Skip to content
vendorvett.

API reference

Calls go to https://api.vendorvett.com with Authorization: Api-Key vvk_…. Replace ORG with your organization id. The machine-readable schema, generated from the API and limited to these paths, is openapi/public-api.json (version 2026-10-17).

The index further down is every path a key is allowed to address. A path can still return 402 or 503 when the plan lacks the feature or a provider is not configured. Where the generator did not declare a response schema, this page does not invent one. The sections above the index are the fields those serializers actually return.

Vendors

GET /api/orgs/ORG/vendors/ lists the inventory. Any member may read. Creating or changing a vendor needs an analyst or an owner, and a write key. Filters: search, ordering, criticality, status, tier, risk=high, review=overdue, plus page and page_size.

curl -s -X POST "https://api.vendorvett.com/api/orgs/ORG/vendors/" \
  -H "Authorization: Api-Key vvk_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "legal_name": "Northwind Analytics",
    "country": "US",
    "criticality": "HIGH",
    "status": "ACTIVE",
    "website": "https://northwind.example"
  }'

legal_name and country (ISO 3166-1 alpha-2) are required. criticality is LOW, MEDIUM, HIGH or CRITICAL (default MEDIUM). status is PROSPECTIVE, ACTIVE, UNDER_REVIEW or OFFBOARDED (default PROSPECTIVE). tier is STRATEGIC, PREFERRED, STANDARD, TACTICAL, or blank. Optional profile fields are category, description, website, contact_email, contact_phone, headquarters, industry, relationship_since, internal_ref (unique in the organization), notes, contacts (a list of name, email and role) and review_interval_months.

The response adds read-only fields: id, country_name, latest_score, latest_assessment_status, assessment_count, document_count, last_reviewed_at, next_review_at, effective_review_interval_months, is_review_overdue, days_until_review, created_by, created_at and updated_at. GET, PATCH and DELETE /api/orgs/ORG/vendors/ID/ address one vendor. GET …/vendors/export/ is the same list as CSV. POST …/vendors/import/ takes a multipart file or a csv string. Without commit=true it only previews the rows.

Assessments

GET /api/orgs/ORG/assessments/ lists assessments. GET …/templates/ lists the questionnaires you can send, including the shared packs. Create an assessment with the vendor id, the template id and the vendor's email:

curl -s -X POST "https://api.vendorvett.com/api/orgs/ORG/assessments/" \
  -H "Authorization: Api-Key vvk_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": 42,
    "template": 7,
    "vendor_contact_email": "security@northwind.example",
    "framework": "SOC2",
    "due_date": "2026-11-30"
  }'

framework defaults to NIST_CSF. The values are NIST_CSF, SOC2, ISO27001, US_VENDOR_DD, ISO9001, DORA, NIS2, HIPAA, PCI_DSS and GDPR. DORA, NIS2, HIPAA and PCI_DSS require the Growth plan. The response includes status, vendor_name, template_name, inherent_score, residual_score and, once the assessment has left draft, portal_url. A single assessment also includes responses, score_breakdown and scored_at.

Status moves DRAFT → SENT → IN_PROGRESS → SUBMITTED → UNDER_REVIEW → COMPLETED. UNDER_REVIEW may instead go to AWAITING_CLARIFICATION and back. POST …/assessments/ID/send/ moves a draft to sent, emails the portal link, and returns the assessment plus email_sent. The vendor has no account; they use that signed link. POST …/start-review/ and POST …/complete/ are the reviewer's steps. Only a draft can be deleted.

Sanctions screening

GET /api/orgs/ORG/screening/ lists runs. ?vendor= limits the list to one vendor. Any member may read. Running a screen or adjudicating a match needs an analyst or an owner.

curl -s -X POST "https://api.vendorvett.com/api/orgs/ORG/screening/run/42/" \
  -H "Authorization: Api-Key vvk_your_key"

A completed run has status COMPLETED. If the list cannot be fetched the response is 503 and the run is stored as FAILED, which is not a clear result. Each run includes the vendor, the list provenance (provider, list_source, list_fingerprint, lists) and its matches. A match includes matched_name, entity_type, programs, list_name, jurisdiction, score, score_breakdown, matched_on and adjudication.

