List vendors

GET

/vendors

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Get,
    RequestUri = new Uri("https://api.vendorica.com/v1/vendors?page=1&limit=100&sortOrder=asc&state=procurement&directlyEngaged=true&hasSecurityOwner=true&hasBusinessOwner=true&riskScored=true"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "net/http"
  "io"
)

func main() {

  url := "https://api.vendorica.com/v1/vendors?page=1&limit=100&sortOrder=asc&state=procurement&directlyEngaged=true&hasSecurityOwner=true&hasBusinessOwner=true&riskScored=true"

  req, _ := http.NewRequest("GET", url, nil)

  req.Header.Add("Authorization", "Bearer <token>")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://api.vendorica.com/v1/vendors?page=1&limit=100&sortOrder=asc&state=procurement&directlyEngaged=true&hasSecurityOwner=true&hasBusinessOwner=true&riskScored=true")
  .get()
  .addHeader("Authorization", "Bearer <token>")
  .build();

Response response = client.newCall(request).execute();

const url = 'https://api.vendorica.com/v1/vendors?page=1&limit=100&sortOrder=asc&state=procurement&directlyEngaged=true&hasSecurityOwner=true&hasBusinessOwner=true&riskScored=true';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://api.vendorica.com/v1/vendors";

    let querystring = [
        ("page", "1"),
        ("limit", "100"),
        ("sortOrder", "asc"),
        ("state", "procurement"),
        ("directlyEngaged", "true"),
        ("hasSecurityOwner", "true"),
        ("hasBusinessOwner", "true"),
        ("riskScored", "true"),
    ];

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.get(url)
        .query(&querystring)
        .headers(headers)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request GET \
  --url 'https://api.vendorica.com/v1/vendors?page=1&limit=100&sortOrder=asc&state=procurement&directlyEngaged=true&hasSecurityOwner=true&hasBusinessOwner=true&riskScored=true' \
  --header 'Authorization: Bearer <token>'

Vendors your organization is directly engaged with. FOURTH PARTIES ARE EXCLUDED BY DEFAULT — vendors minted by the subprocessor register appear only when directlyEngaged is sent explicitly (false for fourth parties alone, true for directly-engaged alone), so an integration that omits it is reading a subset and nothing says so. Filter with search (name contains), country, state and criticalityTierId; the older name parameter is deprecated in favour of search.

Authorizations

bearerAuth
vendors:read

Parameters

Query Parameters

page

integer

default: 1 >= 1 <= 10000

limit

integer

default: 100 >= 1 <= 500

sortBy

string

sortOrder

string

default: desc

Allowed values: asc desc

search

string

>= 1 characters <= 255 characters

name

string

country

string

criticalityTierId

string format: uuid

state

string

Allowed values: procurement active archived

directlyEngaged

string | null

Allowed values: true false all

categoryId

string format: uuid

securityOwnerId

string format: uuid

businessOwnerId

string format: uuid

hasSecurityOwner

string | null

Allowed values: true false all

hasBusinessOwner

string | null

Allowed values: true false all

riskBand

Array<string> | null

<= 100 items

riskScored

string | null

Allowed values: true false all

riskApproval

Array<string> | null

<= 100 items

Allowed values: not_required pending approved

businessUnitId

string format: uuid

createdFrom

string

createdTo

string

createdAfter

string

createdBefore

string

Responses

200

Success

application/json

object

success

required

boolean

data

required

Array<object>

object

required

string format: uuid

organizationId

required

string format: uuid

displayId

required

string | null

name

required

string

state

required

string | null

Allowed values: procurement active archived

directlyEngaged

required

boolean

vatNumber

required

string | null

countryCode

required

string | null

description

required

string | null

website

required

string | null

category

required

string | null

categoryId

required

string | null format: uuid

headquartersCountryCode

required

string | null

authMethod

required

string | null

Allowed values: sso_oidc sso_saml password api_key not_specified

servicesProvided

required

string | null

securityOwnerId

required

string | null format: uuid

businessOwnerId

required

string | null format: uuid

notes

required

string | null

lastAssessedAt

required

string | null format: date-time

criticalityTierId

required

string | null format: uuid

lei

required

string | null

euId

required

string | null

legalPersonType

required

string | null

Allowed values: legal_person natural_person

countryOfRegistration

required

string | null

parentLei

required

string | null

parentName

required

string | null

headOfficeAddress

required

string | null

inherentRiskScore

required

string | null

inherentRiskBand

required

string | null

inherentRiskScoredAt

required

string | null format: date-time

inherentRiskApprovalStatus

required

string

inherentRiskBandOverride

required

string | null

inherentRiskSignedOffAt

required

string | null format: date-time

inherentRiskSignedOffBy

required

string | null format: uuid

inherentRiskAnswersFingerprint

required

string | null

annualExpense

required

string | null

approvalStatus

required

string

approvalInstanceId

required

string | null format: uuid

businessUnitIds

required

Array<string>

createdAt

required

string | null format: date-time

updatedAt

required

string | null format: date-time

timestamp

required

string format: date-time

requestId

string

message

string

pagination

object

page

required

integer

limit

required

integer

total

required

integer

totalPages

required

integer

Example

{
  "success": true,
  "data": [
    {
      "id": "8d186188-a761-4c3e-8b8f-c407465190b9",
      "organizationId": "aa09c50d-bc61-469d-8b08-faba7d22b91a",
      "displayId": "string",
      "name": "string",
      "state": "procurement",
      "directlyEngaged": true,
      "vatNumber": "string",
      "countryCode": "string",
      "description": "string",
      "website": "string",
      "category": "string",
      "categoryId": "5c819b00-a207-4426-860b-863f4f244ee1",
      "headquartersCountryCode": "string",
      "authMethod": "sso_oidc",
      "servicesProvided": "string",
      "securityOwnerId": "4da8ab9b-d986-41db-8627-47087bd4d7e4",
      "businessOwnerId": "7dc40657-5095-47cf-8815-1624b931d460",
      "notes": "string",
      "lastAssessedAt": "2026-08-19T09:41:12.004Z",
      "criticalityTierId": "4b1671d5-0b55-4575-8d23-28c234592fb2",
      "lei": "string",
      "euId": "string",
      "legalPersonType": "legal_person",
      "countryOfRegistration": "string",
      "parentLei": "string",
      "parentName": "string",
      "headOfficeAddress": "string",
      "inherentRiskScore": "string",
      "inherentRiskBand": "string",
      "inherentRiskScoredAt": "2026-08-19T09:41:12.004Z",
      "inherentRiskApprovalStatus": "string",
      "inherentRiskBandOverride": "string",
      "inherentRiskSignedOffAt": "2026-08-19T09:41:12.004Z",
      "inherentRiskSignedOffBy": "752c3e27-99a5-443f-8c0d-1a7498a09e50",
      "inherentRiskAnswersFingerprint": "string",
      "annualExpense": "string",
      "approvalStatus": "string",
      "approvalInstanceId": "9038eea0-ab9f-4906-8157-12df8712aec1",
      "businessUnitIds": [
        "c66d6881-e13b-4639-8ab4-4d4e63d5ab7e"
      ],
      "createdAt": "2026-08-19T09:41:12.004Z",
      "updatedAt": "2026-08-19T09:41:12.004Z"
    }
  ],
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string",
  "pagination": {
    "page": 1,
    "limit": 1,
    "total": 1,
    "totalPages": 1
  }
}

400

Validation error

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Unauthorized

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Forbidden — missing scope

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Not found

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Rate limit exceeded

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}