---
title: "Create a vendor"
method: POST
path: "/vendors"
tags: ["Vendors"]
---

# Create a vendor

`POST /vendors`

Add vendor with metadata.

## Request body

- CreateVendorInput
  - `name` string, required — Display name of the vendor.
  - `websiteUrl` string — The url of the vendor's website.
  - `accountManagerName` string — Name of the external account manager for this vendor.
  - `accountManagerEmail` string — Email of the external account manager for this vendor.
  - `securityOwnerUserId` string — The Vanta user ID of the security owner of this vendor.
  - `servicesProvided` string — Services provided by the vendor.
  - `additionalNotes` string — Miscellaneous notes about the vendor
  - `businessOwnerUserId` string — The Vanta user ID of the business owner of this vendor.
  - `contractStartDate` string, date-time — When the contract with the vendor is up for renewal.
  - `contractRenewalDate` string, date-time — When the contract with the vendor is up for renewal.
  - `contractTerminationDate` string, date-time — When the contract with the vendor was terminated.
  - `isVisibleToAuditors` boolean — Whether or not auditors can view this vendor.
  - `authDetails` object — The authentication details about the vendor.
    - `passwordMinimumLength` number, double — Minimum number for chacters required for passwords for this vendor.
    - `passwordRequiresSymbol` boolean — Whether or not the vendor requires passwords to have a symbol.
    - `passwordRequiresNumber` boolean — Whether or not the vendor requires passwords to have a number.
    - `passwordMFA` boolean — Whether or not the vendor requires password multi factor authentication.
    - `method` 'AUTH_0' | 'AZURE_AD' | 'GOOGLE_WORKSPACE' | 'O_AUTH' | 'O365' | 'OKTA' | 'ONE_LOGIN' | 'OWA' | 'SSO' | 'USERNAME_PASSWORD' | 'OTHER' — The authentication method a vendor uses: - AUTH_0: The vendor authenticates using Auth0 - AZURE_AD: The vendor authenticates using Azure Active Directory - G_SUITE: The vendor authenticates using Google Workspace - O_AUTH: The vendor authenticates using OAuth - O365: The vendor authenticates using Office 365 - OKTA: The vendor authenticates using Okta - ONE_LOGIN: The vendor authenticates using OneLogin - OWA: The vendor authenticates using OWA - SSO: The vendor authenticates using SSO - USERNAME_PASSWORD: The vendor authenticates using usernames and passwords
  - `status` 'MANAGED' | 'ARCHIVED' | 'IN_PROCUREMENT' — The current state of a vendor: - MANAGED: The vendor is actively managed. - ARCHIVED: The vendor has been archived - IN_PROCUREMENT: The vendor is in the procurement process
  - `category` string — The vendor's category.
  - `inherentRiskLevel` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' | 'UNSCORED' — The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium security risk - LOW: The vendor has a low security risk - UNSCORED: The vendor has not been given a risk level
  - `residualRiskLevel` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' | 'UNSCORED' — The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium security risk - LOW: The vendor has a low security risk - UNSCORED: The vendor has not been given a risk level
