# Get one supplier

Requires the `supplier:read` scope.

`GET /suppliers/{supplierId}`

Scope `supplier:read`

Requires the `supplier:read` scope.

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `supplierId` | string | yes |  |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `assessmentStatus`: string Assessment status.
- `businessOwnerId`: optional string Business owner employee id (empl_).
- `createdAt`: string (date-time) Creation time (UTC).
- `criticality`: string Criticality.
- `dependencyType`: optional string Dependency type, when set.
- `displayName`: string Display name of the supplier.
- `hasCardData`: boolean Processes card data.
- `hasPhi`: boolean Processes health data.
- `hasPii`: boolean Processes personal data.
- `id`: string Supplier id (sup_).
- `lastAssessmentAt`: optional string (date-time) or null Last assessment time (UTC).
- `legalName`: string Legal name of the supplier (an organisation).
- `networkAccessLevel`: optional string Network access level, when set.
- `nextAssessmentDueAt`: optional string (date-time) or null Next assessment due (UTC).
- `openFindingCount`: integer Open findings.
- `openRiskCount`: integer Open risks.
- `privilegedAccess`: boolean Has privileged access.
- `securityOwnerId`: optional string Security owner employee id (empl_).
- `serviceCategory`: string Service category.
- `status`: string Lifecycle status.
- `supplierOwnerId`: optional string Supplier owner employee id (empl_).
- `supportsCrownJewel`: boolean Supports a crown-jewel asset.
- `updatedAt`: string (date-time) Last update time (UTC).
- No other fields.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | - | no | The request is invalid. |
| 401 | - | no | The token is missing, malformed, expired or revoked. |
| 402 | - | no | The organisation's plan does not include the feature this route needs. |
| 403 | - | no | The token may not use this route. |
| 404 | - | no | The resource does not exist in this organisation. |
| 429 | - | yes | Rate limit or row budget exceeded; retry after the time in Retry-After. |
| 500 | - | no | Unexpected server error. |
| 503 | - | yes | A dependency is temporarily unavailable; retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/suppliers/<supplierId>" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/suppliers/<supplierId>",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/suppliers/<supplierId>", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": {
    "assessmentStatus": "completed",
    "businessOwnerId": "empl_1hgyq2b7z5tc",
    "createdAt": "2026-02-12T09:00:00Z",
    "criticality": "CRITICAL",
    "dependencyType": "single",
    "displayName": "Example Cloud",
    "hasCardData": false,
    "hasPhi": false,
    "hasPii": true,
    "id": "sup_1hd8c2x7q0wn",
    "lastAssessmentAt": "2026-05-20T10:00:00Z",
    "legalName": "Example Cloud Services Ltd.",
    "networkAccessLevel": "privileged",
    "nextAssessmentDueAt": "2027-05-20T00:00:00Z",
    "openFindingCount": 3,
    "openRiskCount": 2,
    "privilegedAccess": true,
    "securityOwnerId": "empl_1hgyun41rx48",
    "serviceCategory": "Cloud Provider",
    "status": "active",
    "supplierOwnerId": "empl_1hgyun41rx48",
    "supportsCrownJewel": true,
    "updatedAt": "2026-10-01T12:00:00Z"
  },
  "error": null
}
```