Adjudicate with decision TRUE_MATCH or FALSE_POSITIVE and a note of at least 10 characters. PENDING is the state before a person decides; it is not a value you can submit.

curl -s -X POST "https://api.vendorvett.com/api/orgs/ORG/screening/matches/MATCH/adjudicate/" \
  -H "Authorization: Api-Key vvk_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "decision": "FALSE_POSITIVE",
    "note": "Different entity: the listed party is in another country."
  }'

Reports

GET /api/orgs/ORG/assessments/ID/report/ returns application/pdf. The plan must include reports (Starter and above). The assessment must already have a residual score; otherwise the response is 409 and no file is produced. Generating a report is recorded on the audit log.

curl -s -L "https://api.vendorvett.com/api/orgs/ORG/assessments/ID/report/" \
  -H "Authorization: Api-Key vvk_your_key" \
  -o report.pdf

The PDF states the residual score beside its working, framework coverage, evidence digests and the audit events it cites. An AI narrative is included only where a named reviewer accepted it.

All operations

162 operations. Query parameters are listed when the schema declares them. A request body is noted when one is declared; the schema file has its shape.

Vendors

  • GET /api/orgs/{org_id}/vendors/

    Org-scoped vendor inventory. Tenant isolation: the queryset is hard-filtered to the org in the URL, and IsOrgMember guarantees the requester belongs to that org. RBAC: writes require ANALYST or OWNER.

    Query: ordering, page, page_size, search

  • POST /api/orgs/{org_id}/vendors/

    Org-scoped vendor inventory. Tenant isolation: the queryset is hard-filtered to the org in the URL, and IsOrgMember guarantees the requester belongs to that org. RBAC: writes require ANALYST or OWNER.

    Declares a request body.

  • GET /api/orgs/{org_id}/vendors/export/

    Stream the filtered inventory as CSV. Reuses ``get_queryset`` so the download is exactly what the user is looking at — the same search and filters, not the whole table.

  • POST /api/orgs/{org_id}/vendors/import/

    Preview, then import, vendors from a CSV. Every plan. ``commit`` false (the default) validates the file and reports what each row would do; true creates the rows that preview as "create". The file arrives as a multipart ``file`` or as ``csv`` text.

    Declares a request body.

  • GET /api/orgs/{org_id}/vendors/import/template/

    The CSV layout the import reads, with one example row.

  • GET /api/orgs/{org_id}/vendors/summary/

    Counts for the inventory header tiles. Aggregated in the database rather than derived from the page of rows the client happens to be showing, so the tiles stay correct once an org's inventory outgrows a single page.

  • GET /api/orgs/{org_id}/vendors/{id}/

    Org-scoped vendor inventory. Tenant isolation: the queryset is hard-filtered to the org in the URL, and IsOrgMember guarantees the requester belongs to that org. RBAC: writes require ANALYST or OWNER.

  • PATCH /api/orgs/{org_id}/vendors/{id}/

    Org-scoped vendor inventory. Tenant isolation: the queryset is hard-filtered to the org in the URL, and IsOrgMember guarantees the requester belongs to that org. RBAC: writes require ANALYST or OWNER.

    Declares a request body.

  • DELETE /api/orgs/{org_id}/vendors/{id}/

    Org-scoped vendor inventory. Tenant isolation: the queryset is hard-filtered to the org in the URL, and IsOrgMember guarantees the requester belongs to that org. RBAC: writes require ANALYST or OWNER.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/capa/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/capa/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/capa/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/capa/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • PATCH /api/orgs/{org_id}/vendors/{vendor_id}/capa/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • DELETE /api/orgs/{org_id}/vendors/{vendor_id}/capa/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/evaluations/

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/evaluations/

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/insurance/

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/insurance/

  • PATCH /api/orgs/{org_id}/vendors/{vendor_id}/insurance/{id}/

  • DELETE /api/orgs/{org_id}/vendors/{vendor_id}/insurance/{id}/

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/onboarding/

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/onboarding/bank-change/

  • PUT /api/orgs/{org_id}/vendors/{vendor_id}/onboarding/items/{key}/

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/onboarding/sam-check/

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/onboarding/status/

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/performance/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/performance/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/performance/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/performance/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • PATCH /api/orgs/{org_id}/vendors/{vendor_id}/performance/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • DELETE /api/orgs/{org_id}/vendors/{vendor_id}/performance/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/quality-certificates/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/quality-certificates/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/quality-certificates/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • POST /api/orgs/{org_id}/vendors/{vendor_id}/quality-certificates/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • PATCH /api/orgs/{org_id}/vendors/{vendor_id}/quality-certificates/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

    Declares a request body.

