For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
These endpoints manage vendors and services beyond the basic create, read and update calls in the Vendors API. Each endpoint needs the same permission as the matching screen in the dashboard, and returns the same data the dashboard shows.
All endpoints are scoped to the API key’s organization. See API conventions for shared behavior. None of these endpoints honor Idempotency-Key.
Errors
Every error body has this shape:Actions an API key cannot take
To protect decisions that need a person, an API key gets403 api_key_not_allowed on every endpoint that archives, deletes or approves. A signed-in user calling the same endpoint with their own token is allowed. These are:
POST /v1/vendors/{vendor_id}/archivePOST /v1/vendors/{vendor_id}/mergeandPOST /v1/vendors/bulk-merge, because a merge archives the sourcePOST /v1/vendors/bulk-actionwithaction: "archive"DELETE /v1/vendors/{vendor_id}/subprocessors/{subprocessor_id}POST /v1/vendors/{vendor_id}/subprocessor-proposals/decidePOST /v1/vendor-parent-proposals/decidePOST /v1/services/{service_id}/mergeandPOST /v1/services/{service_id}/promote, because both archive a serviceDELETE /v1/departments/{department_id}andDELETE /v1/departments/{department_id}/members/{user_id}POST /v1/vendor-discoveries/approveandPOST /v1/vendor-discoveries/dismissPOST /v1/screening-matches/{match_id}/dispositionPOST /v1/bills-of-materials/{bom_id}/archivePOST /v1/documents/bulk-actionwithaction: "archive"POST /v1/services/bulk-actionwithaction: "archive"DELETE /v1/vendor-kyc/{kyc_id}, andPATCH /v1/vendor-kyc-fields/{field_id}withis_archived: trueDELETE /v1/vendor-discovery/aliases/{alias_id}PATCH /v1/data-classes/{data_class_id}when it archives or restores a classPOST /v1/vendors/{vendor_id}/intelligence/{surface}/revision/{proposal_id}/applyPOST /v1/prequalification-evaluations/{evaluation_id}/overridePOST /v1/record-drift/{drift_id}/decidePOST /v1/supplier_reviews/{review_id}/rejectandPOST /v1/legal_entity_assignments/{assignment_id}/rejectDELETE /v1/vendors/{vendor_id}/financial-statementsPUT /v1/vendor-sso/settings, which needs an organization admin and returns403 admin_requiredto a key
Endpoints
List endpoints that take
limit and offset return items, total, limit and offset. limit defaults to 50 and accepts 1 to 200.
Archive, merge and bulk-edit vendors
Archive a vendor
POST
POST /v1/vendors/{vendor_id}/archivevendor_id, name and is_archived: true.
Merge two vendors
POST
POST /v1/vendors/{vendor_id}/mergestring
required
The vendor to merge in and archive (
cbvndr_...).vendor_id, name and source_vendor_id. Returns 400 invalid_merge when the two vendors cannot be merged, for example when they are the same vendor.
Run several merges
POST
POST /v1/vendors/bulk-mergeobject[]
required
Each item has
target_vendor_id, source_vendor_id and an optional strategy. Use merge_equal (the default) to merge and archive the source, make_service to turn the source into a service under the target, or delete_source to archive the source without moving anything. make_service also needs service:create:org.results (one per pair, with success and error), success_count and failure_count.
To find candidate pairs, call GET /v1/vendor-duplicate-groups. It returns groups of live vendors that share a domain, a brand or a similar name, with each vendor’s assessment_count.
