Compliance Posture Integration Guide

Overview

ARIAS Compliance Posture exposes two integration surfaces that any GRC platform can consume:

You can use one, two, or all three depending on what your GRC tool supports.

Step 1 — Generate an API key in ARIAS

1. Log in as an Admin user
2. Navigate to Compliance Posture → Integrations → API Keys
3. Click Generate API key
4. Give it a label that identifies the GRC tool (e.g. “Vanta production”)
5. Click Generate
6. Copy the raw key now — it will never be shown again

Keys are prefixed aria_cp_ and pass as a Bearer token.

Step 2 — Configure your GRC tool

Tools that ingest OSCAL (TrustCloud, OneTrust, AuditBoard)

Configure the data source URL as:

GET https://app.tryarias.com/api/analysis/compliance/oscal/<framework>
Authorization: Bearer aria_cp_<your-key>

Where <framework> is one of:

eu_ai_act         nist_ai_rmf       iso_42001         soc2
gdpr              owasp_llm_top_10  owasp_agentic_top_10
maestro

Optional query parameter: ?repository=<name> to scope the export to a single repository’s most-recent scan.

The response is standard OSCAL — every credible OSCAL-compliant tool deduplicates findings and observations using the stable UUIDs in the document, so re-imports are idempotent.

Tools with custom data source ingest (Vanta, Drata, Hyperproof)

Configure a polling job that hits:

GET https://app.tryarias.com/api/analysis/compliance/evidence?since=<iso8601>
Authorization: Bearer aria_cp_<your-key>

Save the latest as_of timestamp from each response and pass it as since= on the next poll. Optional filters: ?framework=<name> and ?repository=<name>.

Each evidence record has this shape:

{
  "evidence_id": "<deterministic-uuid>",
  "source": "ARIAS",
  "control_id": "Article 14",
  "framework": "eu_ai_act",
  "status": "aligned | partial | gap | not_checked",
  "evidence_count": 7,
  "analysis_id": "<scan-uuid>",
  "timestamp": "<iso8601>"
}

Push-mode (any tool that accepts inbound webhooks)

1. In your GRC tool, create a webhook receiver URL
2. In ARIAS Compliance Posture → Integrations → Webhooks → Add webhook
3. Paste the receiver URL + a label
4. Save the signing secret that ARIAS generates — your receiver must use it to verify the HMAC signature on every event

Event payload:

{
  "event": "compliance.posture.changed",
  "tenant_id": "<tenant>",
  "analysis_id": "<scan-uuid>",
  "occurred_at": "<iso8601>",
  "transitions": [
    {
      "framework": "eu_ai_act",
      "control_id": "Article 14",
      "prev_status": "aligned",
      "new_status": "gap"
    }
  ]
}

Headers:

• Content-Type: application/json
• X-ARIAS-Event: compliance.posture.changed
• X-ARIAS-Signature: sha256=<hex>

To verify the signature in your receiver:

import hmac, hashlib
expected = hmac.new(
    signing_secret.encode("utf-8"),
    request.body,
    hashlib.sha256,
).hexdigest()
signature_ok = hmac.compare_digest(
    expected,
    request.headers["X-ARIAS-Signature"].removeprefix("sha256=")
)

Step 3 — Verify the integration

1. Run a scan in ARIAS (or wait for one to complete)
2. Pull-mode: invoke your GRC tool’s manual sync; confirm new evidence rows appear
3. Push-mode: check the webhook entry’s Last delivery column in ARIAS — should show HTTP 200

Operational notes

Supported frameworks today

ARIAS doesn’t claim to cover every control in every framework — only the controls where ARIAS provides evidence via SCF-mapped knowledge-base rules. The % framework assessed metric on each card surfaces the honest coverage breadth.

Questions

Email support@tryarias.com — we typically reply within one business day. For enterprise integration support please contact your account team.