Integrations
An owner connects these under Settings. Slack, Jira and Linear use credentials you provide. SAML and SCIM use your identity provider. Nothing on this page is a webhook subscription: VendorVett does not offer outbound webhooks.
| Integration | Plan | Status | What it does |
|---|---|---|---|
| Public API | Business | Available | Organization API keys. See Authentication and the endpoint reference. |
| MCP server | Business | Available | Read-only tools over inventory, scores and the audit log. |
| Slack | Growth | Available | An incoming webhook you paste. Alerts and the weekly digest post there. |
| Jira and Linear | Growth | Available | Tickets you open from a corrective action. Status is read back hourly. |
| SAML single sign-on | Business | Available | Your identity provider. The sign-in page sends matching email domains there. |
| SCIM 2.0 | Business | Available | Users only, with a separate bearer token. Not an API key. |
| Google Workspace discovery | Growth | Coming soon | The connector is in the product and returns 503 until VendorVett's OAuth client is configured. |
| Microsoft Entra discovery | Growth | Coming soon | Same as Google Workspace: the start request returns 503 with code discovery_not_configured. |
| Outbound webhooks | — | Not offered | VendorVett does not send webhooks to a URL you register. |
MCP server
Business plan. Settings → API shows the URL and a client snippet. The server is one JSON-RPC endpoint:
POST https://api.vendorvett.com/api/orgs/ORG/mcp/Send Authorization: Bearer vvk_… or Api-Key vvk_…. A read-only key is enough. GET returns 405. A JSON array (a batch) is rejected. A notification with no id returns 202 and no body. Each tools/call is written to the audit log. The same per-key rate limit applies.
The tools are read-only:
- list_vendors — inventory, with optional search, criticality, status and limit (1–200, default 50).
- get_vendor — one vendor, including recent assessments, open monitoring signals, confirmed subprocessors and the latest screening.
- list_assessments — framework, status and scores. Optional vendor_id, status and limit.
- get_assessment_score — inherent and residual scores with the per-question working.
- search_audit_log — events, newest first. Optional action, target_type, since and limit.
- verify_audit_chain — re-hashes the log and reports altered, removed or reordered events.
- portfolio_summary — counts by criticality and status, overdue reviews, open assessments and signals, and the most shared subprocessors.
A bad argument comes back inside the tool result with isError: true, so the caller can correct it.
Slack, Jira and Linear
Slack (Growth) takes an incoming webhook URL and a channel name for your own reference. Alerts post there with a link back to VendorVett. Approving or signing off still happens in VendorVett, where the action is checked and audited.
Jira takes the site URL, account email, project key, issue type and an API token. Linear takes a team id and a personal API key. Opening a ticket is an action on the record in the app. An hourly job reads open tickets and, when the ticket is done, marks the link closed. The VendorVett item itself stays open until a person closes it.
SAML and SCIM
SAML (Business) is configured by an owner under Settings → SSO & SCIM: the identity provider's entity id, sign-in URL and signing certificate, and the email domains that should use it. The sign-in page's single sign-on button looks the domain up. New members can be created on first sign-in when a seat is free and just-in-time provisioning is on.
SCIM (Business) is a different credential, issued on the same settings tab. The base URL is https://api.vendorvett.com/scim/v2 and the header is Authorization: Bearer vvs_…. The resource is Users: list (filter userName eq "…"), create, get, replace, patch (active and name) and delete. Deactivating or deleting removes the membership. It does not delete the person's account or the audit history. The last owner cannot be removed, and seat limits apply.
Discovery
Coming soon. Google Workspace and Microsoft Entra scans exist in the product for the Growth plan. Starting a scan returns 503 with code discovery_not_configured until VendorVett's OAuth client for that provider is configured. There is no scan to run before that.