Claude can add documents to third-party risk management records in three ways: upload a file, save a web link, or attach a document that's already in Core GRC. Adding a document needs manage permission for assets (canManageAssets). Reading one needs view permission (canViewAssets).

Every document belongs to a record. Give Claude the record type (vendor, asset, service, element, processing-activity, or ai-system) and the record, by name or id.

Upload a file

Files go through a signed upload link, the same way as in the Core GRC app. There's no base64 upload.

  1. Claude calls tprm_create_document_upload_url with the file's type and name, for example application/pdf and soc2-report.pdf. Core GRC returns an upload link that works for 15 minutes.
  2. The file is uploaded to that link with an HTTP PUT. Its Content-Type must match step 1.
  3. Claude calls tprm_create_document with the record, a name, type file, a category, and the objectPath from step 1.

Step 2 needs a client that can send the file itself, such as Claude Code with the file on your computer, or the Core GRC CLI with curl. In Claude on the web, Desktop, or mobile, upload the file in the Core GRC app and ask Claude to attach it (see below).

No upload needed. Ask, for example:

Add Acme's privacy policy at https://acme.example/privacy to the Acme vendor record as a Policy document.

Claude calls tprm_create_document with type web-reference and the sourceUrl.

Attach an existing document

Attach our existing "Acme SOC 2 2025" document to the Acme Hosting service.

Claude finds the document with tprm_list_documents and calls tprm_create_document with its sourceDocumentId. The name, type, and category are copied from the original.

Read a document

tprm_get_document returns a document's details. Ask for its text and Claude passes includeText, which returns the extracted text (shortened for long files). Download links and storage paths are not returned through the connector; download files from the Core GRC app.