Change many vendors at once
POST
POST /v1/vendors/bulk-action400 invalid_bulk_action).
string[]
required
Between 1 and 100 vendor IDs.
string
required
One of
tag, assign-relationship-owner, assign-risk-analyst, update-status, archive, set-next-assessment-date.string[]
For
tag: up to 15 tags. Required for that action.string
default:"add"
For
tag: add or remove.string
For the two assign actions: the user to add. Required for those actions.
string
For
update-status: a vendor status ID. Required for that action.integer | null
For
set-next-assessment-date: unix seconds, or null to clear.tag, update-status and set-next-assessment-date actions need vendor:update:org. The assign actions need vendor:assign:org. archive needs vendor:archive:org and a signed-in user. Returns action and vendor_count.
cURL
Risk profile and business units
GET /v1/vendors/{vendor_id}/risk-profile returns the vendor’s portfolio risk profile: bcp_documented, bcp_last_tested_at, rto_hours, rpo_hours, meets_rto_rpo, dr_plan_documented, pen_test_last_at, ir_plan_documented, subprocessor_list_current, ai_usage_disclosed, ai_data_types, data_processing_regions, data_types_processed, integration_depth (deep, moderate or shallow), viable_alternatives_count, substitutability_score and is_user_edited. Fields read as their defaults until the profile is saved or extracted from a completed assessment.
PUT /v1/vendors/{vendor_id}/risk-profile replaces the editable fields with the body you send. It is a full replace, so an omitted field resets to its default. To change one field, read the profile, change the field and send the whole profile back. A save sets is_user_edited, and the automatic extraction never overwrites a user-edited profile.
GET /v1/vendors/{vendor_id}/business-unit-dependencies lists the departments that depend on the vendor, each with criticality and usage_description. Dependencies are derived nightly from the vendor’s services.
PUT /v1/vendors/{vendor_id}/business-unit-dependencies/{department_id} sets one dependency.
string
required
critical, high, elevated or acceptable.string
What the business unit uses the vendor for.
404 when the department is not a live department of your organization.
Subprocessors
GET /v1/vendors/{vendor_id}/subprocessors returns subprocessors, the fourth parties the vendor depends on. is_user_edited separates links a person manages from links the subprocessor-list crawl found.
POST /v1/vendors/{vendor_id}/subprocessors links a subprocessor. Send either subprocessor_id (an existing catalog entry) or name (an unknown name creates the entry). Optional fields are category, hq_location, inherent_risk_level_id, tag_ids, and entity_id or entity_website to resolve the company. Send entity_id or entity_website, not both.
PATCH /v1/vendors/{vendor_id}/subprocessors/{subprocessor_id} edits the catalog entry, which every vendor in your organization that links it shares. Send inherent_risk_level_id: null to clear the level and tag_ids: [] to clear the tags.
PATCH /v1/vendors/{vendor_id}/subprocessors/{subprocessor_id}/relationship edits your organization’s record of the dependency: is_active, dependency_type, dependency_detail, mode, data_scopes, description, data_class_ids, service_ids and transfer_regions. Only the fields you send change. After you edit, the nightly inheritance stops proposing changes to the link.
DELETE /v1/vendors/{vendor_id}/subprocessors/{subprocessor_id} unlinks the subprocessor. The link is archived, so the crawl cannot add it back.
Each of these write endpoints returns the vendor’s full subprocessor list.
Subprocessor proposals
GET /v1/vendors/{vendor_id}/subprocessor-proposals lists the subprocessors the shared data suggests for the vendor. An organization that inherits automatically has an empty list. POST .../subprocessor-proposals/refresh re-scans the vendor now instead of overnight.
POST /v1/vendors/{vendor_id}/subprocessor-proposals/decide accepts or rejects proposals.
boolean
required
true links each subprocessor, false records a durable rejection.string[]
The proposals to decide. Omit to decide every pending proposal on the vendor.
string
Why, when rejecting.
decided_count, accepted_count, rejected_count and remaining_count.
GET /v1/vendors/{vendor_id}/fourth-party-coverage says how complete and how fresh the vendor’s fourth-party list is, per source.
Corporate family and financial stability
GET /v1/vendors/{vendor_id}/corporate-family returns the vendor’s ultimate parent and every vendor under it, with the family’s engagements, highest residual risk and contract value. It needs the engagement record feature, or it returns 404 not_enabled.
GET /v1/vendor-parent-proposals?status=pending lists parent links the company registers suggest. status is pending (the default), accepted or rejected. POST /v1/vendor-parent-proposals/decide takes ids and a decision of accepted or rejected. An accepted link that would loop the family refuses the whole batch with 422.
