For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
The walkthroughs below trace three full lifecycle workflows. Each is built from the same no-code triggers, conditions and actions any admin composes in the Workflows section of the dashboard, so treat them as worked examples to copy and edit rather than as fixed templates. Event names are real catalog values. For the authoritative, case-sensitive list of subscribable events and the exact API request/response schemas, always defer to the event catalog and the API reference.
Workflow A: Vendor onboarding
A new third-party request enters Coverbase from procurement, gets risk-classified, drives the appropriate assessment depth, and produces a decision artifact that flows back to procurement and contract management.1
Procurement creates the vendor
Source system: Ariba, or any procurement intake.Trigger fired:
Vendor.Created.2
Workflow runs IRQ classification
The workflow inspects
Data Types, Requested Use, and Business Unit. Conditions branch:- If
customer_piiis present and the vendor has SaaS hosting, route to the full security and privacy assessment path. - If the engagement is a commodity, with no data access and no system integration, route to a lightweight financial and compliance check and skip directly to procurement approval.
3
Assessment created and questionnaire dispatched
Action: create assessment, send a portal with the questionnaire to the vendor contact.Webhook fired:
Assessment.Created, carrying the assessment_id. Your GRC tool receives the webhook and creates a corresponding tracking record.4
Vendor responds
Vendor uploads SOC 2 and completes the questionnaire through the vendor portal.Webhook fired:
QuestionnaireResponse.Updated as the response moves through its statuses, and VendorDocument.Created for each uploaded document.5
Copilot processes evidence
Copilot runs as part of the assessment, not as a separate workflow action. It extracts control evidence from the SOC 2 and reconciles it against questionnaire responses. Evaluations are produced for each control.Webhook fired:
Assessment.Updated, with the status change in field_diffs, as the assessment moves toward completion.6
Findings are flagged for review
Action: issues found in the evaluations are raised as findings. For findings above a configured severity, a workflow on
Finding.Created creates a work queue item for the internal risk owner.Webhook fired: Finding.Created, one per finding. Your Jira instance receives webhooks and creates tickets, or the workflow’s Create jira ticket action creates them directly.7
Domain reviews are issued in parallel
Action: create one review per implicated risk domain, each scoped to that domain and routed to its standing reviewers, individually or as a user group. InfoSec, Financial Crime, Legal, Privacy and Finance receive their own work queue item and see the slice of the evidence they own.Each review carries its own assignee, status, notes and outcome, and they complete in whatever order the SMEs complete them. One domain returning its scope for rework does not reopen another domain’s decision.Webhook fired:
WorkQueueItem.Created, one per domain review, so your ITSM or GRC platform can mirror the queue.8
The gate resolves
Condition: a work-queue-item-complete condition scoped to the workflow run, with
require all set, holds the next step until every domain review is decided. Set require all off for a first-past-the-post gate, and raise a different set of reviews per tier to express a quorum.Each reviewer selects an outcome from your organization’s own list: Approve, Approve with finding, Approve with policy exception, Reject, or Return for rework. The selected outcome is a branch point: an assessment-recommendation condition routes a policy exception down a different path from a clean approval, raising the exception record and scheduling an earlier reassessment.Webhook fired: Review.Updated and WorkQueueItem.Completed per decision, then Assessment.Updated and Vendor.Updated, each with the status change in field_diffs, once the gate clears. The Ariba integration receives Vendor.Updated and unblocks the procurement record. Contract management receives the same event and starts contract drafting with risk context attached.9
Or the work goes back
Where a reviewer selects Return for rework, the round is returned with a revision message rather than closed. The round number increments, the previous round is preserved rather than overwritten, and the item reappears as outstanding work for whoever owes it: the vendor in their portal, or the requester in intake.Every loop is countable. Rounds are rows, so “how many cycles did this assessment take”, “which control areas generate the most rework” and “how long did each side hold each round” are queries rather than reconstructions. See Reviews, approvals and gates.
10
Contract Guardian runs on the agreement
When the draft MSA is uploaded, either via UI, API, or pulled from your CLM through a separate integration, Contract Guardian runs automatically. Missing clauses, liability deviations, and AI usage provisions are surfaced.Webhook fired:
Contract.Created when the agreement lands, and Contract.Updated as its fields change. There is no separate event for the clause review finishing, so your receiving handler routes the new contract to the legal team.Workflow B: Ongoing monitoring and reassessment
After a vendor is active, Coverbase runs continuous monitoring and triggers reassessment work when conditions warrant.Continuous monitoring with Supplier Radar
Supplier Radar ingests external signals such as breaches, sanctions, regulatory actions, and threat intelligence, and produces events scoped to specific vendors. When an event lands above a configured severity threshold:- Trigger fired:
RadarSignal.Created, withRadarDetectorResult.Createdfor each alert a detector raises. - Conditions branch on the signal’s fields and the vendor’s tier.
- For high-severity events on tier 1 vendors, action: create a targeted incident assessment, create a work queue item for the risk owner, and send a webhook to your paging tool.
Scheduled reassessment
Reassessment rules set each vendor’s next assessment date from its risk level, for example quarterly for the highest level and annually below it. There is no recurring workflow trigger, so when an external GRC tool owns the cadence, it starts the assessment itself:Contract renewal trigger
There is no renewal-window trigger. Notice and renewal dates are tracked as contract dates and reminders, andContract.Expired fires when a contract’s term runs out.
Trigger fired: Contract.Expired. The workflow optionally launches a reassessment and sends a webhook to your CLM with current risk context.
Workflow C: Vendor offboarding
When a relationship ends, Coverbase coordinates the offboarding sequence.1
External system signals offboarding
Vendor.Updated, with the status change in field_diffs.2
Termination assessment
Action: create a termination assessment focused on data return, access revocation, and exit obligations from the contract. Action: send a portal with a structured offboarding questionnaire covering data destruction certification, access termination confirmation, and return of materials.Webhook fired:
Assessment.Created.3
Internal access cleanup
Action: Send webhook to your IAM tool’s endpoint. It receives the event and revokes vendor user accounts, API keys, and SSO entitlements.
4
Document archival
Documents stay on the vendor record after offboarding. If your records policy needs a copy in long-term storage, your webhook handler pulls them through the Documents API.
5
Final closure
When all offboarding tasks complete, an Update vendor status action moves the vendor to your offboarded status.Webhook fired:
Vendor.Updated. Procurement and finance systems receive the event and close their respective records.These scenarios use the generic surfaces. For the named platforms Coverbase integrates with natively (ProcessUnity, ServiceNow VRM, OneTrust, Workday Strategic Sourcing, Aravo), see the platform-specific guides, which show how each one composes these same flows.