> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Drata

> Connect Serval to Drata's Public API v2 with read-only access to compliance data.

## About Drata

The Drata integration lets Serval workflows read compliance data from Drata's Public API v2. It includes the complete published GET surface for assets, audits, controls, evidence, frameworks, monitoring tests, personnel, policies, risks, vendors, workspaces, and related resources.

This integration is deliberately read-only. Serval exposes only GET operations and rejects any non-GET request before credentials are added.

**Authentication:** A Drata API key with **All read** access. Serval stores the key securely and sends it as a bearer token only to Drata's published US, EU, or APAC Public API host.

**Data sync:** On demand. Serval reads data from Drata when a workflow runs and does not perform a background sync.

## Create a read-only API key

<Steps>
  <Step title="Open Drata API Keys">In Drata, open **Settings**, then select **API Keys**.</Step>

  <Step title="Create the key">
    Select **Create API Key**, enter a descriptive name such as Serval Read Only, and choose an
    expiration policy that matches your security requirements.
  </Step>

  <Step title="Choose All read access">
    For **Access**, select **All read**. Do not select **All read and write**; the Serval
    integration cannot issue write requests.
  </Step>

  <Step title="Copy the key">Save the full key immediately. Drata displays it only once.</Step>
</Steps>

See [Drata's API-key guide](https://help.drata.com/en/articles/6695964-drata-public-api) for the current setup steps, IP allowlisting, and key lifecycle details.

## Connect in Serval

<Steps>
  <Step title="Name the connection">Enter a recognizable instance name, such as Production.</Step>

  <Step title="Select the region">
    Choose United States, European Union, or Asia Pacific to match the location of your Drata
    account.
  </Step>

  <Step title="Enter the API key">Paste the complete Drata API key and submit the form.</Step>
</Steps>

## Verify the connection

Serval checks that it can read company information, personnel, vendors, and workspaces. A failed check normally means the API key is invalid, the wrong region was selected, Drata's terms have not been accepted, or the key lacks the corresponding read permission.

<Note>
  Drata enforces a limit of 500 requests per minute per source IP. List endpoints use cursor-based
  pagination and accept up to 500 results per request.
</Note>

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your Drata integration.