Diligent API
Diligent is enterprise software that unifies board governance, risk management, compliance, audit, ESG, and entity management in one platform. An unofficial API lets you programmatically pull risk registers, controls, audit engagements and findings, policy attestations, vendor assessm
What is Diligent?
Diligent is a cloud platform for modern governance that centralizes board workflows, risk and compliance operations, internal audit, ESG reporting, and corporate entity management. Teams use Diligent to manage board meetings and materials, build and maintain risk registers, design and test internal controls, run audits from planning through remediation, track compliance obligations and policies with attestations, oversee third-party/vendor risk, and collect ESG metrics across frameworks.
Core product areas include:
- Governance & Board Management (Meetings, Agendas, Minutes, Voting, Questionnaires, Secure Document Distribution)
- Risk & Controls (Risk Registers, Control Libraries, Assessments, Issues/Incidents, Mitigation Plans)
- Audit Management (Audit Plans, Fieldwork, Workpapers, Findings, Recommendations, Remediation Tracking)
- Compliance & Policy (Regulatory Obligations, Policy Lifecycle, Attestations, Certifications, Evidence)
- Third-Party Risk (Vendors, Due Diligence, Risk Ratings, Assessments, Contracts)
- ESG & Entity Management (ESG Data Collection, Framework Mapping, Subsidiaries/Entity Records)
Common data entities:
- Organizations, Users, Roles/Permissions (Board Members, Executives, Risk Owners, Auditors, Compliance Officers)
- Risks (metadata, category, likelihood/impact, scores, status, owner, linked controls/issues)
- Controls (design/operating effectiveness, mappings to frameworks, test plans and results)
- Audits (engagements, objectives, workpapers, findings, recommendations, approvals)
- Issues/Incidents (severity, root cause, remediation plan, due dates, ownership)
- Policies (versions, lifecycle states, attestations, acknowledgements)
- Vendors/Third Parties (profiles, assessments, risk tier, contracts, remediation actions)
- Evidence & Documents (attachments, versions, checksum, access controls)
The Diligent Integration Challenge
GRC and audit teams rely on Diligent daily, but turning portal-based workflows into API-driven automation is non-trivial:
- Role-aware portals: Directors, executives, auditors, risk owners, and vendors each see different data and approval states
- Data lineage: Risks, controls, audits, and issues are interconnected across modules and frameworks (SOX, ISO, NIST, COSO)
- Compliance rigor: Attestations, evidence integrity, approvals, and sign-offs require careful handling and auditability
- Authentication complexity: SSO/MFA and session lifecycles complicate headless automation in regulated environments
- Mixed artifacts: Critical context lives in documents, workpapers, questionnaires, and approval histories, not just tables
How Supergood Creates Diligent APIs
Supergood reverse-engineers authenticated browser flows and network interactions to deliver a resilient API endpoint layer for your Diligent tenant.
- Handles username/password, SSO/OAuth, and MFA (SMS, email, TOTP) securely
- Maintains session continuity with automated refresh and change detection
- Normalizes responses so you can integrate once and rely on consistent objects across modules
- Aligns with customer entitlements and role-based permissions to ensure compliant access
Getting Started
- Schedule Integration Assessment
Book a 30-minute session to confirm your modules, licensing, and authentication model.
- Supergood Builds and Validates Your API
We deliver a hardened Diligent adapter tailored to your workflows and entitlements.
- Deploy with Monitoring
Go live with continuous monitoring and automatic adjustments as Diligent evolves.
API Endpoints
Authentication
/sessionsEstablish a session using credentials. Supergood manages MFA (SMS, email, TOTP) and SSO/OAuth when enabled. Returns a short-lived auth token maintained by the platform.
Authentication
/sessions/refreshRefresh an existing token to keep sessions uninterrupted.
Risks
/risksList risks in the organization's risk register with filters and summary details.
Control Testing
/controls/{controlId}/testsCreate a control test result for a defined period with methodology, evidence, and conclusion.
Audit Findings
/audits/{auditId}/findings/{findingId}Update finding status, severity, ownership, and remediation plan.
Policy Attestations
/policies/{policyId}/attestationsRecord a user's attestation to a policy version with proof metadata.
Use Cases
Risk & Control Data Sync
- Mirror risk registers and control libraries into your internal systems - Keep likelihood/impact, residual scores, and owners current for analytics and reporting - Normalize control mappings across frameworks to drive continuous monitoring
Audit & Issue Remediation
- Pull audit findings and route remediation tasks to Jira/ServiceNow with SLAs - Upload evidence and test results from your product while preserving approvals and lineage - Track status changes and due dates for dashboards and executive reporting
Policy & Compliance Attestations
- Automate attestations for new policy versions from your app - Capture proof (IP/device, time, version) and push acknowledgements back to Diligent - Trigger re-attestation workflows based on role, regulation, or risk tier
Third-Party Risk & Vendor Oversight
- Sync vendor profiles and assessment results to your governance hub - Drive automated re-assessments and remediation tasks for high-risk third parties - Consolidate contracts, obligations, and ratings into unified views
Technical Specifications
Authentication
Username/password with MFA (SMS, email, TOTP) and SSO/OAuth where enabled; supports service accounts or customer-managed credentials
Response format
JSON with consistent resource schemas and pagination across modules
Rate limits
Tuned for enterprise throughput while honoring customer entitlements and usage controls
Session management
Automatic reauth and cookie/session rotation with health checks
Data freshness
Near real-time retrieval of risks, controls, audits, policies, and vendor objects
Security
Encrypted transport, scoped tokens, and audit logging; respects Diligent role-based permissions and data access controls
Webhooks
Optional asynchronous delivery for long-running workflows (e.g., approvals, attestations, audit status updates)
Latency
Sub-second responses for list/detail queries under normal load
Throughput
Designed for high-volume risk/control sync and audit/policy processing
Reliability
Retry logic, backoff, and idempotency keys minimize duplicate actions
Adaptation
Continuous monitoring for UI/API changes with rapid adapter updates
Frequently asked questions
Supergood supports workflows across commonly used modules such as Governance (Boards, Documents), Risk & Controls (Risk Registers, Control Testing), Audit (Engagements, Findings), Compliance & Policy (Policies, Attestations), and Third-Party Risk (Vendors, Assessments), subject to your licensing and entitlements. We scope coverage during integration assessment.
We support username/password + MFA (SMS, email, TOTP) and can operate behind SSO/OAuth when enabled. Sessions are refreshed automatically with secure challenge handling.
Yes. We normalize audit findings, issues, and remediation plans to match your ticketing schema, and deliver updates via webhooks or polling while complying with rate and permission constraints. We commonly integrate with Jira and ServiceNow.
Yes. We support uploading attachments via signed uploads, with checksum validation and time-limited URLs. Approval states and sign-offs are modeled explicitly in our normalized responses with user and timestamp metadata.