For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Coverbase is a third-party risk and procurement platform. These docs cover both sides of it: using the product, and building against it.
Pick the one that matches what you are doing.
Use the product
Step-by-step guides for setting up Coverbase and running it day to day. Start here if you have the product open in another tab.
Build an integration
The REST API, import and export, webhooks, and the workflow engine. Start here if you are moving data in or out.
Evaluate the platform
Compliance posture, identity and access, data protection, regulatory alignment, service levels, and contract terms. Start here if you are reviewing Coverbase as a vendor.
If you are evaluating Coverbase
The answers a third-party risk team, a procurement team or an examiner asks for, each on its own page.Regulatory alignment
How the platform maps to the 2023 Interagency Guidance on Third-Party Relationships, the Interagency Guidelines Establishing Information Security Standards, FFIEC, GLBA, DORA and NCUA.
Reviews, approvals and gates
Configurable gate outcomes, parallel domain-scoped SME reviews, multi-approver and threshold logic, and rework loops with reasons, comments and round counts.
Identity and access
SAML 2.0 SSO inheriting your IdP’s MFA and conditional access, just-in-time provisioning, IGA-driven lifecycle, RBAC and network restriction.
Service levels and support
The P0 to P3 severity ladder with response clocks, the timed escalation path, and the 99.9% uptime commitment.
Contract terms and exit
Incident notification, data return and destruction, renewal and notice, subprocessors, and the diligence package.
Evidence packaging
Producing the complete due-diligence file for one third party, and assembling an examination package.
If you are new to Coverbase
Three guides cover most people. You only need the one that matches your job.I am setting up Coverbase
Import vendors, build the intake questionnaire, tune scales and control sets, then set roles, templates and monitoring.
I run vendor risk day to day
Triage requests, launch assessments, review what the AI found, engage vendors, and close the loop.
I just need a tool approved
The short one. What you will be asked, how to file it, and what happens next.
Building on Coverbase
Three integration surfaces. Each works on its own, and you can combine them.Export API
Pull vendor, assessment and control data out of Coverbase into your dashboards, BI tools, and remediation workflows.
Import API
Push vendor, assessment and service data in from your ERP, CMDB, legacy GRC platform, or service catalog.
MCP server
Connect Claude, Cursor, or any MCP client and work with your TPRM program through conversation.
1
Get an API key
Ask a Coverbase admin in your organization to provision one. See API keys.
2
Store it properly
Keep it in a secrets manager. Never commit a key to source control or embed it in client-side code.
3
Test the connection
Call
/v1/utils/authtest with your bearer token to check connectivity, key validity, and firewall rules before wiring anything up.4
Read the concepts page for your surface
Then jump to the reference for the endpoints you need.
Base URL
https://api.coverbase.appFormat
REST, JSON over HTTPS, encrypted in transit.
What else is here
Products
What each part of the platform does, from Autonomous Intake to Agentic Inspect.
Field reference
Every filterable field, its path, and where it comes from.
Integration workflows
Platform-specific guides for ServiceNow, Jira, Slack, OneTrust, and more.
Reporting and templates
Assessment report templates and the placeholders available to them.
Need help?
Product support
Security issues
Book a meeting
Talk to our team about your integration.