  • DELETE /api/orgs/{org_id}/vendors/{vendor_id}/quality-certificates/{id}/

    List/create for one vendor-scoped record type. Subclasses name the model, serializer, audit actions and which fields the trail records.

  • GET /api/orgs/{org_id}/vendors/{vendor_id}/scorecard/

    What the supplier would score if evaluated today. Nothing is saved.

Assessments

  • GET /api/orgs/{org_id}/assessments/

    Query: page, page_size

  • POST /api/orgs/{org_id}/assessments/

    Declares a request body.

  • GET /api/orgs/{org_id}/assessments/{id}/

  • PATCH /api/orgs/{org_id}/assessments/{id}/

    Declares a request body.

  • DELETE /api/orgs/{org_id}/assessments/{id}/

  • GET /api/orgs/{org_id}/assessments/{id}/chain/

    Verify the audit chain beneath this assessment's events. Any member may run it, not only owners: it names actions, times and hashes but not actors or IP addresses, so it reveals nothing the report does not. It is the ``audit_log`` plan feature (Starter and up), like the org-wide check on the audit page, since it is the same walk scoped to one assessment. Only this endpoint is gated: receipts call ``verify_assessment_chain`` directly, and recording is never gated. On demand and uncached, like the org-wide check, for the same reason: an integrity result is a statement about one moment.

  • GET /api/orgs/{org_id}/assessments/{id}/clarifications/

    List this assessment's clarification rounds, or raise a new one. Raising a round takes the questions currently marked FOLLOW_UP, copies each reviewer note across as the question the vendor is being asked, and snapshots the answer as it stands before anything replaces it.

  • POST /api/orgs/{org_id}/assessments/{id}/clarifications/

    List this assessment's clarification rounds, or raise a new one. Raising a round takes the questions currently marked FOLLOW_UP, copies each reviewer note across as the question the vendor is being asked, and snapshots the answer as it stands before anything replaces it.

    Declares a request body.

  • POST /api/orgs/{org_id}/assessments/{id}/clarifications/{number}/close/

    Close a round. Allowed whether or not the vendor replied. A vendor who goes quiet is the ordinary case, and a review that cannot be finished without them is a review held hostage — the reviewer records a verdict on what they have.

    Declares a request body.

  • POST /api/orgs/{org_id}/assessments/{id}/complete/

    Declares a request body.

  • PUT /api/orgs/{org_id}/assessments/{id}/questions/{question_id}/review/

    Record (or change) the analyst's verdict on one question. The first verdict on a submitted assessment starts the review, so the analyst does not have to press a separate button before working.

    Declares a request body.

  • GET /api/orgs/{org_id}/assessments/{id}/receipt/

    Issue a signed evidence receipt as JSON (default) or PDF. The query parameter is ``output``, not ``format``: DRF reserves ``?format=`` for renderer negotiation and would 404 on ``pdf``.

  • GET /api/orgs/{org_id}/assessments/{id}/report/

    Download the audit-ready PDF for this assessment. Available to any member of an org whose plan includes the report (Starter and up): it is the deliverable a viewer is most likely to need, and it contains nothing they cannot already read through the assessment detail endpoint.

  • POST /api/orgs/{org_id}/assessments/{id}/rescore/

    Re-run the deterministic scoring engine (e.g. after question weights changed). Only meaningful once answers exist — pre-submission there is nothing to score.

    Declares a request body.

  • POST /api/orgs/{org_id}/assessments/{id}/send/

    DRAFT → SENT. Generates the signed portal token and emails the link. Emailing is best-effort: a mail misconfiguration must not block the workflow, since the sender can always copy the link (``portal_url``) from the response. ``email_sent`` reports whether delivery succeeded.

    Declares a request body.

  • POST /api/orgs/{org_id}/assessments/{id}/start-review/

    Declares a request body.

  • GET /api/orgs/{org_id}/assessments/{id}/workspace/

    Everything the analyst review screen needs, in one response.

Questionnaire templates

  • GET /api/orgs/{org_id}/templates/

    Query: page, page_size

  • POST /api/orgs/{org_id}/templates/

    Declares a request body.