GET /v1/vendors/{vendor_id}/financial-stability rates the vendor under your organization’s financial stability methodology and returns the filed ratios behind the rating. GET .../financial-stability/peers rates the vendor’s security peers the same way, and needs_refresh says a refresh would read newer SEC figures. POST .../financial-stability/peers/refresh returns 202 with queued, the number of peers whose figures were queued for reading. These three need Zero Touch Assessments, or they return 404.
Risk domain scores and risk changes
GET /v1/vendors/{vendor_id}/risk-domain-scores returns data, one entry per risk domain with the inherent and residual score and level and the score_source. GET .../risk-domain-scores/{risk_domain_id} returns one domain.
POST /v1/vendors/{vendor_id}/risk-domain-scores creates or updates one domain’s score and recomputes the vendor’s tier.
string
required
The risk domain.
string
required
Where the score comes from, for example
manual for a score you set by hand or assessment.number | null
Send
null to clear. The same applies to inherent_risk_level_id, residual_risk_score and residual_risk_level_id.string
Required when a
manual score changes a value. Without it the request returns 422 score_override_rationale_required.GET /v1/services/{service_id}/risk-domain-scores and POST /v1/services/{service_id}/risk-domain-scores do the same for a service, and the write recomputes the vendor rollup.
GET /v1/vendors/{vendor_id}/risk-changes returns the vendor’s risk-change history, newest first, as data and total_count. Filter with risk_type (inherent_risk or residual_risk) and pass include_dismissed=true to include dismissed changes.
Budgets
GET /v1/vendors/{vendor_id}/budget?year=2026 returns the vendor’s budget for the year, or null.
PUT /v1/vendors/{vendor_id}/budget?year=2026 sets the budget, replacing the one there.
string | null
required
The amount, with up to two decimals.
null clears the budget and the response is null.string
ISO currency code. Without it, the existing budget’s currency or your organization’s base currency applies.
string
A note, up to 2000 characters.
string
The CPI rate used to price next year’s request.
GET /v1/vendors/{vendor_id}/budget-summary?year=2026 reads the budget against the contracts that count towards it: committed_amount, remaining_amount, percent_used, is_over_budget, the counted contracts, and next_year_request. Pass cpi_pct to price the request at another rate.
POST /v1/vendors/{vendor_id}/budget-request saves next year’s budget as this year’s committed spend raised by CPI. Send year and cpi_pct. It returns 422 when no CPI rate is available.
Services
POST /v1/services/{service_id}/merge merges source_service_id into the path service and archives the source.
POST /v1/services/{service_id}/relink moves the service to target_vendor_id. A service with no records of its own moves at once and the response is the moved service. Otherwise nothing moves and the response carries record_counts. To move the service with the records exclusive to it, send the same body to POST /v1/services/{service_id}/relink/confirm.
POST /v1/services/{service_id}/promote turns the service into a standalone vendor and archives the service. Send the new vendor’s fields under vendor (at least name). Most records stay with the original vendor, and moved_record_counts and retained_record_counts say what moved.
Departments
Departments are business units and user groups.GET /v1/departments lists them (pass include_archived=true for archived ones) and GET /v1/departments/{department_id} returns one with its lead and members.
POST /v1/departments returns 201 and takes name, description, assignment_strategy and lead_user_id. PATCH /v1/departments/{department_id} changes the fields you send; send description: null or lead_user_id: null to clear one.
POST /v1/departments/{department_id}/members adds user_id with an optional rotation_order, and returns 400 when the user already belongs. PATCH .../members/{user_id} changes member_status, inactive_from, inactive_to or rotation_order; send null for an inactive_ field to clear the out-of-office window. Every write is recorded on the department’s activity feed.
Tags and tag groups
GET /v1/tags lists live tags. POST /v1/tags returns 201 and takes key (the group), value and an optional color. It returns 400 when the tag already exists. PATCH /v1/tags/{tag_id} changes key, value or color. To archive a tag, use the dashboard.
