Vendorica for developers

Vendorica’s public API lets your own systems read the registers you keep in the platform — vendors, contracts, risks, evidence, the audit log — and file documents into them without anyone opening a browser.

QuickstartMint a key and make your first call in about five minutes.

API referenceEvery endpoint, generated from the running service — never written by hand.

AuthenticationAPI keys, scopes, and what a key can never do.

Uploading documentsStream evidence and agreements in — the migration path.

The shape of it

Base URL — https://api.vendorica.com/v1

Authentication — a bearer API key, issued from Settings → API keys in the app. Keys are organization-scoped and carry explicit scopes. See Getting an API key.

Responses — every JSON response is wrapped in the same envelope, so a client parses one shape:

{
  "success": true,
  "data": { },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J..."
}

Versioning — the version is in the path. Within /v1 the API is additive only: new fields, new optional parameters and new endpoints can appear at any time, and a client must ignore fields it does not recognise. A breaking change cuts /v2.

What the API covers today

The public surface is deliberately narrower than the application. It is mostly reads, plus a handful of write paths:

Area	Read	Write
Vendors	list, get	bulk import
Contracts	list, get, documents, download	upload a document
Controls	list, get, mappings	—
Evidence	list (cursor), get, download	upload to a control
Risk registers	list, get	—
Risk scenarios	list, get	create, update
Incidents	list, get	file an incident
Policies	list, get, versions	—
Compliance	posture, framework by code	—
Trust Center	resources, access requests, subscribers, visitor tokens, access log	approve or reject an access request
Audit log	list (cursor)	—
Outbound webhooks	list, get, triggers, deliveries	create, update, delete

If you need something that is not here, say so — the surface grows by customers asking for the specific thing they are automating, not by speculatively exposing the whole application.

Note

A request to a /v1 path that does not exist returns 401, not 404. Key authentication runs before routing, so a typo in a path is rejected as “Invalid API key”. If a call returns 401 and you are confident the key is good, check the path in the API reference before you go looking at credentials.

The machine-readable contract

The OpenAPI 3.1 document is generated from the running service’s route definitions, not maintained by hand, and a CI check fails the build if it drifts from what is mounted. The API reference in these docs is built from that same file — so if the reference says a field exists, the service returns it.