Docs / Observability and data
Vanta
Connect Vanta read-only so the agent can find failing compliance tests and help you fix them.
Pangea connects to Vanta with an OAuth client-credentials app that you create in your Vanta organization. The connector is read-only. The agent reads which compliance tests need attention, for frameworks such as SOC 2, ISO 27001 and HIPAA, and helps you fix them. It never writes to Vanta.
Connect
1. Create a Vanta app
- Sign in to Vanta as an admin.
- Open Settings → Developer console.
- Create an app of type Manage Vanta (OAuth client credentials).
- Grant it read access to tests and vulnerabilities.
- Copy the Client ID (starts with
vci_) and generate a Client Secret (starts withvcs_). Vanta shows the secret only once.
2. Connect in Pangea
As a team Administrator, open Connectors → Connect → Vanta and fill in:
| Field | Notes |
|---|---|
| Label | A friendly name, for example Acme Vanta |
| Client ID | Starts with vci_ |
| Client Secret | Starts with vcs_. Stored encrypted |
Pangea verifies the credentials with the Vanta API before it saves them. It requests the read-only vanta-api.all:read scope. Access tokens are created on demand and stay on Pangea's servers. The agent reads through a Pangea proxy and never sees your Vanta credentials.
In the Pangea app
A connected organization gets a Failed Tests page. The connection itself lives in Connectors, where an Administrator can manage its allow-list or remove it.
What the agent can do for you
The agent reads the tests that need attention, each with its failure description and suggested fix. It can narrow the list to infrastructure categories such as vulnerability management. The real value is fixing things across connectors:
- "What's failing in Vanta right now?" The agent lists the failing tests with their fix guidance.
- When a failing test points to a system you've connected, such as an unencrypted S3 bucket in AWS, a missing DNS record in Cloudflare or a repository setting in GitHub, the agent can offer to fix it there. It uses that connector's permissions and the normal review flow.
- After the fix, Vanta's next check picks it up, and the agent can follow the test back to passing.
Permissions
Team Administrators connect and remove this connection. They can limit who uses it with a member allow-list. Fixes made through other connectors follow Auto Mode and Full Access, and significant infrastructure work goes through plans.
Good to know
Vanta allows one active access token per app. Use a dedicated app for Pangea. If other tools share the app, their tokens revoke each other.
To rotate the secret, remove the connection and connect again with the new credentials.