Just built a custom API script to pull evidence Drata missed - sharing the code

We've been running Drata for about 18 months now, and while it's fantastic for the 90% of automated evidence collection, we kept hitting the same wall: certain critical, but custom, SaaS platform configurations were consistently missed. Manual uploads became a weekly chore for the team.

Specifically, our internal security policies require us to document specific feature flags and role-based access settings in our dev toolchain (Think Vercel, CircleCI, etc.). Drata's native integrations don't yet poll for those nuanced states. Instead of waiting, I wrote a lightweight Python script that uses the Drata API to directly attach evidence to specific control IDs.

The pattern is simple:
1. Use our internal admin APIs (or SaaS platform APIs) to gather the required state.
2. Format it as a JSON snapshot.
3. Push it to Drata as a file attachment to the pre-mapped control.

Here's the core of the script. You'll need a Drata API token with `evidence:write` scope.

```python
import requests
import json
from datetime import datetime

DRATA_API_BASE = "https://api.drata.com"
DRATA_API_TOKEN = "your_token_here"
CONTROL_ID = "your_drata_control_id_here" # e.g., "ACC-123"

# 1. Fetch your custom evidence (example: CircleCI security settings)
def fetch_evidence():
# Your custom logic here. This is a mock.
return {
"timestamp": datetime.utcnow().isoformat(),
"settings": {
"security_context_enabled": True,
"require_2fa_for_project_admins": True,
"ip_range_restrictions": "10.0.0.0/8"
}
}

# 2. Create evidence record in Drata
evidence_data = fetch_evidence()
filename = f"circleci_security_{datetime.utcnow().date().isoformat()}.json"

headers = {
"Authorization": f"Bearer {DRATA_API_TOKEN}",
"Content-Type": "application/json"
}

create_payload = {
"controlId": CONTROL_ID,
"filename": filename,
"description": "Automated upload: CircleCI SSO & IP restrictions.",
"note": "Collected via custom API script."
}

create_resp = requests.post(
f"{DRATA_API_BASE}/public/evidence",
json=create_payload,
headers=headers
)
create_resp.raise_for_status()
upload_url = create_resp.json()["data"]["uploadUrl"]

# 3. Upload the JSON file
upload_resp = requests.put(
upload_url,
data=json.dumps(evidence_data),
headers={"Content-Type": "application/json"}
)
upload_resp.raise_for_status()
print(f"Evidence uploaded for control {CONTROL_ID}")
```

Key takeaways from running this in production:
- Schedule it via a cron job in your CI or a lightweight Kubernetes `CronJob`.
- Store the Drata control IDs as environment variables or in a secure config map.
- The script is idempotent; daily runs create a clear audit trail of state over time.

This approach has cut our manual compliance overhead for these custom checks to near zero. If you've built similar extensions, I'm curious what other evidence gaps you've plugged. For teams scaling their compliance posture, this kind of small automation can really solidify the audit trail.