GET /v1/tag-group-settings lists every tag group with a setting: key, rollup_mode, ranked_tag_ids (riskiest first) and category.
PUT /v1/tag-group-settings sets one group.
string
required
The tag group. A blank key returns
400.string
How service tags reach the vendor.
union leaves vendor tags to whoever writes them. highest_rank keeps only the riskiest tag across the vendor’s active services.string[]
The group’s tags, riskiest first. Tags you leave out become unranked.
string | null
The heading the group is filed under.
null or blank clears it.rollup_mode or ranked_tag_ids recomputes vendor tags.
Discovered vendors
These endpoints need the vendor discovery integration, or they return404.
GET /v1/vendor-discoveries lists vendors your integrations discovered, one row per vendor across sources. Filter with review_status (pending by default, approved or dismissed) and search.
POST /v1/vendor-discoveries/approve takes discovery_ids and an optional target_vendor_id. Each discovery links to a matching vendor, merges onto target_vendor_id, or creates a vendor. The response lists approved_discovery_ids, created_vendor_ids and linked_vendor_ids.
POST /v1/vendor-discoveries/dismiss takes discovery_ids and an optional reason.
Both are all or nothing and return 409 when a discovery was already reviewed. GET /v1/vendors/{vendor_id}/discoveries lists every integration that discovered the vendor, with its records.
Screening
These endpoints need sanctions screening, or they return404 not_found. They also need screening_match permissions, which API keys do not hold, so call them with a signed-in user’s token.
GET /v1/screening/settings returns your screening configuration. GET /v1/vendors/{vendor_id}/screening returns the vendor’s screening subjects (the company and the people you enrolled), their latest runs and their open matches. GET /v1/screening-runs lists runs, newest first, and takes vendor_id, subject_id, limit and offset.
POST /v1/screening-matches/query filters matches, and GET /v1/screening-matches/{match_id} returns one match with its evidence and history. To record a decision on a match, a signed-in user sends POST /v1/screening-matches/{match_id}/disposition. API keys get 403 api_key_not_allowed.
PATCH /v1/screening-subjects/{subject_id} edits a subject, for example whether it is monitored.
To screen one name once, send POST /v1/screening/ad-hoc with name and kind (entity or person), and optionally vendor_id, country and feeds. Feeds your organization switched off are refused with 400. To screen every live subject of a vendor now, send POST /v1/vendors/{vendor_id}/screening/rescreen; the response lists dispatched_subject_ids. To enroll a person you know belongs to the vendor, send POST /v1/vendors/{vendor_id}/screening/people with name, and optionally country, role and screen_now. It returns 201 with the new subject.
Vendor SSO
GET /v1/vendor-sso/summary counts the vendors your identity provider shows in use and how many enforce SSO. GET /v1/vendors/{vendor_id}/sso lists the applications linked to one vendor. GET /v1/vendor-sso/applications lists applications; pass unlinked=true or suggested=true to narrow it.
To link an application to a vendor, send PUT /v1/vendor-sso/applications/{application_id}/vendor. To accept several suggested matches at once, send POST /v1/vendor-sso/applications/confirm. To clear a link so matching runs again, send POST /v1/vendor-sso/applications/{application_id}/vendor/reset. GET /v1/vendor-sso/settings reads the settings. PUT /v1/vendor-sso/settings replaces them, and only an organization admin can call it, so an API key gets 403 admin_required. A change to matching or findings checks every vendor again.
To open an unassigned finding for each approved vendor without SSO that has none yet, send POST /v1/vendor-sso/findings/open. Pass vendor_ids to limit it and due_days to set the due date. The response says how many were opened.
Data quality
These endpoints need the engagement record feature, or they return404 not_enabled.
GET /v1/data-quality-rules returns the per-tier rules: which fields count, how old a value may be, and the score threshold. PUT /v1/data-quality-rules replaces them, and saving any rule turns the daily check on. It returns 422 for an unknown field or a tier listed twice.
