Vendors API

Manage your organization’s vendor relationships, contracts, and risk assessments.

Vendor States

Available vendor states:

• onboarding - Vendor is being set up
• active - Vendor relationship is active
• offboarding - Vendor is being phased out
• deprecated - Vendor relationship has ended

Criticality Levels

Available criticality levels:

• low - Low business impact
• medium - Medium business impact
• high - High business impact

GET /vendors/

List all vendors with optional filtering.

Query Parameters

Parameter	Type	Description
state[]	array	Filter by state: onboarding, active, offboarding, deprecated.
criticality[]	array	Filter by criticality: low, medium, high.
owner[]	array	Filter by owner user IDs.
manager[]	array	Filter by manager user IDs.
labels[]	array	Filter by label IDs. Use none for vendors without labels.

Array parameters

To filter by multiple values, repeat the parameter with [] brackets for each value. For example:

?state[]=active&state[]=onboarding&criticality[]=high

curl --location GET \
--url "https://YOUR_KORDON_DOMAIN/api/v1/vendors/" \
--header "Authorization: Bearer YOUR-TOKEN"

Example with filters:

curl --location GET \
--url "https://YOUR_KORDON_DOMAIN/api/v1/vendors/?state[]=active&criticality[]=high&criticality[]=medium" \
--header "Authorization: Bearer YOUR-TOKEN"

Example Response

Status: 200

{
    "data": [
        {
            "id": "c81c5ceb-fbd4-4d68-9db5-1e019dfa7c1c",
            "assets": [],
            "contact": "Eliise Veri",
            "contract_end_date": "2025-02-28T00:00:00+00:00",
            "contract_start_date": "2025-02-01T00:00:00+00:00",
            "country": "Spain",
            "created_at": "2025-02-27T08:11:34+00:00",
            "criticality": "high",
            "description": "<p>Something something something</p>",
            "labels": [],
            "manager": {
                "id": "aa0bfcda-2fc3-4b25-801a-1c053b5459c3",
                "name": "Jaana Manana"
            },
            "owner": {
                "id": "d650d63e-538e-4aff-a1df-d9ae8346a9f5",
                "name": "Andrey Rozumnyi"
            },
            "permissions": {
                "update": true,
                "destroy": true,
                "connect": true
            },
            "personal_data_classification": "no_personal",
            "risks": [],
            "state": "active",
            "tasks": [],
            "title": "My vendor",
            "updated_at": "2025-05-12T08:33:07+00:00"
        }
    ],
    "meta": {
        "total_count": 25,
        "page": 1,
        "permissions": {
            "create": true
        },
        "per_page": "1"
    }
}

POST /vendors/

Create a new vendor relationship.

Required Parameters:

• title - Vendor name
• manager_id - User ID of the vendor manager
• owner_id - User ID of the vendor owner
• state - Vendor state

curl --location POST \
--url "https://YOUR_KORDON_DOMAIN/api/v1/vendors/" \
--header "Authorization: Bearer YOUR-TOKEN" \
--header "Content-Type: application/json" \
--data '{
    "title": "Vendor A",
    "manager_id": "6ab0ac31-8162-4e1c-ba4d-43ad29af6ee7",
    "owner_id": "6ab0ac31-8162-4e1c-ba4d-43ad29af6ee7",
    "state": "active"
}'

PATCH /vendors/:id

Update vendor information.

curl --location PATCH \
--url "https://YOUR_KORDON_DOMAIN/api/v1/vendors/vendor-id-here" \
--header "Authorization: Bearer YOUR-TOKEN" \
--header "Content-Type: application/json" \
--data '{
    "country": "Italy"
}'

DELETE /vendors/:id

Remove a vendor relationship.

curl --location DELETE \
--url "https://YOUR_KORDON_DOMAIN/api/v1/vendors/vendor-id-here" \
--header "Authorization: Bearer YOUR-TOKEN"

Managing Vendor Connections

Vendors can be connected to Controls, Risks, Assets, Business Processes, and Findings.

PATCH /vendors/:id/connections

Update the connections for a vendor.

Connection Parameters

Parameter	Type	Description
control_ids	array	IDs of controls to connect
risk_ids	array	IDs of risks to connect
asset_ids	array	IDs of assets to connect
business_process_ids	array	IDs of business processes to connect
finding_ids	array	IDs of findings to connect

Partial Updates

Only connection types included in the request are updated. Omitted connection types remain unchanged.

Replacing Connections

When updating a connection type, you must include all IDs you want connected, not just the new ones.

• To add a connection: include all existing IDs plus the new ID
• To remove a connection: include all IDs except the one to remove
• To remove all connections of a type: include an empty array []

Invalid IDs are ignored.

Example: Update vendor connections

curl --location PATCH \
--url "https://YOUR_KORDON_DOMAIN/api/v1/vendors/c81c5ceb-fbd4-4d68-9db5-1e019dfa7c1c/connections" \
--header "Authorization: Bearer YOUR-TOKEN" \
--header "Content-Type: application/json" \
--data '{
    "connections": {
        "control_ids": [
            "18211d00-904f-4ca9-a212-1e616a687d83"
        ],
        "asset_ids": [
            "0fb11fe0-85de-423d-ba63-b76598a9c743"
        ],
        "risk_ids": [
            "3efe0045-3562-4aa5-96bd-b17f13c4de79"
        ],
        "business_process_ids": [
            "5a35e67e-f6b7-488d-86a2-6d7943ea6119"
        ]
    }
}'

Example Response

Status: 200

The response returns the full vendor object with all updated connections.