docs

Create vendor

POST /sscs/vendors

Scope sbom:write Plan Growth+

Register a software vendor. name, type, riskTier and assessmentStatus are all required. type is oss, commercial or internal; riskTier is the integer 1, 2 or 3 (1 is the highest risk); assessmentStatus is not_started, in_progress or completed. vendorId and orgId are server-assigned. Requires the sbom:write scope (or a signed-in Owner or Manager session).

Example

curl -X POST "https://api.autociso.io/api/v1/sscs/vendors" \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"Example Analytics","website":"https://vendor.example.com","type":"commercial","riskTier":2,"assessmentStatus":"in_progress","notes":"Processes pseudonymised usage events only."}'

Response 201

{
  "data": {
    "vendorId": "vendor_example000001",
    "orgId": "org_example000001",
    "name": "Example Analytics",
    "website": "https://vendor.example.com",
    "type": "commercial",
    "riskTier": 2,
    "assessmentStatus": "in_progress",
    "lastAssessedAt": "2026-07-14T10:00:00Z",
    "notes": "Processes pseudonymised usage events only.",
    "createdAt": "2026-03-02T11:20:05Z",
    "updatedAt": "2026-09-05T08:41:12Z"
  }
}

Request body

  • name string required
    minLength 1
  • website string
  • type string required
    "oss" | "commercial" | "internal"
  • riskTier integer required
    1 | 2 | 3
  • assessmentStatus string required
    "not_started" | "in_progress" | "completed"
  • notes string
  • No other fields.

Returns

The data field of the standard { data, error, meta } envelope:

  • vendorId string
  • orgId string required
  • name string required
  • website string
  • type string required
    "oss" | "commercial" | "internal"
  • riskTier integer required
    1 is the highest risk.
    1 | 2 | 3
  • assessmentStatus string required
    "not_started" | "in_progress" | "completed"
  • lastAssessedAt string (date-time)
  • notes string
  • createdAt string (date-time) required
  • updatedAt string (date-time) required

Errors

Status Code Retry Meaning
400 VALIDATION_FAILED no The JSON body does not match the request schema. code VALIDATION_FAILED, or INVALID_REQUEST when the body cannot be read.
401 INVALID_TOKEN no Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402 FEATURE_GATED no The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403 INSUFFICIENT_SCOPE no The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN).
413 FILE_TOO_LARGE no The body exceeds the size limit. code FILE_TOO_LARGE (upload, 5 MB) or PAYLOAD_TOO_LARGE (JSON body).
429 RATE_LIMITED yes Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds.
500 DB_ERROR no Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support.
503 BILLING_UNAVAILABLE yes Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc