Quickstart

1. Mint a key

In the app, open Settings → API keys (app.vendorica.com/settings/api-keys) and create one. The key is shown once, at creation — Vendorica stores only a bcrypt hash, so a lost key is replaced rather than recovered.

A key is the literal prefix vnd_live_ followed by 32 random characters. There is no endpoint that mints one: key management lives behind a signed-in session on purpose. Full detail, including rotation, is on Getting an API key.

Caution

A key carries the permissions of whoever issued it, so it can do anything that person can do through the UI, without a second factor. Store it the way you store a database password: a secret manager, never a repository, never a browser.

2. Choose scopes

You pick the key’s scopes at issue time. Grant the narrowest set the integration needs — a SIEM export that only reads the audit log should hold audit:read and nothing else. A key cannot be given a scope its issuer does not already have.

3. Call something

curl https://api.vendorica.com/v1/vendors \
  -H "Authorization: Bearer $VENDORICA_API_KEY"

{
  "success": true,
  "data": [
    {
      "id": "8f2a...",
      "organizationId": "3c91...",
      "name": "Acme Cloud Services",
      "status": "active",
      "createdAt": "2026-03-04T08:12:44.000Z",
      "updatedAt": "2026-08-01T15:03:20.000Z"
    }
  ],
  "pagination": { "page": 1, "limit": 25, "total": 118, "totalPages": 5 },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J..."
}

4. Read the response headers

Every response carries your remaining budget:

RateLimit-Limit: 300
RateLimit-Remaining: 297
RateLimit-Reset: 42

Pace against RateLimit-Remaining rather than waiting for a 429. See rate limits.

Where to go next

AuthenticationScopes, rotation, and the 401 that is really a 404.

PaginationPages for registers, cursors for feeds — and when to use which.

ErrorsThe error envelope and the codes worth handling by name.

Uploading documentsStreaming, checksums, and resuming an interrupted migration.