  - `vendorHeadquarters` 'EUE' | 'AND' | 'ARE' | 'AFG' | 'ATG' | 'AIA' | 'ALB' | 'ARM' | 'AGO' | 'ATA' | 'ARG' | 'ASM' | 'AUT' | 'AUS' | 'ABW' | 'ALA' | 'AZE' | 'BIH' | 'BRB' | 'BGD' | 'BEL' | 'BFA' | 'BGR' | 'BHR' | 'BDI' | 'BEN' | 'BLM' | 'BMU' | 'BRN' | 'BOL' | 'BES' | 'BRA' | 'BHS' | 'BTN' | 'BVT' | 'BWA' | 'BLR' | 'BLZ' | 'CAN' | 'CCK' | 'COD' | 'CAF' | 'COG' | 'CHE' | 'CIV' | 'COK' | 'CHL' | 'CMR' | 'CHN' | 'COL' | 'CRI' | 'CUB' | 'CPV' | 'CUW' | 'CXR' | 'CYP' | 'CZE' | 'DEU' | 'DJI' | 'DNK' | 'DMA' | 'DOM' | 'DZA' | 'ECU' | 'EST' | 'EGY' | 'ESH' | 'ERI' | 'ESP' | 'ETH' | 'FIN' | 'FJI' | 'FLK' | 'FSM' | 'FRO' | 'FRA' | 'GAB' | 'ENG' | 'SCT' | 'GBR' | 'WAL' | 'NIR' | 'GRD' | 'GEO' | 'GUF' | 'GGY' | 'GHA' | 'GIB' | 'GRL' | 'GMB' | 'GIN' | 'GLP' | 'GNQ' | 'GRC' | 'SGS' | 'GTM' | 'GUM' | 'GNB' | 'GUY' | 'HKG' | 'HMD' | 'HND' | 'HRV' | 'HTI' | 'HUN' | 'IDN' | 'IRL' | 'ISR' | 'IMN' | 'IND' | 'IOT' | 'IRQ' | 'IRN' | 'ISL' | 'ITA' | 'JEY' | 'JAM' | 'JOR' | 'JPN' | 'KEN' | 'KGZ' | 'KHM' | 'KIR' | 'COM' | 'KNA' | 'PRK' | 'KOR' | 'KWT' | 'CYM' | 'KAZ' | 'LAO' | 'LBN' | 'LCA' | 'LIE' | 'LKA' | 'LBR' | 'LSO' | 'LTU' | 'LUX' | 'LVA' | 'LBY' | 'MAR' | 'MCO' | 'MDA' | 'MNE' | 'MAF' | 'MDG' | 'MHL' | 'MKD' | 'MLI' | 'MMR' | 'MNG' | 'MAC' | 'MNP' | 'MTQ' | 'MRT' | 'MSR' | 'MLT' | 'MUS' | 'MDV' | 'MWI' | 'MEX' | 'MYS' | 'MOZ' | 'NAM' | 'NCL' | 'NER' | 'NFK' | 'NGA' | 'NIC' | 'NLD' | 'NOR' | 'NPL' | 'NRU' | 'NIU' | 'NZL' | 'OMN' | 'PAN' | 'PER' | 'PYF' | 'PNG' | 'PHL' | 'PAK' | 'POL' | 'SPM' | 'PCN' | 'PRI' | 'PSE' | 'PRT' | 'PLW' | 'PRY' | 'QAT' | 'REU' | 'ROU' | 'SRB' | 'RUS' | 'RWA' | 'SAU' | 'SLB' | 'SYC' | 'SDN' | 'SWE' | 'SGP' | 'SHN' | 'SVN' | 'SJM' | 'SVK' | 'SLE' | 'SMR' | 'SEN' | 'SOM' | 'SUR' | 'SSD' | 'STP' | 'SLV' | 'SXM' | 'SYR' | 'SWZ' | 'TCA' | 'TCD' | 'ATF' | 'TGO' | 'THA' | 'TJK' | 'TKL' | 'TLS' | 'TKM' | 'TUN' | 'TON' | 'TUR' | 'TTO' | 'TUV' | 'TWN' | 'TZA' | 'UKR' | 'UGA' | 'UMI' | 'USA' | 'URY' | 'UZB' | 'VAT' | 'VCT' | 'VEN' | 'VGB' | 'VIR' | 'VNM' | 'VUT' | 'WLF' | 'WSM' | 'YEM' | 'MYT' | 'ZAF' | 'ZMB' | 'ZWE'
  - `contractAmount` VendorContractAmount
    - `amount` number, double, required — The amount of the contract.
    - `currency` 'ARS' | 'AUD' | 'BRL' | 'CAD' | 'COP' | 'CZK' | 'DKK' | 'EUR' | 'GBP' | 'ILS' | 'INR' | 'JPY' | 'MXN' | 'NOK' | 'NZD' | 'PHP' | 'PKR' | 'PLN' | 'RSD' | 'SEK' | 'SGD' | 'UAH' | 'USD' | 'ZAR', required
  - `customFields` CustomField[] — The custom fields for the vendor. For more information on how to set custom fields via the API, visit https://developer.vanta.com/docs/guides/use-custom-fields-with-vendors
    - `label` string, required
    - `value` union, required
      - string
      - string[]
  - `frameworkScope` VendorFrameworkScope — Framework scoping configuration for a vendor. Determines which compliance frameworks the vendor applies to.
    - `scopeType` 'ALL' | 'PARTIAL' | 'NONE', required — The scope type: - ALL: Vendor applies to all frameworks - PARTIAL: Vendor applies to specific frameworks (requires frameworkIds) - NONE: Vendor excluded from all frameworks
    - `frameworkIds` string[] — Framework IDs the vendor applies to. Required when scopeType is PARTIAL.

