# Update vendor

Update a vendor.

`PUT /sscs/vendors/{vendorId}`

Scope `sbom:write` | Plan **Growth+**

Update a vendor. The body is validated against the same schema as create, so all four required fields must be present: send the full record, not a partial patch. `website` and `notes` are always overwritten with what you send (omit them to clear); `name`, `type`, `riskTier` and `assessmentStatus` are overwritten when non-empty. Requires the sbom:write scope (or a signed-in Owner or Manager session).

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `vendorId` | string | yes | Vendor id. |

## Request body

- `name`: string minLength 1
- `website`: optional string
- `type`: string
  - `oss`
  - `commercial`
  - `internal`
- `riskTier`: integer
  - `1`
  - `2`
  - `3`
- `assessmentStatus`: string
  - `not_started`
  - `in_progress`
  - `completed`
- `notes`: optional string
- No other fields.

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `vendorId`: optional string
- `orgId`: string
- `name`: string
- `website`: optional string
- `type`: string
  - `oss`
  - `commercial`
  - `internal`
- `riskTier`: integer 1 is the highest risk.
  - `1`
  - `2`
  - `3`
- `assessmentStatus`: string
  - `not_started`
  - `in_progress`
  - `completed`
- `lastAssessedAt`: optional string (date-time)
- `notes`: optional string
- `createdAt`: string (date-time)
- `updatedAt`: string (date-time)

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | `VALIDATION_FAILED` | no | The JSON body does not match the request schema. code VALIDATION_FAILED, or INVALID_REQUEST when the body cannot be read. |
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN). |
| 404 | `NOT_FOUND` | no | Unknown or foreign-tenant vendor id. code NOT_FOUND. |
| 413 | `FILE_TOO_LARGE` | no | The body exceeds the size limit. code FILE_TOO_LARGE (upload, 5 MB) or PAYLOAD_TOO_LARGE (JSON body). |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl -X PUT "https://api.autociso.io/api/v1/sscs/vendors/<vendorId>" \
  -H "Authorization: Bearer <your-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"Example Analytics","website":"https://vendor.example.com","type":"commercial","riskTier":1,"assessmentStatus":"completed","notes":"Annual review closed."}'
```

### Python

```python
import requests

response = requests.put(
    "https://api.autociso.io/api/v1/sscs/vendors/<vendorId>",
    headers={"Authorization": "Bearer <your-api-token>", "Content-Type": "application/json"},
    json={
        "name": "Example Analytics",
        "website": "https://vendor.example.com",
        "type": "commercial",
        "riskTier": 1,
        "assessmentStatus": "completed",
        "notes": "Annual review closed.",
    },
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/sscs/vendors/<vendorId>", {
  method: "PUT",
  headers: { "Authorization": "Bearer <your-api-token>", "Content-Type": "application/json" },
  body: JSON.stringify({
    "name": "Example Analytics",
    "website": "https://vendor.example.com",
    "type": "commercial",
    "riskTier": 1,
    "assessmentStatus": "completed",
    "notes": "Annual review closed."
  }),
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": {
    "vendorId": "vendor_example000001",
    "orgId": "org_example000001",
    "name": "Example Analytics",
    "website": "https://vendor.example.com",
    "type": "commercial",
    "riskTier": 2,
    "assessmentStatus": "in_progress",
    "lastAssessedAt": "2026-07-14T10:00:00Z",
    "notes": "Processes pseudonymised usage events only.",
    "createdAt": "2026-03-02T11:20:05Z",
    "updatedAt": "2026-09-05T08:41:12Z"
  }
}
```