Assessments

These endpoints manage assessments — your organization’s review records — plus their evidence documents and audit log. All routes take an account-id and a vendor-list-id. Reads require viewer; writes require member or above. Base path prefix: /vendor-assessments.

Get assessments

Returns all saved assessments for the list. Add vendor-id, vendor-profile-id, or assessment-id to narrow the result.

Create or update an assessment

Upserts an assessment. Identify the vendor via query or body (vendor_id, vendor_profile_id, or vendor_name).

{
  "vendor_name": "1Password",
  "compliance_approval_status": "approved",
  "sponsor_business_department": "Cybersecurity",
  "sponsor_contact": "sponsor@yourco.com",
  "use_case": "Manage employee passwords",
  "data_collected": ["name", "phone"],
  "compliance_comment": "Reviewed SOC 2; approved."
}

Valid compliance_approval_status values: not-started, in-progress, on-hold, approved, conditional approval, rejected. For conditional approvals, include conditional_approval_condition.

Delete an assessment

Deletes an assessment. assessment-id is preferred; vendor-id / vendor-profile-id are also supported.

Evidence documents

Lists documents attached to an assessment.

Returns a presigned upload URL (member+). Upload the file directly, then it’s attached to the assessment.

Returns a presigned download URL for a document.

Removes a document.

Audit log

Returns the approval audit for an assessment.

The response groups related field changes from a single save into one event (event_id, created_at, submitted_by, changes), giving you a clean, event-level history. A flattened logs list is also returned for compatibility.

Overview

Endpoints

Reference

Get assessments

Create or update an assessment

Delete an assessment

Evidence documents

Audit log

​Get assessments

​Create or update an assessment

​Delete an assessment

​Evidence documents

​Audit log

Get assessments

Create or update an assessment

Delete an assessment

Evidence documents

Audit log