Query and automate the Drata compliance platform through its regional public REST API.
npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill drata-mbadali25
Please help me install this Agent Skill. Skill: drata Source: https://github.com/mbadali25/useful-claude-add-ons/tree/main/skills/drata Command: npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill drata-mbadali25
DrataClient that handles both auth methods, region-to-host mapping, automatic v1/v2 pagination, and 429 retry with Retry-After. - Write safety rails: A read-only mode (DRATA_READ_ONLY=1) and per-call --dry-run flag let you preview mutations before touching controls, personnel, or evidence that auditors can see. - Task recipes: Reference guides cover framework readiness checks, failing monitoring-test sweeps, personnel and evidence export, policy PDF downloads via signed URLs, and CI compliance gates. - Use Case: A security engineer wants a CI job that fails the build whenever any Drata monitoring test is in FAILED state — the Skill provides the exact script, scoped read-only credentials guidance, and jq filtering to do it. ## Quick Start Ask the AI to use the Drata skill to list all failing monitoring tests in your workspace after exporting your DRATA_API_KEY and DRATA_REGION environment variables.High-intent search queries and answers about installing and using this skill.
Drata API authentication uses a Bearer token that is either a long-lived API key from Settings > API Keys or an OAuth2 client-credentials token from Settings > OAuth Applications. OAuth is recommended for production and CI because tokens are short-lived and secrets rotate cleanly.
Export Drata personnel by calling GET /public/personnel, which is v1 offset-paginated with page and limit parameters. The included drata_client.py script auto-paginates via get-all, and each record includes the server-computed complianceStatus and trainingStatus fields.
Drata 401/403 errors with a valid key usually mean the wrong regional host (US, EU, or APAC), an expired or revoked key, or a missing scope for that resource. Keys are also workspace-scoped, so a key from one workspace cannot read another.
Drata v2 endpoints live under /public/v2 and use cursor pagination with expand support, while v1 endpoints under /public use offset pagination with page and limit up to 100. Prefer v2 for new work; some resources like personnel still use v1 paths.
Yes, the helper script supports a --dry-run flag that prints the exact request without sending it, and DRATA_READ_ONLY=1 blocks all POST, PUT, PATCH, and DELETE calls. This matters because Drata writes are auditor-visible compliance records.
No, the drata_client.py script uses only the Python standard library (urllib, json, argparse), so it runs without pip installs. Credentials are supplied through environment variables such as DRATA_API_KEY and DRATA_REGION.
Sambhav242005Provision and manage Prisma Postgres databases via Console, create-db CLI, and Management API.
innFactory-AITracks compliance gaps, remediation items, and audit readiness against frameworks and policies.
wyre-technologyList, search, and retrieve SentinelOne XSPM cloud security misconfigurations.
dennislee928Build agentic AI applications with OpenAI's Responses API and MCP connectivity.