--- title: "List of vendors who are in scope for this audit" method: GET path: "/audits/{auditId}/vendors" tags: ["Audits"] deprecated: true --- # List of vendors who are in scope for this audit `GET /audits/{auditId}/vendors` > **Deprecated.** Returns a list of vendors who are in scope for this audit. End of life — this endpoint works for classic audits only; it does not support controlled audit view. It remains available for existing classic audits but will be removed once classic audits are fully phased out, so do not build new integrations on it. Rate limit: 10 requests / minute. ## Path parameters - `auditId` string, required ## Query parameters - `pageSize` integer — Controls the maximum number of items returned in one response from the API. - `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. ## Response `200` Ok - PaginatedResponseVendor - `results` object, required - `data` Vendor[], required - `id` string, required — The vendor's unique ID. - `name` string, required — The vendor's display name. - `websiteUrl` string, nullable, required — The vendor's website URL. - `accountManagerName` string, nullable, required — The vendor's external account manager name. - `accountManagerEmail` string, nullable, required — The vendor's external account manager email. - `servicesProvided` string, nullable, required — Services provided by the vendor. - `additionalNotes` string, nullable, required — Any additional notes about the vendor - `securityOwnerUserId` string, nullable, required — The vendor's security owner's Vanta user ID. - `businessOwnerUserId` string, nullable, required — The vendor's business owner's Vanta user ID. - `contractStartDate` string, date-time, nullable, required — The date the contract with the vendor began. - `contractRenewalDate` string, date-time, nullable, required — The date the contract with the vendor is up for renewal. - `contractTerminationDate` string, date-time, nullable, required — The date the contract with the vendor was terminated. - `nextSecurityReviewDueDate` string, date-time, nullable, required — The next due date for a security review. - `lastSecurityReviewCompletionDate` string, date-time, nullable, required — The most recent date a security review was completed. - `isVisibleToAuditors` boolean, nullable, required — Whether or not auditors can view this vendor. - `isRiskAutoScored` boolean, nullable, required — Whether or not the vendor's risk is automatically scored. - `riskAttributeIds` string[], required — The list of risk attribute IDs the vendor has been assigned to. - `category` object, nullable, required — The vendor's category. - `displayName` string, required - `authDetails` object, required — The vendor's authentication details. - `passwordMinimumLength` number, double, nullable, required — Minimum number for chacters required for passwords for this vendor. - `passwordRequiresSymbol` boolean, nullable, required — Whether or not the vendor requires passwords to have a symbol. - `passwordRequiresNumber` boolean, nullable, required — Whether or not the vendor requires passwords to have a number. - `passwordMFA` boolean, nullable, required — Whether or not the vendor requires passwords to have multi factor authentication. - `method` 'AUTH_0' | 'AZURE_AD' | 'GOOGLE_WORKSPACE' | 'O_AUTH' | 'O365' | 'OKTA' | 'ONE_LOGIN' | 'OWA' | 'SSO' | 'USERNAME_PASSWORD' | 'OTHER', required — The authentication method a vendor uses: - AUTH_0: The vendor authenticates using Auth0 - AZURE_AD: The vendor authenticates using Azure Active Directory - G_SUITE: The vendor authenticates using Google Workspace - O_AUTH: The vendor authenticates using OAuth - O365: The vendor authenticates using Office 365 - OKTA: The vendor authenticates using Okta - ONE_LOGIN: The vendor authenticates using OneLogin - OWA: The vendor authenticates using OWA - SSO: The vendor authenticates using SSO - USERNAME_PASSWORD: The vendor authenticates using usernames and passwords - `status` 'MANAGED' | 'ARCHIVED' | 'IN_PROCUREMENT', required — The current state