Workiva GRC API Preview#
The Workiva GRC API provides programmatic access to your Governance, Risk, and Compliance data. The initial preview exposes Risk & Control Matrix (RCM) controls and risks as read-only resources, including digest context for the processes, subprocesses, systems, and locations that organize them. It also exposes assurance projects, where you can read a project and read and manage the set of controls in its scope. It also exposes remediation issues and their action tasks, so you can keep remediation work in sync with an external system such as Jira. Additional GRC resource types will be added under the same API over time.
Key concepts:
Control: A safeguard or activity that mitigates one or more risks. A control may be standalone, a definition (a template), or an instance (a definition applied to a specific location or system). All three are returned in one unified shape. A workspace is in either standalone mode or multi-instance mode, and unfiltered lists return the types that belong to that mode.
Risk: A potential event that controls are designed to mitigate.
Process / SubProcess: Digest context for the business-process hierarchy that groups risks and controls.
System / Location: Digest context for the application and place dimensions a control applies to.
Assurance Project: A governance or audit project, such as an independent controls-testing engagement. You can list and read projects, and read and manage which controls are in a project’s scope.
Issue: A remediation issue, such as an audit finding or a control deficiency, tracked through resolution. You can list and read issues and update fields such as their name, severity, and owners. An issue’s status and resolution stay in Workiva and are read-only. You can also export issues to a file with an asynchronous operation.
Action Task: A work item on an issue, assigned to a user and tracked through completion. You can read and update an action task’s name, description, and due date. When the work is done in an external system, mark the task sent externally (it moves to
inProgress, or staysoverdueif past due, without a Task Portal task, notification, or reminders) and later implemented. This is different from a task sent from the Workiva app, which notifies the assignee through the Task Portal.
Relationships between resources are returned as lightweight digests (an id plus a few
display fields). Controls, risks, and issues can be retrieved in full by their digest id. Processes,
subprocesses, systems, and locations remain digest-only in this preview. See
Digests.
Using This Preview#
The GRC API is released as a new version of the Workiva API (see Versioning).
To use this feature preview, include an X-Version header with the value
2026-09-01.grc.preview on every request, along with the Wk-Workspace header that selects
the workspace to operate in. Authenticate with an OAuth 2.0 bearer token
obtained through the flow described in Authentication. You can then call
any of the endpoints documented in this preview. To sync remediation work with an external
system, see the Remediation guide.
Preview Status#
Important
This API is in preview status. Always include X-Version: 2026-09-01.grc.preview on all
requests. The API may change before general availability — do not rely on it for
business-critical production workflows until GA.
For preview terms, expectations, and lifecycle details, see API Previews at Workiva.