Official vendor OpenAPI document · agent-readySecurityComplianceapiKey61 EndpointsREST
For Agents
Use the AWS Audit Manager API to automate compliance evidence collection across AWS workloads on AWS, with 61 operations covering the full control-plane lifecycle.
Use for: Create a SOC 2 assessment for my production accounts, I want to delegate a control set to a colleague for review, Generate an assessment report for the auditor, List all assessments I currently own
Not supported: Does not handle vulnerability scanning, threat detection, or remediation actions - use for compliance assessment management and evidence collection only.
AWS Audit Manager automates the collection of evidence for compliance audits across AWS workloads. It uses prebuilt and custom frameworks - such as PCI DSS, HIPAA, and SOC 2 - to map controls to assessable AWS services and continuously gather evidence into structured assessments and reports.
Install Jentic One Beta
Connect the AWS Audit Manager to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Audit Manager, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Faws-auditmanager" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Faws-auditmanager" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS Audit Manager API.
Create assessments scoped to a framework, accounts, and AWS service set
Build custom frameworks and controls when prebuilt ones do not match internal policy
Continuously gather evidence from CloudTrail, AWS Config, Security Hub, and other sources
Delegate control sets to subject-matter experts for review and approval
Generate assessment reports that bundle evidence for external auditors
Manually attach supporting evidence to controls when automated sources are insufficient
Use Cases
Patterns agents use AWS Audit Manager API for, with concrete tasks.
★ Continuous SOC 2 evidence collection
Run a continuous SOC 2 Type II assessment by selecting the prebuilt SOC 2 framework, scoping it to the relevant AWS accounts, and letting Audit Manager gather evidence from CloudTrail, AWS Config, and Security Hub against each control. Assessment reports compile the evidence on demand for an external auditor. Initial scoping typically takes one to three days; ongoing collection is automatic.
Create an assessment named 'soc2-prod-2026' from the AWS-prebuilt SOC 2 framework scoped to accounts 111111111111 and 222222222222, owned by the security team.
Custom internal-policy framework
Codify an internal security policy as a custom Audit Manager framework with controls mapped to specific AWS Config rules and CloudTrail event names. Once defined, the framework can be used for repeat assessments quarter after quarter, and Audit Manager replays evidence collection automatically against new accounts joining the scope.
Create a custom framework called 'internal-baseline-v3' containing a control set 'access-controls' with three controls mapped to specific AWS Config rule data sources.
Auditor handover with packaged reports
Generate an assessment report at the end of a compliance period to hand to an external auditor. Audit Manager packages all collected evidence with metadata about each control's data source so the auditor can trace every claim back to its origin event in CloudTrail or AWS Config. Report generation is on demand, typically minutes per assessment.
Generate an assessment report for assessment id 'a-1234' with the description 'Q2 2026 auditor handover'.
AI agent driving compliance reviews through Jentic
A compliance agent can run Audit Manager assessments end-to-end by calling its operations through Jentic. It searches for the evidence-collection intents, loads the schemas for CreateAssessment, BatchImportEvidence, and CreateAssessmentReport, and executes them with scoped credentials, so audit-admin keys never enter its context. The agent compresses periodic compliance work to a single intent.
Search Jentic for 'automate evidence collection for a compliance audit', load the CreateAssessment and CreateAssessmentReport schemas, and execute them for the SOC 2 framework on the production accounts.
Key Endpoints
61 endpoints — aws audit manager automates the collection of evidence for compliance audits across aws workloads.
