Drata

Connect Drata so agents can review failing tests, control readiness, and personnel gaps, and make changes through your Approvals

Connect Drata and CloudThinker agents can show which monitoring tests fail and which controls they block, find controls without evidence, and list people missing training or other checks. Drata authenticates with an API key you create in Drata, and with a read-and-write key agents can also change records through your Approvals.

Prerequisites

• A Drata Admin account. Only Admins can open Settings → API Keys.
• Your Drata region: US (app.drata.com), EU (app.eu.drata.com), or APAC (app.apac.drata.com).
• A Drata admin has accepted Drata’s terms for your account. Drata refuses API requests until they do.
• Edit permission on connections in your CloudThinker workspace.

Setup

1. Create an API key in Drata

   In Drata, select your account at the bottom left, then Settings → API Keys, and click Create API Key. Set:

   • Name: cloudthinker. You can’t change the name later.
   • Expiration date: 12 months (the default), a custom date, or Never.
   • Allowed IP addresses: add CloudThinker’s egress IPs, or leave the field empty. A key limited to other addresses fails the connection test. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us.
   • Access: All read to investigate only, or All read and write to let agents make approved changes.

   Save the key and copy it. Drata shows the full key only once. If you lose it, create a new one.

2. Open Drata in CloudThinker

   In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Drata and click Connect.

3. Enter the key and region

   Fill in:

   • API key: the key you copied.
   • Region: pick the region of your Drata account from the dropdown.

   Click Connect. CloudThinker calls Drata to check the key.

   Success state: the connection shows a Connected status and Drata connection verified (<your company>, <REGION>).

Connection details

Field	Description	Example
API key	The key from Settings → API Keys	<your-api-key>
Region	Dropdown: US, EU, or APAC, each shown with its API address. Default US	EU

Each region has its own Drata API address, and the region you choose decides which one CloudThinker calls.

Region	Drata app	Drata API address
US	app.drata.com	public-api.drata.com
EU	app.eu.drata.com	public-api.eu.drata.com
APAC	app.apac.drata.com	public-api.apac.drata.com

Required permissions

Goal	Drata key access
Investigate only	All read
Investigate and make approved changes	All read and write

All read and All read and write also cover scopes Drata adds later.

Start with All read. You can edit an active key’s scopes at any time, so you can add write access later without a new key. A Custom key works only if it grants every area agents read; a missing area fails with the 403 message in Troubleshooting.

Agent capabilities

Capability	What agents read
Overview	Your company, plan, workspaces, and enabled frameworks, with how ready each one is
Failing tests	Failing monitoring tests, oldest first, the resources behind them, and the controls they block
Controls and evidence	Controls that aren’t ready or have no evidence, plus framework requirements, policies, and audits
Personnel	Who misses training, a background check, policy acceptance, MFA, or a device check
Vendors and risks	Vendors, security reviews, and the risk register, if your Drata plan includes them
Integrations	Health of your Drata integrations, and which ones aren’t healthy

Agents report only what they read in the current conversation, because tests and people change often. When your Drata plan doesn’t include a section, agents say so instead of reporting it as empty.

Verify the connection

Start a chat, type # and pick Drata, then ask:

Summarize my Drata account: workspaces, framework readiness, and the oldest failing tests

Expected result: your company name, your workspaces, how ready each framework is, and the oldest failing tests with how long they’ve failed.

Example prompts

Which Drata tests have been failing the longest, and which controls do they block?
List the people who haven't finished security training or a background check
Which Drata controls have no evidence in the framework I'm preparing for?

Write access

A key with All read and write lets agents change:

• Evidence and policies
• Controls and control owners
• Personnel
• Vendors and risks
• Tasks, notes, and custom data

Allow writes is on by default, so a read-and-write key can act as soon as you connect. To keep the connection read-only, open Drata in More → Workspace settings → Connections and turn off Allow writes.

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

How a change runs:

1. Reads run without approval.
2. Before it asks, the agent reads the current record and tells you what will change.
3. It warns you when the change can’t be undone, such as deletes, background checks, retests, personnel and policy actions, and imports.
4. After the change, it reads the record back and reports whether the change is confirmed.

Agents make one change per approval. If a change times out, the agent doesn’t retry. It reads the record and tells you whether the change landed. Approve again only if it didn’t. Agents can’t upload files or change your AWS, Azure, GCP, or GitLab connections in Drata. Make those changes in the Drata app.

Troubleshooting

Accordion titles written as full sentences that end in a period are the exact messages CloudThinker shows when the connection test fails.

Drata rejected the API key. Check that it was copied whole, that it has not expired or been revoked in Settings > API Keys, and that the region matches your Drata tenant.

Check that you copied the whole key, that its status in Settings → API Keys is Active, and that Region matches your account. An expired or revoked key can’t be made active again, so create a new one.

Drata accepted the key but refused the request. Check the key's scopes and its IP allowlist in Settings > API Keys.

The key is valid but can’t make this request. Open the key in Settings → API Keys, check that its scopes cover what you ask for, and that Allowed IP addresses is empty or includes CloudThinker’s egress IPs.

Drata refused the request because the tenant has not accepted Drata's terms. A Drata admin must sign in and accept them, then test again.

A Drata Admin must sign in to Drata and accept the terms shown there. Then click Connect again.

Drata rate-limited the test. The limit is 500 requests per minute per source IP, so wait a minute and test again.

Wait one minute and test again. If the message repeats, other tools calling Drata from the same address may share the limit. Pause them first.

Could not reach the Drata API. Check network access.

CloudThinker couldn’t connect to the Drata address for your region. Check Region, then test again.

Drata answered, but did not name the company for this API key. Create a new key in Settings > API Keys, then test again.

The key worked, but Drata returned no company name. Create a new key with All read or All read and write, and update the connection.

Choose a Drata region: us, eu, or apac.

Region is empty or not one of the three options. The message uses lowercase region codes; in the form, pick US, EU, or APAC from the dropdown and connect again.

An agent says a Drata section is not on this plan

Your Drata plan doesn’t include that area, such as vendors or risks. The connection works. Ask your Drata account owner about the plan.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Use a dedicated key. Name it cloudthinker, so you can see its last use in Settings → API Keys and revoke it without affecting other tools.
• Rotate before expiry. Keys expire after 12 months by default. Create a new key and update the connection before then.

Related

Approvals

Decide which Drata changes run and which wait for you

Prowler Connection

Failed security findings and cloud compliance status