docs

List suppliers

GET /suppliers

Scope supplier:read

Requires the supplier:read scope.

Example

curl "https://api.autociso.io/api/v1/suppliers" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": [
    {
      "assessmentStatus": "completed",
      "businessOwnerId": "empl_1hgyq2b7z5tc",
      "createdAt": "2026-02-12T09:00:00Z",
      "criticality": "CRITICAL",
      "dependencyType": "single",
      "displayName": "Example Cloud",
      "hasCardData": false,
      "hasPhi": false,
      "hasPii": true,
      "id": "sup_1hd8c2x7q0wn",
      "lastAssessmentAt": "2026-05-20T10:00:00Z",
      "legalName": "Example Cloud Services Ltd.",
      "networkAccessLevel": "privileged",
      "nextAssessmentDueAt": "2027-05-20T00:00:00Z",
      "openFindingCount": 3,
      "openRiskCount": 2,
      "privilegedAccess": true,
      "securityOwnerId": "empl_1hgyun41rx48",
      "serviceCategory": "Cloud Provider",
      "status": "active",
      "supplierOwnerId": "empl_1hgyun41rx48",
      "supportsCrownJewel": true,
      "updatedAt": "2026-10-01T12:00:00Z"
    },
    {
      "assessmentStatus": "not_started",
      "createdAt": "2026-10-07T13:00:00Z",
      "criticality": "MEDIUM",
      "displayName": "Example Payroll",
      "hasCardData": false,
      "hasPhi": false,
      "hasPii": true,
      "id": "sup_1hd8c4m1r9ty",
      "legalName": "Example Payroll GmbH",
      "networkAccessLevel": "none",
      "openFindingCount": 0,
      "openRiskCount": 0,
      "privilegedAccess": false,
      "serviceCategory": "Payroll",
      "status": "onboarding",
      "supportsCrownJewel": false,
      "updatedAt": "2026-10-07T13:00:00Z"
    }
  ],
  "error": null,
  "meta": {
    "limit": 25,
    "offset": 0,
    "total": 24
  }
}

Query parameters

  • limit integer
    Page size. minimum 1, maximum 100, default 25
  • offset integer
    Rows to skip (offset mode). Cannot be combined with cursor. minimum 0, maximum 10000, default 0
  • cursor string
    An opaque cursor taken from meta.nextCursor of the previous page (cursor mode). Valid for 24 hours and bound to the token and the query; do not parse or construct it.
  • sort[id] string
    Sort direction for id.
    "asc" | "desc"
  • sort[updatedAt] string
    Sort direction for updatedAt.
    "asc" | "desc"
  • filter[assessmentStatus][eq] string
    Filter assessmentStatus (eq).
  • filter[assessmentStatus][in] string
    Filter assessmentStatus (in). Comma-separated, at most 50 values.
  • filter[criticality][eq] string
    Filter criticality (eq).
  • filter[criticality][in] string
    Filter criticality (in). Comma-separated, at most 50 values.
  • filter[id][eq] string
    Filter id (eq).
  • filter[id][in] string
    Filter id (in). Comma-separated, at most 50 values.
  • filter[serviceCategory][eq] string
    Filter serviceCategory (eq).
  • filter[serviceCategory][in] string
    Filter serviceCategory (in). Comma-separated, at most 50 values.
  • filter[status][eq] string
    Filter status (eq).
  • filter[status][in] string
    Filter status (in). Comma-separated, at most 50 values.
  • filter[updatedAt][gte] string (date-time)
    Filter updatedAt (gte).
  • filter[updatedAt][lt] string (date-time)
    Filter updatedAt (lt).

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • assessmentStatus string required
    Assessment status.
  • businessOwnerId string
    Business owner employee id (empl_).
  • createdAt string (date-time) required
    Creation time (UTC).
  • criticality string required
    Criticality.
  • dependencyType string
    Dependency type, when set.
  • displayName string required
    Display name of the supplier.
  • hasCardData boolean required
    Processes card data.
  • hasPhi boolean required
    Processes health data.
  • hasPii boolean required
    Processes personal data.
  • id string required
    Supplier id (sup_).
  • lastAssessmentAt string (date-time) or null
    Last assessment time (UTC).
  • legalName string required
    Legal name of the supplier (an organisation).
  • networkAccessLevel string
    Network access level, when set.
  • nextAssessmentDueAt string (date-time) or null
    Next assessment due (UTC).
  • openFindingCount integer required
    Open findings.
  • openRiskCount integer required
    Open risks.
  • privilegedAccess boolean required
    Has privileged access.
  • securityOwnerId string
    Security owner employee id (empl_).
  • serviceCategory string required
    Service category.
  • status string required
    Lifecycle status.
  • supplierOwnerId string
    Supplier owner employee id (empl_).
  • supportsCrownJewel boolean required
    Supports a crown-jewel asset.
  • updatedAt string (date-time) required
    Last update time (UTC).
  • No other fields.

Errors

Status Code Retry Meaning
400 - no The request is invalid.
401 - no The token is missing, malformed, expired or revoked.
402 - no The organisation’s plan does not include the feature this route needs.
403 - no The token may not use this route.
429 - yes Rate limit or row budget exceeded; retry after the time in Retry-After.
500 - no Unexpected server error.
503 - yes A dependency is temporarily unavailable; retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc