> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vendexlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vendor lists

> Manage the vendors your organization tracks, including CSV import.

Vendor lists hold the vendors your organization tracks. The default list is `master-list`. These endpoints create lists, snapshot their vendors, import from CSV, manage product rows, and toggle per-vendor alerts.

<Info>
  All routes take an `account-id` query parameter — your organization UUID, or the literal `individual` for personal lists. Reads require **viewer**; writes require **member** or above.
</Info>

## List or read

<ParamField path="GET /vendor-lists?account-id={uuid}">
  Returns all lists for the organization, or one list's vendors when `vendor-list` is supplied.
</ParamField>

## Create a list

<ParamField path="POST /vendor-lists?account-id={uuid}&vendor-list={name}">
  Creates a new list with the given name.
</ParamField>

## Snapshot vendors on a list

<ParamField path="POST /vendor-lists?account-id={uuid}&operation=save-vendors">
  Replaces the list's vendor membership with the supplied set.
</ParamField>

```json theme={null}
{
  "vendors": [
    "1Password",
    { "vendor_name": "Paper", "website_url": "https://paper.design" }
  ]
}
```

Vendors may be plain name strings or objects with a `website_url`. **Vendors omitted from the payload are removed from the list.** Newly added custom vendors are queued for enrichment; the response includes an `org_enrichment` summary (queued counts, quota usage, and any errors).

<Note>
  Each organization can enrich up to **500** distinct custom vendors.
</Note>

## Import from CSV

<ParamField path="POST /vendor-lists?account-id={uuid}&operation=import-csv&vendor-list-id={listId}">
  Merges vendors and assessment fields from a CSV.
</ParamField>

```json theme={null}
{
  "csv": "vendor_name,website_url,product_name\n1Password,https://1password.com,",
  "dry_run": true,
  "row_offset": 0,
  "row_limit": 5
}
```

* Set `dry_run: true` to validate only — the response lists `custom_vendors` (names with no existing profile) so you can preflight.
* Files are capped at **1 MB** and **500 rows**. Because of the 30-second gateway timeout, send rows in batches using `row_offset` / `row_limit`, and follow `has_more` / `next_row_offset` in the response.

## Add a product to a vendor

<ParamField path="POST /vendor-lists/{vendor_list_id}/vendors/{vendor_id}/products?account-id={uuid}">
  Adds a product row for a vendor already on the list. Body: `{ "product_name": "..." }`. Returns `409` if that product already exists.
</ParamField>

## Toggle alerts

<ParamField path="PATCH /vendor-lists?account-id={uuid}&operation=alerts-enabled&vendor-list={listId}">
  Body `{ "vendor-id": "<uuid>", "alerts_enabled": true }`. Controls whether the vendor's incidents generate notifications.
</ParamField>

## Delete a list

<ParamField path="DELETE /vendor-lists?account-id={uuid}">
  Deletes the list by id.
</ParamField>