  • GET /api/orgs/{org_id}/templates/{id}/

Sanctions screening

  • GET /api/orgs/{org_id}/screening/

    Query: page, page_size

  • POST /api/orgs/{org_id}/screening/matches/{match_id}/adjudicate/

    Declares a request body.

  • POST /api/orgs/{org_id}/screening/run/{vendor_id}/

    Screen a vendor now. A provider that cannot serve the list yields 503 and a FAILED run — never a 200 with an empty match list. The client must not be able to confuse "we checked and found nothing" with "we could not check".

    Declares a request body.

  • GET /api/orgs/{org_id}/screening/{id}/

Documents

  • GET /api/orgs/{org_id}/documents/

    Org-scoped evidence library. Tenant isolation: the queryset is filtered to the org in the URL, and any vendor/assessment an upload is attached to is re-resolved inside that same org — a foreign primary key yields 400, never a cross-tenant link. RBAC: reads for any member, writes for ANALYST or OWNER.

    Query: page, page_size

  • POST /api/orgs/{org_id}/documents/

    Org-scoped evidence library. Tenant isolation: the queryset is filtered to the org in the URL, and any vendor/assessment an upload is attached to is re-resolved inside that same org — a foreign primary key yields 400, never a cross-tenant link. RBAC: reads for any member, writes for ANALYST or OWNER.

    Declares a request body.

  • GET /api/orgs/{org_id}/documents/{id}/

    Org-scoped evidence library. Tenant isolation: the queryset is filtered to the org in the URL, and any vendor/assessment an upload is attached to is re-resolved inside that same org — a foreign primary key yields 400, never a cross-tenant link. RBAC: reads for any member, writes for ANALYST or OWNER.

  • DELETE /api/orgs/{org_id}/documents/{id}/

    Org-scoped evidence library. Tenant isolation: the queryset is filtered to the org in the URL, and any vendor/assessment an upload is attached to is re-resolved inside that same org — a foreign primary key yields 400, never a cross-tenant link. RBAC: reads for any member, writes for ANALYST or OWNER.

  • GET /api/orgs/{org_id}/documents/{id}/download/

    Mint a short-expiry signed URL. Never returns a permanent link. CLEAN files are issued straight away. A file the scanner could not check (``Document.is_unscanned``) is issued only when the caller sends ``?acknowledge_unscanned=1``, which the app does after the member has confirmed a warning; without it the answer is 409 with the warning, so no client can fetch one by accident. INFECTED and still-scanning files are never issued.

Audit log

  • GET /api/orgs/{org_id}/audit/

    Page of events, plus cheap chain stats for the page header. The stats ride along rather than needing a second request, but they are deliberately *not* a verification: a header that claimed "intact" on every page load would be walking the whole chain on every page load. Integrity is checked on demand via ``verify``.

    Query: page, page_size

  • GET /api/orgs/{org_id}/audit/export/

    CSV of the filtered trail, including the hashes. The digests are exported alongside the rows so the file is independently checkable: an auditor holding the export can re-run the chain themselves without trusting this endpoint's verdict.

  • GET /api/orgs/{org_id}/audit/verify/

    Walk the whole chain and report whether it is intact. Deliberately on demand and not cached: a cached integrity result is worth nothing, because the thing it asserts could have changed a second after it was computed.

Trust center

  • POST /api/orgs/{org_id}/trust/documents/

  • DELETE /api/orgs/{org_id}/trust/documents/{id}/

  • GET /api/orgs/{org_id}/trust/profile/

  • PUT /api/orgs/{org_id}/trust/profile/

  • POST /api/orgs/{org_id}/trust/profile/publish/

  • GET /api/orgs/{org_id}/trust/questionnaires/

  • POST /api/orgs/{org_id}/trust/questionnaires/

  • GET /api/orgs/{org_id}/trust/questionnaires/{id}/

  • DELETE /api/orgs/{org_id}/trust/questionnaires/{id}/

  • POST /api/orgs/{org_id}/trust/questionnaires/{id}/autofill/

  • GET /api/orgs/{org_id}/trust/questionnaires/{id}/export.csv

  • PATCH /api/orgs/{org_id}/trust/questions/{id}/

  • GET /api/orgs/{org_id}/trust/requests/

  • POST /api/orgs/{org_id}/trust/requests/{id}/{decision}/

MCP

  • GET /api/orgs/{org_id}/mcp/

  • POST /api/orgs/{org_id}/mcp/

ai

  • GET /api/orgs/{org_id}/ai/document-analyses/

    Shared accept/reject action. Acceptance is the audited moment an AI draft becomes part of the assessment record. Subclasses declare ``audit_action`` and ``audit_label`` so the trail names the artifact in the reviewer's terms — "SOC2 report" rather than "DocumentAnalysis 500".

