> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Drata > Connect Drata so agents can review failing tests, control readiness, and personnel gaps, and make changes through your Approvals Connect Drata and CloudThinker agents can show which monitoring tests fail and which controls they block, find controls without evidence, and list people missing training or other checks. Drata authenticates with an **API key** you create in Drata, and with a read-and-write key agents can also change records through your [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md). ## Prerequisites * A Drata **Admin** account. Only Admins can open **Settings → API Keys**. * Your Drata region: US (`app.drata.com`), EU (`app.eu.drata.com`), or APAC (`app.apac.drata.com`). * A Drata admin has accepted Drata's terms for your account. Drata refuses API requests until they do. * Edit permission on connections in your CloudThinker workspace. ## Setup **1. Create an API key in Drata** In Drata, select your account at the bottom left, then **Settings → API Keys**, and click **Create API Key**. Set: * **Name**: `cloudthinker`. You can't change the name later. * **Expiration date**: 12 months (the default), a custom date, or **Never**. * **Allowed IP addresses**: add CloudThinker's egress IPs, or leave the field empty. A key limited to other addresses fails the connection test. These docs don't publish CloudThinker's egress IP list: ask your CloudThinker contact, or [contact us](https://cloudthinker.io/contact). * **Access**: **All read** to investigate only, or **All read and write** to let agents make approved changes. Save the key and copy it. Drata shows the full key only once. If you lose it, create a new one. **2. Open Drata in CloudThinker** In the sidebar, click **More → Workspace settings → Connections**. On the **Builtin Connections** tab, search for **Drata** and click **Connect**. **3. Enter the key and region** Fill in: * **API key**: the key you copied. * **Region**: pick the region of your Drata account from the dropdown. Click **Connect**. CloudThinker calls Drata to check the key. **Success state:** the connection shows a **Connected** status and `Drata connection verified (, )`. ## Connection details | Field | Description | Example | | - | - | - | | **API key** | The key from **Settings → API Keys** | `` | | **Region** | Dropdown: **US**, **EU**, or **APAC**, each shown with its API address. Default **US** | **EU** | Each region has its own Drata API address, and the region you choose decides which one CloudThinker calls. | Region | Drata app | Drata API address | | - | - | - | | **US** | `app.drata.com` | `public-api.drata.com` | | **EU** | `app.eu.drata.com` | `public-api.eu.drata.com` | | **APAC** | `app.apac.drata.com` | `public-api.apac.drata.com` | ## Required permissions | Goal | Drata key access | | - | - | | Investigate only | **All read** | | Investigate and make approved changes | **All read and write** | **All read** and **All read and write** also cover scopes Drata adds later. > [!TIP] > > Start with **All read**. You can edit an active key's scopes at any time, so you can add write access later without a new key. A **Custom** key works only if it grants every area agents read; a missing area fails with the 403 message in Troubleshooting. ## Agent capabilities | Capability | What agents read | | - | - | | **Overview** | Your company, plan, workspaces, and enabled frameworks, with how ready each one is | | **Failing tests** | Failing monitoring tests, oldest first, the resources behind them, and the controls they block | | **Controls and evidence** | Controls that aren't ready or have no evidence, plus framework requirements, policies, and audits | | **Personnel** | Who misses training, a background check, policy acceptance, MFA, or a device check | | **Vendors and risks** | Vendors, security reviews, and the risk register, if your Drata plan includes them | | **Integrations** | Health of your Drata integrations, and which ones aren't healthy | Agents report only what they read in the current conversation, because tests and people change often. When your Drata plan doesn't include a section, agents say so instead of reporting it as empty. ### Verify the connection Start a chat, type `#` and pick **Drata**, then ask: ```text theme={null} Summarize my Drata account: workspaces, framework readiness, and the oldest failing tests ``` **Expected result:** your company name, your workspaces, how ready each framework is, and the oldest failing tests with how long they've failed. ### Example prompts ```text theme={null} Which Drata tests have been failing the longest, and which controls do they block? List the people who haven't finished security training or a background check Which Drata controls have no evidence in the framework I'm preparing for? ``` ## Write access A key with **All read and write** lets agents change: * Evidence and policies * Controls and control owners * Personnel * Vendors and risks * Tasks, notes, and custom data **Allow writes** is on by default, so a read-and-write key can act as soon as you connect. To keep the connection read-only, open **Drata** in **More → Workspace settings → Connections** and turn off **Allow writes**. Every change an agent makes goes through your workspace's [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md) first. On the default **Auto · Rules + AI · Ask me** mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on [Rule enforcement](https://docs.cloudthinker.io/guide/approvals/rules.md#troubleshooting) for your workspace. Choose **Manual** to approve every change yourself. How a change runs: 1. Reads run without approval. 2. Before it asks, the agent reads the current record and tells you what will change. 3. It warns you when the change can't be undone, such as deletes, background checks, retests, personnel and policy actions, and imports. 4. After the change, it reads the record back and reports whether the change is confirmed. Agents make one change per approval. If a change times out, the agent doesn't retry. It reads the record and tells you whether the change landed. Approve again only if it didn't. Agents can't upload files or change your AWS, Azure, GCP, or GitLab connections in Drata. Make those changes in the Drata app. ## Troubleshooting Accordion titles written as full sentences that end in a period are the exact messages CloudThinker shows when the connection test fails. > [accordion] Drata rejected the API key. Check that it was copied whole, that it has not expired or been revoked in Settings > API Keys, and that the region matches your Drata tenant. > > Check that you copied the whole key, that its status in **Settings → API Keys** is **Active**, and that **Region** matches your account. An expired or revoked key can't be made active again, so create a new one. > [accordion] Drata accepted the key but refused the request. Check the key's scopes and its IP allowlist in Settings > API Keys. > > The key is valid but can't make this request. Open the key in **Settings → API Keys**, check that its scopes cover what you ask for, and that **Allowed IP addresses** is empty or includes CloudThinker's egress IPs. > [accordion] Drata refused the request because the tenant has not accepted Drata's terms. A Drata admin must sign in and accept them, then test again. > > A Drata Admin must sign in to Drata and accept the terms shown there. Then click **Connect** again. > [accordion] Drata rate-limited the test. The limit is 500 requests per minute per source IP, so wait a minute and test again. > > Wait one minute and test again. If the message repeats, other tools calling Drata from the same address may share the limit. Pause them first. > [accordion] Could not reach the Drata API. Check network access. > > CloudThinker couldn't connect to the Drata address for your region. Check **Region**, then test again. > [accordion] Drata answered, but did not name the company for this API key. Create a new key in Settings > API Keys, then test again. > > The key worked, but Drata returned no company name. Create a new key with **All read** or **All read and write**, and update the connection. > [accordion] Choose a Drata region: us, eu, or apac. > > **Region** is empty or not one of the three options. The message uses lowercase region codes; in the form, pick **US**, **EU**, or **APAC** from the dropdown and connect again. > [accordion] An agent says a Drata section is not on this plan > > Your Drata plan doesn't include that area, such as vendors or risks. The connection works. Ask your Drata account owner about the plan. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - **Use a dedicated key.** Name it `cloudthinker`, so you can see its last use in **Settings → API Keys** and revoke it without affecting other tools. - **Rotate before expiry.** Keys expire after 12 months by default. Create a new key and update the connection before then. ## Related > [card] [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md) > > Decide which Drata changes run and which wait for you > [card] [Prowler Connection](https://docs.cloudthinker.io/guide/connections/prowler.md) > > Failed security findings and cloud compliance status This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.