Skip to main content
Vendor lists hold the vendors your organization tracks. The default list is master-list. These endpoints create lists, snapshot their vendors, import from CSV, manage product rows, and toggle per-vendor alerts.
All routes take an account-id query parameter — your organization UUID, or the literal individual for personal lists. Reads require viewer; writes require member or above.

​
List or read

​
GET /vendor-lists?account-id={uuid}
Returns all lists for the organization, or one list’s vendors when vendor-list is supplied.

​
Create a list

​
POST /vendor-lists?account-id={uuid}&vendor-list={name}
Creates a new list with the given name.

​
Snapshot vendors on a list

​
POST /vendor-lists?account-id={uuid}&operation=save-vendors
Replaces the list’s vendor membership with the supplied set.
{
  "vendors": [
    "1Password",
    { "vendor_name": "Paper", "website_url": "https://paper.design" }
  ]
}
Vendors may be plain name strings or objects with a website_url. Vendors omitted from the payload are removed from the list. Newly added custom vendors are queued for enrichment; the response includes an org_enrichment summary (queued counts, quota usage, and any errors).
Each organization can enrich up to 500 distinct custom vendors.

​
Import from CSV

​
POST /vendor-lists?account-id={uuid}&operation=import-csv&vendor-list-id={listId}
Merges vendors and assessment fields from a CSV.
{
  "csv": "vendor_name,website_url,product_name\n1Password,https://1password.com,",
  "dry_run": true,
  "row_offset": 0,
  "row_limit": 5
}
  • Set dry_run: true to validate only — the response lists custom_vendors (names with no existing profile) so you can preflight.
  • Files are capped at 1 MB and 500 rows. Because of the 30-second gateway timeout, send rows in batches using row_offset / row_limit, and follow has_more / next_row_offset in the response.

​
Add a product to a vendor

​
POST /vendor-lists/{vendor_list_id}/vendors/{vendor_id}/products?account-id={uuid}
Adds a product row for a vendor already on the list. Body: { "product_name": "..." }. Returns 409 if that product already exists.

​
Toggle alerts

​
PATCH /vendor-lists?account-id={uuid}&operation=alerts-enabled&vendor-list={listId}
Body { "vendor-id": "<uuid>", "alerts_enabled": true }. Controls whether the vendor’s incidents generate notifications.

​
Delete a list

​
DELETE /vendor-lists?account-id={uuid}
Deletes the list by id.