    Query: page, page_size

  • POST /api/orgs/{org_id}/ai/document-analyses/

    Queue analysis of one scan-clean document in this org.

    Declares a request body.

  • GET /api/orgs/{org_id}/ai/document-analyses/{id}/

    Shared accept/reject action. Acceptance is the audited moment an AI draft becomes part of the assessment record. Subclasses declare ``audit_action`` and ``audit_label`` so the trail names the artifact in the reviewer's terms — "SOC2 report" rather than "DocumentAnalysis 500".

  • POST /api/orgs/{org_id}/ai/document-analyses/{id}/review/

    Shared accept/reject action. Acceptance is the audited moment an AI draft becomes part of the assessment record. Subclasses declare ``audit_action`` and ``audit_label`` so the trail names the artifact in the reviewer's terms — "SOC2 report" rather than "DocumentAnalysis 500".

    Declares a request body.

  • GET /api/orgs/{org_id}/ai/narratives/

    Shared accept/reject action. Acceptance is the audited moment an AI draft becomes part of the assessment record. Subclasses declare ``audit_action`` and ``audit_label`` so the trail names the artifact in the reviewer's terms — "SOC2 report" rather than "DocumentAnalysis 500".

    Query: page, page_size

  • POST /api/orgs/{org_id}/ai/narratives/

    Queue a narrative draft for one scored assessment.

    Declares a request body.

  • GET /api/orgs/{org_id}/ai/narratives/{id}/

    Shared accept/reject action. Acceptance is the audited moment an AI draft becomes part of the assessment record. Subclasses declare ``audit_action`` and ``audit_label`` so the trail names the artifact in the reviewer's terms — "SOC2 report" rather than "DocumentAnalysis 500".

  • POST /api/orgs/{org_id}/ai/narratives/{id}/review/

    Shared accept/reject action. Acceptance is the audited moment an AI draft becomes part of the assessment record. Subclasses declare ``audit_action`` and ``audit_label`` so the trail names the artifact in the reviewer's terms — "SOC2 report" rather than "DocumentAnalysis 500".

    Declares a request body.

API keys

  • GET /api/orgs/{org_id}/api-keys/

  • POST /api/orgs/{org_id}/api-keys/

  • DELETE /api/orgs/{org_id}/api-keys/

  • GET /api/orgs/{org_id}/api-keys/{id}/

  • POST /api/orgs/{org_id}/api-keys/{id}/

  • DELETE /api/orgs/{org_id}/api-keys/{id}/

billing

  • GET /api/orgs/{org_id}/billing/

  • POST /api/orgs/{org_id}/billing/addons/

  • POST /api/orgs/{org_id}/billing/checkout/

  • POST /api/orgs/{org_id}/billing/portal/

chasing

  • GET /api/orgs/{org_id}/chasing/

    Pause, resume, stop and remind. Analysts and owners only; viewers can read the state.

  • POST /api/orgs/{org_id}/chasing/assessments/{assessment_id}/remind/

    Manual "send reminder". Every plan — see apps.assessments.scheduling.

  • POST /api/orgs/{org_id}/chasing/assessments/{assessment_id}/stop/

    Hard stop. There is deliberately no undo — see AssessmentChaseStop.

  • POST /api/orgs/{org_id}/chasing/vendors/{vendor_id}/pause/

    Pause, resume, stop and remind. Analysts and owners only; viewers can read the state.

  • DELETE /api/orgs/{org_id}/chasing/vendors/{vendor_id}/pause/

    Pause, resume, stop and remind. Analysts and owners only; viewers can read the state.

dashboard

  • GET /api/orgs/{org_id}/dashboard/

    GET /api/orgs/<org_id>/dashboard/ — everything the landing page needs.

Discovery

Coming soon. Starting a Google or Microsoft scan returns 503 until that connector is configured. See Integrations.

