

## Write access

A key with **All read and write** lets agents change evidence, policies, controls and control owners, personnel, vendors, risks, tasks, notes, and custom data.

Reads run without approval. Every change waits for your approval. Before it asks, CloudThinker reads the current record and tells you what will change. It warns you when the change cannot be undone, such as deletes, background checks, retests, personnel and policy actions, and imports. After the change, CloudThinker reads the record back to confirm it.

Agents make one change per approval, and do not retry a change that times out.

Agents cannot upload files, or change your AWS, Azure, GCP, or GitLab connections in Drata. Make those changes in the Drata app.

***

## Troubleshooting

<Accordion title="Drata rejected the API key. Check that it was copied whole, that it has not expired or been revoked in Settings > API Keys, and that the region matches your Drata tenant.">
  Drata answered with an authentication error. Check that you copied the whole key, that its status in **Settings → API Keys** is **Active**, and that **Region** matches the region of your account. Create a new key if it expired or was revoked.
</Accordion>

<Accordion title="Drata accepted the key but refused the request. Check the key's scopes and its IP allowlist in Settings > API Keys.">
  The key is valid but cannot make this request. Open the key in **Settings → API Keys**, check that its scopes cover what you ask for, and clear **Allowed IP addresses**.
</Accordion>

<Accordion title="Drata refused the request because the tenant has not accepted Drata's terms. A Drata admin must sign in and accept them, then test again.">
  A Drata Admin must sign in to Drata and accept the terms shown there. Then click **Connect** again.
</Accordion>

<Accordion title="Drata rate-limited the test. The limit is 500 requests per minute per source IP, so wait a minute and test again.">
  Drata allows 500 requests per minute from each source IP address. Wait one minute and test again. If the message repeats, other tools may share the limit. Pause them first.
</Accordion>

<Accordion title="Could not reach the Drata API. Check network access.">
  CloudThinker could not connect to the Drata address for your region. Check **Region**, then test again.
</Accordion>

<Accordion title="Drata answered, but did not name the company for this API key. Create a new key in Settings > API Keys, then test again.">
  The key worked, but Drata returned no company name. Create a new key with **All read** or **All read and write**, and update the connection.
</Accordion>

<Accordion title="Choose a Drata region: us, eu, or apac.">
  **Region** is empty or not one of the three options. Choose **US**, **EU**, or **APAC** and connect again.
</Accordion>

<Accordion title="An agent says a Drata section is not on this plan">
  Your Drata plan does not include that area, such as vendors or risks. The connection works. Ask your Drata account owner about the plan.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Use a dedicated key** — name it `cloudthinker`, so you can see its last use in **Settings → API Keys** and revoke it without affecting other tools.
- **Rotate before expiry** — keys expire after 12 months by default. Create a new key and update the connection before then.

***

## Related

<CardGroup cols={2}>
  <Card title="Prowler Connection" icon="shield-check" href="/guide/connections/prowler">
    Failed security findings and cloud compliance status
  </Card>

  <Card title="Wazuh Connection" icon="https://mintcdn.com/cloudthinker/b7eHHxxxDnbPJd0B/images/icons/wazuh.svg?fit=max&auto=format&n=b7eHHxxxDnbPJd0B&q=85&s=d3d1f64d6334d7f7966b8fa4eccca775" href="/guide/connections/wazuh" width="24" height="24" data-path="images/icons/wazuh.svg">
    Alert and agent investigation with approved changes
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.