Drata CLI

Drata CLI

Agent Protocol

The CLI auto-detects non-TTY environments and outputs JSON - no --json flag needed in pipelines.

Rules for agents:

• Supply DRATA_API_KEY and DRATA_REGION env vars. Never rely on interactive login.
• Pass -q / --quiet to suppress spinners and get clean JSON.
• Exit 0 = success, 1 = error.
• Error JSON:

  {"error":"..."}
  

• All commands produce structured JSON output when stdout is not a TTY.
• Most workspace-scoped commands require --workspace <id>. Get workspace IDs with workspaces list.
• List responses use cursor-based pagination: check pagination.cursor for next page.

Authentication

Auth resolves: --api-key flag > DRATA_API_KEY env > config file (drata login).

Global Flags

Available Commands

Auth & Diagnostics

Core Resources

Controls & Compliance

People & Devices

Policies & Events

Risk Management

Vendors

Integrations

Common Patterns

Get workspace ID first (required for many commands):

DRATA_API_KEY=key DRATA_REGION=eu node dist/cli.cjs workspaces list -q

Check compliance posture:

node dist/cli.cjs frameworks list --workspace 1 -q
# Returns: {data: [{name, isReady, numReadyInScopeRequirements, numInScopeRequirements}]}

Find failing tests:

node dist/cli.cjs monitoring-tests list --workspace 1 -q | jq '.data[] | select(.checkResultStatus == "FAILED")'

List all controls with owners:

node dist/cli.cjs controls list --workspace 1 --expand owners -q --size 200

List all assets by provider:

node dist/cli.cjs assets list --asset-provider AWS -q

Create a risk from findings:

node dist/cli.cjs risks create --register-id 1 --data '{"name": "CVE-2025-1234", "description": "Critical vuln found in dep audit"}'

Paginate through all results:

# First page
node dist/cli.cjs assets list -q --size 100
# Returns pagination.cursor - pass it for next page
node dist/cli.cjs assets list -q --size 100 --cursor "aWR8ODEz"

Vendor security posture:

node dist/cli.cjs vendors stats -q
node dist/cli.cjs vendors list -q

Pagination

All list endpoints use cursor-based pagination:

• --size <n> controls page size (default 25)
• Response includes pagination.cursor - pass as --cursor for next page
• cursor: null means no more pages
• Use --include-total-count on first request to get total record count

Common Mistakes