---
title: "Update vendor record"
method: PATCH
path: "/v1/vendors/{id}"
tags: ["Vendors"]
---

# Update vendor record

`PATCH /v1/vendors/{id}`

Update vendor ownership, risk attributes, review metadata, and third-party compliance context for an organization.

## Path parameters

- `id` string, required

## Request body

- UpdateVendorDto
  - `name` string — Vendor name
  - `description` string — Vendor description
  - `category` 'cloud' | 'infrastructure' | 'software_as_a_service' | 'finance' | 'marketing' | 'sales' | 'hr' | 'other' — Vendor category
  - `status` 'not_assessed' | 'in_progress' | 'assessed' — Assessment status
  - `inherentProbability` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely' — Inherent probability
  - `inherentImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe' — Inherent impact
  - `residualProbability` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely' — Residual probability
  - `residualImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe' — Residual impact
  - `treatmentStrategy` 'accept' | 'avoid' | 'mitigate' | 'transfer' — Risk treatment strategy
  - `treatmentStrategyDescription` object — Description of the treatment strategy
  - `website` string — Vendor website URL
  - `isSubProcessor` boolean — Whether the vendor is a sub-processor
  - `assigneeId` string — Assignee member ID

## Response `200`

Vendor updated successfully

- object
  - `id` string — Vendor ID
  - `name` string — Vendor name
  - `description` string — Vendor description
  - `category` 'cloud' | 'infrastructure' | 'software_as_a_service' | 'finance' | 'marketing' | 'sales' | 'hr' | 'other'
  - `status` 'not_assessed' | 'in_progress' | 'assessed'
  - `inherentProbability` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
  - `inherentImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
  - `residualProbability` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
  - `residualImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
  - `website` string, nullable
  - `organizationId` string
  - `assigneeId` string, nullable — ID of the user assigned to manage this vendor
  - `createdAt` string, date-time — When the vendor was created
  - `updatedAt` string, date-time — When the vendor was last updated
  - `authType` 'api-key' | 'session' — How the request was authenticated
  - `authenticatedUser` object — User information (only for session auth)
    - `id` string
    - `email` string

## Other responses

- `400` — Bad request - Invalid input data
- `401` — Unauthorized - Invalid authentication or insufficient permissions
- `404` — Vendor not found
- `500` — Internal server error

---

[API](https://skmtc.net/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.net/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/726b9523fb22/schema)