GET /v1/vendors/{vendor_id}/data-quality-score returns the vendor’s latest score and the reasons behind it, or null before the daily check has scored it.
Company registration
POST /v1/vendors/{vendor_id}/company-registration/proposal searches the company registers for the vendor’s legal entity and returns candidates. Nothing is saved. POST .../company-registration/confirm saves one candidate as the vendor’s registered company. POST .../company-registration/undo reverts the last confirmation, and POST .../company-registration/rematch runs the match again. The last three return the saved registration profile.
Nth parties and bills of materials
POST /v1/nth-parties/query filters, sorts and pages the companies your vendors depend on, with the same unified filter body the dashboard uses (filter, sort, search, limit, offset).
GET /v1/bills-of-materials/{bom_id} returns one software or AI bill of materials, and GET .../components pages its components with search and component_type. POST .../promote makes it the current bill for its vendor or service. POST .../archive archives it and refuses API keys.
Vendor documents
These endpoints extend the Documents API.POST /v1/vendors/{vendor_id}/documents/query filters, sorts and pages one vendor’s documents with the unified filter body (filter, sort, search, limit, offset, and an optional group). POST /v1/documents/query does the same across every vendor. POST /v1/documents/groups returns document counts by type or status.
POST /v1/documents/expirations/query lists every expiry and renewal date across your documents, soonest first, with one row per date. Filter with search, anchor_keys, document_type_slugs, anchor_date_start and anchor_date_end.
GET /v1/document-types lists the document types you can assign, including your custom types. GET /v1/contract-documents/unlinked lists contract documents not yet linked to a contract record.
To record a company named in a document as one of the vendor’s subprocessors, send POST /v1/documents/{document_id}/mark-subprocessor with company_name. This also clears the document’s company-name mismatch alerts. POST /v1/documents/{document_id}/autofill writes the vendor custom fields the document’s extracted details fill, and returns 400 when there are none. POST /v1/documents/{document_id}/alerts/{alert_type}/dismiss archives the document’s active alerts of one type.
POST /v1/documents/bulk-action takes action: "archive" with ids, action: "update_services" with ids and service_ids, or action: "update_services_granular" with items of id and service_ids. It returns updated_count. Archiving refuses API keys.
To open a password-protected document, send POST /v1/documents/{document_id}/unlock with password. The unlock runs in the background and the request returns 202; a document that is not locked returns 400.
To extract document insights, send POST /v1/documents/{document_id}/extract-insights, optionally with insight_config_ids. It returns 202 with the queued insight_extraction state. Poll GET /v1/documents/{document_id} until the state is no longer running. A request while an extraction is already running returns 409 with insight_extraction_running.
To classify a file before you upload it, send POST /v1/documents/infer-type with filename and text_content, and optionally allowed_document_slugs to narrow the answer. POST /v1/documents/infer-control-set takes the same body and returns the questionnaire control_set_id the file answers, or null when none matches.
To rerun inference of one field on a processed document, send POST /v1/documents/{document_id}/infer with field and optionally reanalyze: true to read the content again. It returns the document, and 400 while the document is still processing.
POST /v1/documents/{document_id}/recreate-assessment-report rebuilds a Word assessment report document from its template with the placeholder values you send in vendor_data, services_data, assessment_data, reviews_data, agent_data and intelligence_data. It replaces the stored file and returns the document.
To add many documents at once, upload a ZIP with one folder per vendor and send its org_document_id to POST /v1/documents/bulk-upload. Each folder name must match exactly one vendor and the ZIP may hold no loose files. The response says whether validation passed and lists the matched vendors or the errors; on success the documents are added in the background.
Know Your Supplier
These endpoints need Know Your Supplier turned on for your organization; otherwise they return404 not_enabled. Bank account numbers are always masked here.
GET /v1/supplier_countries lists the countries whose bank and tax details can be validated. GET /v1/supplier_countries/{country_code} returns that country’s bank, tax ID and address rules with your overrides applied, and GET /v1/supplier_countries/{country_code}/banks lists its known banks, which is empty for most countries. A country without rules returns 404 country_not_configured.