METHOD
PATH
DESCRIPTION
POST
/assessments
Create an assessment from a framework
POST
/assessmentFrameworks
Create a custom assessment framework
POST
/controls
Create a custom control
POST
/assessments/{assessmentId}/reports
Generate an assessment report
POST
/assessments/{assessmentId}/controlSets/{controlSetId}/controls/{controlId}/evidence
Import evidence for a control
POST
/assessments/{assessmentId}/delegations
Delegate a control set for review
POST
/assessments
Create an assessment from a framework
POST
/assessmentFrameworks
Create a custom assessment framework
POST
/controls
Create a custom control
POST
/assessments/{assessmentId}/reports
Generate an assessment report
POST
/assessments/{assessmentId}/controlSets/{controlSetId}/controls/{controlId}/evidence
Import evidence for a control
POST
/assessments/{assessmentId}/delegations
Delegate a control set for review
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
AWS Audit Manager
- AI-Aware (B-)61/100
99
Foundational Compliance63
Developer Experience & Jentic Compatibility38
AI-Readiness & Agent Experience92
Agent Usability50
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
99
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A+Signals: 4
95%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
100%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
63
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B-Signals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
50%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
38
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
54%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
100%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
92
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
92%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
50
Security
Trust, risk posture, and security compliance.
Grade: C-Signals: 1
50%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring AWS Audit Manager by hand means creating IAM credentials, choosing the right regional host from auditmanager.{region}.amazonaws.com, signing every request with AWS SigV4, and building your own retry and pagination handling. Through Jentic you install once, import AWS Audit Manager from the API Directory, store the AWS access key once, and your agent calls it.
Permission scoping
AWS Audit Manager puts the assessment id in the URL path (/assessments/{assessmentId}/reports, /assessments/{assessmentId}/delegations), so a rule can pin your agent to one assessment: it can generate reports and import evidence for that assessment and nothing else. You choose the operations it may call, so destructive ones like deleting an assessment or a custom control are not included unless you add them.
Credential isolation
Your AWS access key for AWS Audit Manager is stored once, encrypted, by your own Jentic One instance and signed with SigV4 at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'automate evidence collection for a compliance audit' or 'generate an assessment report', and Jentic returns the matching AWS Audit Manager operation with its input schema so the agent calls the right endpoint without browsing the AWS service reference.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS Audit Manager API through Jentic.
What authentication does the AWS Audit Manager API use?
The AWS Audit Manager API uses AWS Signature Version 4 (HMAC) request signing with IAM-issued credentials, the same scheme as every AWS service API. Jentic's your Jentic One instance stores those AWS credentials encrypted in the vault, generates short-lived signed requests at execution time, and never passes raw access keys into the agent's context.
Can I create a soc 2 assessment for my production accounts with the AWS Audit Manager API?
Yes - the AWS Audit Manager API exposes 61 operations including the actions needed for that scenario. Use the operations listed in the key endpoints section as the starting point, then chain calls as needed for your workflow.
What are the rate limits for the AWS Audit Manager API?
AWS applies per-account, per-region request rate limits to the AWS Audit Manager control plane. Specific limits are not encoded in the OpenAPI spec; consult the AWS service quotas console for the AWS Audit Manager entry, and design retries with exponential backoff to absorb throttling responses.
How do I automate evidence collection for a compliance audit through Jentic?
Run pip install jentic, then call client.search('automate evidence collection for a compliance audit') to discover the AWS Audit Manager operations that match. Load the schema for the chosen operation with client.load(...) and execute it with client.execute(...). Jentic handles AWS request signing automatically against the credentials stored in your Jentic One instance.
Is the AWS Audit Manager API free to call?
AWS does not charge for control-plane API calls themselves on most AWS Audit Manager operations, but the underlying resources you create or operate (fleets, queries, deployments, and so on) incur usage charges according to the AWS Audit Manager pricing page. Refer to the AWS pricing page for the service to estimate cost.
Which operations should an agent call first when working with the AWS Audit Manager API?
For most workflows, agents should start by listing existing resources to understand the current state, then call the create or update operation that matches the intent. The endpoints listed under Key Endpoints in the catalog give a ranked starting set.
Can I limit what my agent is allowed to do with the AWS Audit Manager API?
Yes. Because you run Jentic One yourself, your own rules decide which AWS Audit Manager operations and which AWS credentials the agent may use. Since the API carries the assessment id in the URL path, such as /assessments/{assessmentId}/reports and /assessments/{assessmentId}/delegations, you can pin the agent to a single assessment so it only generates reports and imports evidence for that one. You also choose the exact operations it may call, so destructive actions like deleting an assessment or a custom control stay out of reach unless you explicitly add them.
GET STARTED