of a vendor: - MANAGED: The vendor is actively managed. - ARCHIVED: The vendor has been archived - IN_PROCUREMENT: The vendor is in the procurement process - `inherentRiskLevel` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' | 'UNSCORED', required — The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium security risk - LOW: The vendor has a low security risk - UNSCORED: The vendor has not been given a risk level - `residualRiskLevel` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' | 'UNSCORED', required — The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium security risk - LOW: The vendor has a low security risk - UNSCORED: The vendor has not been given a risk level - `vendorHeadquarters` 'EUE' | 'AND' | 'ARE' | 'AFG' | 'ATG' | 'AIA' | 'ALB' | 'ARM' | 'AGO' | 'ATA' | 'ARG' | 'ASM' | 'AUT' | 'AUS' | 'ABW' | 'ALA' | 'AZE' | 'BIH' | 'BRB' | 'BGD' | 'BEL' | 'BFA' | 'BGR' | 'BHR' | 'BDI' | 'BEN' | 'BLM' | 'BMU' | 'BRN' | 'BOL' | 'BES' | 'BRA' | 'BHS' | 'BTN' | 'BVT' | 'BWA' | 'BLR' | 'BLZ' | 'CAN' | 'CCK' | 'COD' | 'CAF' | 'COG' | 'CHE' | 'CIV' | 'COK' | 'CHL' | 'CMR' | 'CHN' | 'COL' | 'CRI' | 'CUB' | 'CPV' | 'CUW' | 'CXR' | 'CYP' | 'CZE' | 'DEU' | 'DJI' | 'DNK' | 'DMA' | 'DOM' | 'DZA' | 'ECU' | 'EST' | 'EGY' | 'ESH' | 'ERI' | 'ESP' | 'ETH' | 'FIN' | 'FJI' | 'FLK' | 'FSM' | 'FRO' | 'FRA' | 'GAB' | 'ENG' | 'SCT' | 'GBR' | 'WAL' | 'NIR' | 'GRD' | 'GEO' | 'GUF' | 'GGY' | 'GHA' | 'GIB' | 'GRL' | 'GMB' | 'GIN' | 'GLP' | 'GNQ' | 'GRC' | 'SGS' | 'GTM' | 'GUM' | 'GNB' | 'GUY' | 'HKG' | 'HMD' | 'HND' | 'HRV' | 'HTI' | 'HUN' | 'IDN' | 'IRL' | 'ISR' | 'IMN' | 'IND' | 'IOT' | 'IRQ' | 'IRN' | 'ISL' | 'ITA' | 'JEY' | 'JAM' | 'JOR' | 'JPN' | 'KEN' | 'KGZ' | 'KHM' | 'KIR' | 'COM' | 'KNA' | 'PRK' | 'KOR' | 'KWT' | 'CYM' | 'KAZ' | 'LAO' | 'LBN' | 'LCA' | 'LIE' | 'LKA' | 'LBR' | 'LSO' | 'LTU' | 'LUX' | 'LVA' | 'LBY' | 'MAR' | 'MCO' | 'MDA' | 'MNE' | 'MAF' | 'MDG' | 'MHL' | 'MKD' | 'MLI' | 'MMR' | 'MNG' | 'MAC' | 'MNP' | 'MTQ' | 'MRT' | 'MSR' | 'MLT' | 'MUS' | 'MDV' | 'MWI' | 'MEX' | 'MYS' | 'MOZ' | 'NAM' | 'NCL' | 'NER' | 'NFK' | 'NGA' | 'NIC' | 'NLD' | 'NOR' | 'NPL' | 'NRU' | 'NIU' | 'NZL' | 'OMN' | 'PAN' | 'PER' | 'PYF' | 'PNG' | 'PHL' | 'PAK' | 'POL' | 'SPM' | 'PCN' | 'PRI' | 'PSE' | 'PRT' | 'PLW' | 'PRY' | 'QAT' | 'REU' | 'ROU' | 'SRB' | 'RUS' | 'RWA' | 'SAU' | 'SLB' | 'SYC' | 'SDN' | 'SWE' | 'SGP' | 'SHN' | 'SVN' | 'SJM' | 'SVK' | 'SLE' | 'SMR' | 'SEN' | 'SOM' | 'SUR' | 'SSD' | 'STP' | 'SLV' | 'SXM' | 'SYR' | 'SWZ' | 'TCA' | 'TCD' | 'ATF' | 'TGO' | 'THA' | 'TJK' | 'TKL' | 'TLS' | 'TKM' | 'TUN' | 'TON' | 'TUR' | 'TTO' | 'TUV' | 'TWN' | 'TZA' | 'UKR' | 'UGA' | 'UMI' | 'USA' | 'URY' | 'UZB' | 'VAT' | 'VCT' | 'VEN' | 'VGB' | 'VIR' | 'VNM' | 'VUT' | 'WLF' | 'WSM' | 'YEM' | 'MYT' | 'ZAF' | 'ZMB' | 'ZWE', required - `contractAmount` VendorContractAmount, required - `amount` number, double, required — The amount of the contract. - `currency` 'ARS' | 'AUD' | 'BRL' | 'CAD' | 'COP' | 'CZK' | 'DKK' | 'EUR' | 'GBP' | 'ILS' | 'INR' | 'JPY' | 'MXN' | 'NOK' | 'NZD' | 'PHP' | 'PKR' | 'PLN' | 'RSD' | 'SEK' | 'SGD' | 'UAH' | 'USD' | 'ZAR', required - `customFields` CustomField[], nullable, required — The vendor's custom fields. - `label` string, required - `value` union, required - string - string[] - `latestDecision` VendorDecision, required — The decision for a vendor. - `status` 'APPROVED' | 'CONDITIONALLY_APPROVED' | 'NOT_APPROVED', required - `lastUpdatedAt` string, date-time, required - `linkedTaskTrackerTaskProcurementRequest` object, nullable, required — The task tracker procurement request associated with this vendor (if linked). - `url` string, required - `service` string, required - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset. - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor. - `hasNextPage` boolean, required — Indicates if there is another page after the current page. - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page. - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor. --- [API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)