# Vendor risk summary

Open findings aggregated per vendor: the third-party risk view.

`GET /sscs/vendors/risk-summary`

Scope `sbom:read` | Plan **Growth+**

Open findings aggregated per vendor: the third-party risk view. Only vendors with at least one open finding appear, so an empty array means no vendor-linked component is currently vulnerable. Requires the sbom:read scope.

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `vendorId`: string
- `critical`: integer minimum 0
- `high`: integer minimum 0
- `medium`: integer minimum 0
- `low`: integer minimum 0
- `total`: integer minimum 0

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN). |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/sscs/vendors/risk-summary" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/sscs/vendors/risk-summary",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/sscs/vendors/risk-summary", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "vendorId": "vendor_example000001",
      "critical": 0,
      "high": 2,
      "medium": 1,
      "low": 0,
      "total": 3
    }
  ]
}
```