To check details before saving them, send POST /v1/supplier_validation/bank_account with bank_country, currency and values, or POST /v1/supplier_validation/tax_id with country_code, tax_id_type and value. Both return 200 with per-field results, even when the details fail.
GET /v1/vendors/{vendor_id}/supplier_profile returns the vendor’s bank accounts, sites, tax registrations, diversity records, legal entity assignments and pending bank changes in one response. PATCH the same path with legal_name_local to set the vendor’s legal name in its local script; an empty value clears it.
To record a diversity classification or certification, send POST /v1/vendors/{vendor_id}/diversity_records with category and its details. A record that fails validation returns 422 with per-field results.
POST /v1/update_requests/{request_id}/close withdraws an open update request or marks a returned one reviewed, and returns 409 update_request_closed when it is already closed. POST /v1/update_requests/{request_id}/apply_contacts writes the contact changes the supplier proposed onto the vendor; API keys are refused, so a signed-in user applies them.
GET /v1/supplier_settings returns your Know Your Supplier settings. PATCH /v1/supplier_settings replaces them with the whole object you send. API keys are refused on the PATCH, because these settings decide whether a bank change waits for a person’s review.
To add a legal entity that suppliers can be assigned to, send POST /v1/legal_entities with name and entity_code; a code already in use returns 409 duplicate_entity_code. PATCH /v1/legal_entities/{legal_entity_id} changes its name, code, country, description or active flag. POST /v1/legal_entities/{legal_entity_id}/archive archives it and keeps the assignments suppliers already hold; API keys are refused.
GET /v1/supplier_reviews lists the bank changes waiting for a reviewer, optionally for one vendor_id or with include_decided=true. A signed-in user rejects one with POST /v1/supplier_reviews/{review_id}/reject and a reason; API keys are refused. Approving a change, and revealing a full account number, happen only in the dashboard, because an approval redirects payments. POST /v1/legal_entity_assignments/{assignment_id}/reject rejects a requested legal entity assignment, and API keys are refused there too.
To import legal entities, send a CSV as multipart file to POST /v1/legal_entities/import. It needs name and entity_code columns and may carry country_code and description. Rows upsert on entity_code. dry_run defaults to true and reports created, updated, skipped and per-row rows without writing; send dry_run=false to write. A file with a missing column or a CSV that does not parse writes nothing and comes back in schema_errors. This needs org_settings:update:org, which API keys do not hold, so use a key created by a person whose role holds it.
Know your customer (KYC)
A vendor’s KYC record points at three field values: its TIN, business name and business address. Every response masks a TIN to its last four characters, including inside a verification’sinput_data.
GET /v1/vendors/{vendor_id}/kyc returns the record, or 404 kyc_record_not_found. GET, PATCH and DELETE /v1/vendor-kyc/{kyc_id} read, repoint and delete it, and POST /v1/vendor-kyc creates one from existing field ids. A vendor has one record; a second returns 400. Deleting refuses API keys.
POST /v1/vendor-kyc-fields records a value, and GET /v1/vendor-kyc-fields lists them with vendor_id, field_name and is_archived. PATCH /v1/vendor-kyc-fields/{field_id} changes one; archiving refuses API keys.
GET /v1/vendors/{vendor_id}/kyc-verifications lists the TIN, OFAC, PEP, watchlist and bank account checks. Add /history?verification_type=tin for every run of one type. GET /v1/kyc-verifications/{verification_id} returns one.
To rerun the checks from the current values, send POST /v1/vendors/{vendor_id}/kyc/rerun. It returns 202, or 400 kyc_incomplete without a TIN and business name. The TIN is never stored with the queued run, so if the run does not start, send the request again.
Portal bank accounts
GET /v1/vendors/{vendor_id}/portal-bank-accounts lists the bank accounts a vendor submitted through a portal, and GET /v1/portal-bank-accounts/{bank_account_id} returns one. You get metadata only: the account name, payment method, currencies and each detail’s type and label with its last four characters. A full account number, routing number, IBAN or Plaid token is never returned.
Discovery aliases
An alias tells vendor discovery which domain and products a discovered vendor name means.GET /v1/vendor-discovery/aliases lists your overrides. POST adds one with source, vendor_entity, domain and product_patterns, and returns 409 alias_exists for a duplicate. PATCH /v1/vendor-discovery/aliases/{alias_id} changes one, and an explicit null clears its domain. DELETE removes it and refuses API keys.
Vendor intelligence revisions, feedback and refresh
{surface} is security or financial. GET .../intelligence/{surface}/revision returns your organization’s current reading with revised and stored scores. To revise it from text, send POST .../revision/propose with text. That writes a proposal only. POST .../revision/{proposal_id}/preview with accepted_change_ids returns the scores the chosen changes would give. POST .../revision/{proposal_id}/apply accepts them as a new version and refuses API keys. GET .../versions lists versions, and POST .../versions/{version_number}/restore makes an earlier one current. POST /v1/vendors/{vendor_id}/intelligence/review queues the automated check against the vendor’s own site.
To tell Coverbase a tab describes the wrong company or facts, send POST /v1/vendors/{vendor_id}/intelligence-feedback with surface and note, and optionally website or legal_name. A corrected website or legal name rebuilds every surface. The note is stored on the shared company record.
POST /v1/vendors/{vendor_id}/intel-refresh with surfaces rebuilds them, skipping any built in the last six hours. Poll GET /v1/vendors/{vendor_id}/intel-refresh/{request_id} or GET /v1/vendors/{vendor_id}/intelligence-refresh-status.
Vendor outreach
GET /v1/assessments/{assessment_id}/vendor-outreach-request returns the outreach request waiting on an assessment. GET .../vendor-outreach-handoff says why a collection was handed to a person because outreach is off. POST .../vendor-outreach-handoff/send-once prepares the ask once without turning outreach on. Sending it contacts the vendor, and that stays a person’s decision through POST /v1/vendor-outreach-requests/{request_id}/decision.
Data flows
These endpoints need data flow monitoring, or they return404. GET /v1/vendors/{vendor_id}/data-flows returns 90 days of the vendor’s daily flows, the data its engagement declares, and open data-flow findings. GET and PUT /v1/data-flow/label-mapping read and replace the label-to-data-class mapping. PUT /v1/engagements/{engagement_id}/data-scope declares the data classes an engagement may send. GET /v1/data-flow/unmatched-apps lists apps no vendor claims, and PUT /v1/data-flow/app-link ties one to a vendor. Every change checks the flows again.
Service risk profiles and data classes
These endpoints need the engagement record feature, or they return404 not_enabled. GET and PUT /v1/services/{service_id}/risk-profile read and set a service’s data classes, access level, criticality, regulatory scopes and AI flag. GET /v1/vendors/{vendor_id}/service-risk-attributes combines them across a vendor’s services. GET /v1/data-classes lists your data classes, POST adds or renames them by code, and PATCH /v1/data-classes/{data_class_id} changes one. POST /v1/service-risk-profiles/tag-mapping/preview shows what mapping tags to attributes would change, and .../apply backfills it. The data class writes and tag mapping need org_settings:update:org, which API keys do not hold, so use a key created by a person whose role holds it.
More vendor and service reads
POST /v1/nth-parties/filter filters nth parties by name or dependent vendor, and PATCH /v1/nth-parties/{entity_id} replaces an nth party’s tags. GET /v1/bills-of-materials/latest and GET /v1/bills-of-materials take exactly one of vendor_id and service_id. GET /v1/bills-of-materials/components?vendor_id= searches components across a vendor’s bills. GET /v1/ai-inventory groups every AI model, provider or dataset on your applied AI bills by group_by.
POST /v1/vendors/query and POST /v1/services/query take the unified filter body. POST /v1/vendors/filter and POST /v1/services/filter take the structured filters. GET /v1/vendor-status-counts counts live vendors by status, POST /v1/vendors/name-summaries names vendors by id, and GET /v1/subprocessor-proposals pages pending proposals across vendors. GET /v1/services lists services, and GET /v1/services/{service_id} returns one.
