Information
- OpenAPI version:
3.1.0
Overview
Vendorica Public API 1.0.0
Section titled “Vendorica Public API 1.0.0”The Vendorica public API reads the registers your organization keeps in the platform — vendors, contracts, controls, evidence, risks, policies, incidents and the audit log — and files documents and records into them without anyone opening a browser.
Every call
- Base URL —
https://api.vendorica.com/v1. The version is in the path. - Authentication — a bearer API key, issued from Settings → API keys in the app and scoped to one organization. Every operation below states the scope it requires.
- Responses — every JSON body is the same envelope, so a client parses one
shape:
{ success, data, timestamp, requestId }. Errors replacedatawitherrorand a stablecode; branch oncode, never on the message. - Pagination — collections are page-numbered (
page,limit); the append-only ones — the audit log, evidence, incidents, webhook deliveries — are cursor-paginated, because a page number over a growing list skips rows. - Rate limits — every response carries its remaining budget in
RateLimit-Remaining. Pace against that header rather than waiting for a 429.
What changes, and what does not
Within /v1 the API is additive only: new fields, new optional parameters
and new endpoints can appear at any time, and a client must ignore fields it
does not recognise. A breaking change cuts /v2.
A request to a /v1 path that does not exist returns 401, not 404 — key
authentication runs before routing, so a mistyped path is rejected as an
invalid key. If a call returns 401 and the key is good, check the path.
Guides, authentication, pagination, rate limits and the error-code table: https://developer.vendorica.com.
Authentication
Section titled “Authentication”bearerAuth
Section titled “bearerAuth”API key issued from Settings → API clients.
Security scheme type: http
Bearer format: vnd_live_<base62>