  • GET /api/orgs/{org_id}/discovery/

  • POST /api/orgs/{org_id}/discovery/import/

  • POST /api/orgs/{org_id}/discovery/{id}/{decision}/

  • POST /api/orgs/{org_id}/discovery/{provider}/start/

Slack, Jira and Linear

  • GET /api/orgs/{org_id}/integrations/

  • PUT /api/orgs/{org_id}/integrations/{kind}/

  • DELETE /api/orgs/{org_id}/integrations/{kind}/

  • POST /api/orgs/{org_id}/integrations/{kind}/test/

invitations

  • GET /api/orgs/{org_id}/invitations/

    Query: page, page_size

  • POST /api/orgs/{org_id}/invitations/

    Declares a request body.

members

  • GET /api/orgs/{org_id}/members/

    Query: page, page_size

  • PATCH /api/orgs/{org_id}/members/{id}/

    Declares a request body.

  • DELETE /api/orgs/{org_id}/members/{id}/

Monitoring

  • GET /api/orgs/{org_id}/monitoring/

  • PATCH /api/orgs/{org_id}/monitoring/policy/

  • POST /api/orgs/{org_id}/monitoring/signals/{id}/{action}/

  • GET /api/orgs/{org_id}/monitoring/vendors/{vendor_id}/

  • POST /api/orgs/{org_id}/monitoring/vendors/{vendor_id}/run/

  • POST /api/orgs/{org_id}/monitoring/vendors/{vendor_id}/technologies/

  • DELETE /api/orgs/{org_id}/monitoring/vendors/{vendor_id}/technologies/{id}/

notifications

  • GET /api/orgs/{org_id}/notifications/

    Query: page, page_size

  • POST /api/orgs/{org_id}/notifications/read-all/

    Declares a request body.

  • GET /api/orgs/{org_id}/notifications/unread-count/

    The bell's badge. Its own endpoint so the poll is one indexed COUNT, not a page of rows the client throws away.

  • POST /api/orgs/{org_id}/notifications/{id}/read/

    Declares a request body.

Nth-party risk

  • GET /api/orgs/{org_id}/nth-party/

  • PATCH /api/orgs/{org_id}/nth-party/entries/{id}/

  • DELETE /api/orgs/{org_id}/nth-party/entries/{id}/

  • GET /api/orgs/{org_id}/nth-party/vendors/{vendor_id}/

  • POST /api/orgs/{org_id}/nth-party/vendors/{vendor_id}/

  • POST /api/orgs/{org_id}/nth-party/vendors/{vendor_id}/extract/

privacy

  • GET /api/orgs/{org_id}/privacy/deletion/

  • POST /api/orgs/{org_id}/privacy/deletion/

  • DELETE /api/orgs/{org_id}/privacy/deletion/

  • GET /api/orgs/{org_id}/privacy/exports/

    Query: page, page_size

  • POST /api/orgs/{org_id}/privacy/exports/

    Declares a request body.

  • GET /api/orgs/{org_id}/privacy/exports/{id}/download/

    A short-lived link to the archive, minted on demand. Every issue is audited with the manifest digest, so the trail records not only that a copy of everything left, but exactly which copy.

scim tokens

  • GET /api/orgs/{org_id}/scim-tokens/

  • POST /api/orgs/{org_id}/scim-tokens/

  • DELETE /api/orgs/{org_id}/scim-tokens/

  • GET /api/orgs/{org_id}/scim-tokens/{id}/

  • POST /api/orgs/{org_id}/scim-tokens/{id}/

  • DELETE /api/orgs/{org_id}/scim-tokens/{id}/

search

  • GET /api/orgs/{org_id}/search/

sso

  • GET /api/orgs/{org_id}/sso/saml/

  • PUT /api/orgs/{org_id}/sso/saml/

Approved suppliers

  • GET /api/orgs/{org_id}/suppliers/

  • GET /api/orgs/{org_id}/suppliers/export.{fmt}

    CSV or PDF of the filtered ASL. Part of the ISO 9001 pack, so gated on that entitlement rather than the general ``csv_export`` one: an evaluation you cannot hand to an auditor is not documented information.

  • GET /api/orgs/{org_id}/suppliers/scorecard-config/

  • PUT /api/orgs/{org_id}/suppliers/scorecard-config/

tickets

  • GET /api/orgs/{org_id}/tickets/

  • POST /api/orgs/{org_id}/tickets/