GET /v1/entities searches the company directory, POST /v1/entities/query takes long id lists in the body, GET /v1/entities/{entity_id} returns a company, and .../product-lines lists its product lines.
GET /v1/portfolio-risk returns risk over time across the portfolio, one series per vendor whose risk changed, filtered by vendor_id, tag_id, risk_type, source, since and until. POST /v1/assessments/{assessment_id}/scores/compute recomputes an assessment’s scores.
GET /v1/vendor-certificate-summary, GET /v1/vendors/{vendor_id}/risk-ratings, GET /v1/vendors/{vendor_id}/company-registration, GET /v1/vendors/{vendor_id}/financial-health and GET /v1/vendors/{vendor_id}/status-page-components return what the vendor page shows. GET /v1/dnb-integration/entitlements lists your Dun & Bradstreet entitlements.
Change many services at once
POST /v1/services/bulk-action applies one change to up to 100 service_ids. action is tag (up to 15 tag_ids, operation add or remove), assign-relationship-owner or assign-watcher (user_id), update-status (status_id), set-next-assessment-date (next_assessment_date) or archive. Nothing is written when a service, user, status or tag does not exist; that returns 400 invalid_bulk_action. Every action needs service:update:org. Assigning an owner also needs service:assign:org, and archiving needs service:archive:org and refuses API keys.
Exports and imports
Exports run in the background.POST /v1/vendors/{vendor_id}/exports/pdf and /exports/xlsx, and the same under /v1/services/{service_id}, return an odoc_id. POST /v1/vendors/exports?file_name= starts the workbook of every vendor, optionally narrowed by a filter body, and POST /v1/services/exports does the same for services. POST /v1/vendors/portfolio-exports and /v1/services/portfolio-exports start the portfolio PDF. Poll GET /v1/vendor-exports/{export_id}. Once status is complete, it carries a presigned download_url valid for expires_in seconds, and it is sent with Cache-Control: no-store.
To import vendors, services and locations, send the dashboard’s vendor workbook as multipart file with timezone to POST /v1/vendors/imports. dry_run defaults to true. Poll GET /v1/spreadsheet-import-jobs/{job_id} for the result.
GET /v1/vendor-info-web-search?vendor_name= researches a company on the web before you add it.
Do Not Use, record drift and settings
GET and PUT /v1/vendors/{vendor_id}/do-not-use read and set whether a vendor is on the Do Not Use list. A change needs a reason. GET /v1/record-drift lists vendors whose outside records changed, and POST /v1/record-drift/{drift_id}/decide accepts, updates or dismisses each change. Deciding refuses API keys. POST /v1/prequalification-evaluations/{evaluation_id}/override overrides a failed prequalification with a rationale and refuses API keys.
GET /v1/document-type-groups lists document type groups, and POST /v1/document-type-groups/enable turns optional ones on. The passive assessment routes read and edit the fields Coverbase fills in from public sources: /v1/passive-assessment-configs, /v1/passive-assessment-groups, GET /v1/vendors/{vendor_id}/passive-assessment and POST /v1/passive-assessment-data. The settings writes need org_settings:update:org, which API keys do not hold.
PUT /v1/screening/settings changes the screening policy, GET /v1/screening-profile-groups lists the provider’s profile groups, and GET /v1/screening/evidence-export returns a CSV of every screened vendor’s first and last screen.
Submitted financial statements
GET /v1/vendors/{vendor_id}/financial-statements returns the documents the vendor’s financial analysis reads and the analysis, or null. POST the same path with up to five document_ids sets them and analyzes them unless analyze is false. POST .../analyze runs it again. DELETE .../documents/{document_id} stops reading one document. DELETE .../financial-statements withdraws the submission and refuses API keys. GET .../export returns the analysis workbook with Cache-Control: no-store, or 404 before an analysis exists.