# Push evidence to Drata or Sprinto

> Connect Drata or Sprinto, map ApiTraffic's controls to yours, and each month's signed evidence pack is uploaded to the mapped controls.

Source: https://dev.apitraffic.io/docs/compliance-platforms

If your compliance program runs in Drata or Sprinto, ApiTraffic can upload each month's [evidence pack](https://dev.apitraffic.io/docs/compliance#evidence-packs) to the controls or monitors it backs, so the evidence is there when your auditor looks, without anyone downloading and uploading files.

## Before you begin

- **Plan**: your plan includes **Compliance** and **Compliance platform push**.
- **Roles**: account owners and admins connect platforms and map controls, signed in. Everyone on the team can see the connections.
- **Packs**: the monthly account-wide packs are pushed, one per framework that is on. Environment packs (see **Separate packs for** in Compliance settings) stay in ApiTraffic.

## Connect Drata

1. In Drata, open **Settings**, then **API keys**, and create a key with these permissions: **Workspaces: List Workspaces**, **Controls** (read) and **Evidence Library: Create Evidence**.
2. In ApiTraffic, open **Compliance** in the **All buckets** menu, then **Compliance platforms**, and select **Connect** for Drata.
3. Paste the key and choose your Drata region (NA, EU or APAC). Leave **Workspace** empty if you have one workspace.
4. Select **Connect**. ApiTraffic checks the key with Drata before saving it. If the key sees several workspaces, choose the one evidence goes to.

The key is stored encrypted and never shown again; the page shows its last four characters. Drata allows 500 requests a minute from one address, so pushes are spread out and retried when Drata is busy.

## Connect Sprinto

1. In Sprinto, open **Settings**, then **Developer API**, and create a token as an admin.
2. In ApiTraffic, select **Connect** for Sprinto, paste the token and choose your region.
3. Select **Connect**. ApiTraffic checks the token by listing your monitors.

Sprinto's API is in beta. If Sprinto refuses to list monitors with the token, the connection says so.

## Map your controls

A connection needs a mapping before anything is pushed: which of your platform's controls (Drata) or monitors (Sprinto) each ApiTraffic control's evidence goes to.

1. On the connection, select **Map controls**. ApiTraffic lists the controls of the frameworks you have on, each with a suggested match from your platform.
2. Select **Use suggestions** to fill in every suggestion, then check each one and change any that is wrong. Leave a control **Not mapped** to keep its evidence only in the pack.
3. Select **Save mapping**.

Every change to the mapping is recorded in the [account history](https://dev.apitraffic.io/docs/account/activity-log).

## What is uploaded

On the 2nd of each month, as each framework's account-wide pack for the month is built, it is pushed to every connected platform. With SOC 2, PCI DSS and HECVAT on, that is three packs a month:

- **Drata**: each file is uploaded, then one evidence item is created with every file, linked to every mapped control. Its name carries the pack's id, so a retry never creates a second one.
- **Sprinto**: the files are uploaded to each mapped monitor, ten at a time. Each monitor is recorded as it is done, so a retry never uploads to it twice.

Platforms limit the size of a file (Drata about 25 MB, Sprinto 10 MB). The pack's `summary.pdf`, `manifest.json` and `manifest.sig` go as they are; its CSV files go byte for byte inside `evidence-part-1.zip` and on, each under the limit, with an `upload-index.json` saying which part holds which file. The signed manifest is never rewritten, so your auditor checks every file against it after unzipping.

To push an earlier pack, choose it under **Push an account-wide pack now** and select **Push**. A pack that failed to push is tried again.

## Connection status

| Status | Meaning |
| --- | --- |
| **Connected** | Monthly packs are pushed to the mapped controls. |
| **Needs mapping** | No control is mapped, so packs are not pushed. Map controls. |
| **Failing** | Pushing has failed on three days in a row. The last error is shown. |
| **Credential refused** | The platform refused the key or token. Nothing is pushed until you connect again with a new one. |

Each push, and a connection becoming failing or refused, is recorded in the account history.

## Disconnect

Select **Disconnect** on the connection. The key or token is destroyed, and the mapping and push history are removed. Evidence already in your platform stays there.

## Purges

Purging **rules and settings** removes the mappings: connections then need mapping again. Purging **automations and integrations** removes the connections. See [Account data](https://dev.apitraffic.io/docs/account-data).