## Response `200`

Ok

- Vendor
  - `id` string, required — The vendor's unique ID.
  - `name` string, required — The vendor's display name.
  - `websiteUrl` string, nullable, required — The vendor's website URL.
  - `accountManagerName` string, nullable, required — The vendor's external account manager name.
  - `accountManagerEmail` string, nullable, required — The vendor's external account manager email.
  - `servicesProvided` string, nullable, required — Services provided by the vendor.
  - `additionalNotes` string, nullable, required — Any additional notes about the vendor
  - `securityOwnerUserId` string, nullable, required — The vendor's security owner's Vanta user ID.
  - `businessOwnerUserId` string, nullable, required — The vendor's business owner's Vanta user ID.
  - `contractStartDate` string, date-time, nullable, required — The date the contract with the vendor began.
  - `contractRenewalDate` string, date-time, nullable, required — The date the contract with the vendor is up for renewal.
  - `contractTerminationDate` string, date-time, nullable, required — The date the contract with the vendor was terminated.
  - `nextSecurityReviewDueDate` string, date-time, nullable, required — The next due date for a security review.
  - `lastSecurityReviewCompletionDate` string, date-time, nullable, required — The most recent date a security review was completed.
  - `isVisibleToAuditors` boolean, nullable, required — Whether or not auditors can view this vendor.
  - `isRiskAutoScored` boolean, nullable, required — Whether or not the vendor's risk is automatically scored.
  - `riskAttributeIds` string[], required — The list of risk attribute IDs the vendor has been assigned to.
  - `category` object, nullable, required — The vendor's category.
    - `displayName` string, required
  - `authDetails` object, required — The vendor's authentication details.
    - `passwordMinimumLength` number, double, nullable, required — Minimum number for chacters required for passwords for this vendor.
    - `passwordRequiresSymbol` boolean, nullable, required — Whether or not the vendor requires passwords to have a symbol.
    - `passwordRequiresNumber` boolean, nullable, required — Whether or not the vendor requires passwords to have a number.
    - `passwordMFA` boolean, nullable, required — Whether or not the vendor requires passwords to have multi factor authentication.
    - `method` 'AUTH_0' | 'AZURE_AD' | 'GOOGLE_WORKSPACE' | 'O_AUTH' | 'O365' | 'OKTA' | 'ONE_LOGIN' | 'OWA' | 'SSO' | 'USERNAME_PASSWORD' | 'OTHER', required — The authentication method a vendor uses: - AUTH_0: The vendor authenticates using Auth0 - AZURE_AD: The vendor authenticates using Azure Active Directory - G_SUITE: The vendor authenticates using Google Workspace - O_AUTH: The vendor authenticates using OAuth - O365: The vendor authenticates using Office 365 - OKTA: The vendor authenticates using Okta - ONE_LOGIN: The vendor authenticates using OneLogin - OWA: The vendor authenticates using OWA - SSO: The vendor authenticates using SSO - USERNAME_PASSWORD: The vendor authenticates using usernames and passwords
  - `status` 'MANAGED' | 'ARCHIVED' | 'IN_PROCUREMENT', required — The current state of a vendor: - MANAGED: The vendor is actively managed. - ARCHIVED: The vendor has been archived - IN_PROCUREMENT: The vendor is in the procurement process
  - `inherentRiskLevel` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' | 'UNSCORED', required — The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium security risk - LOW: The vendor has a low security risk - UNSCORED: The vendor has not been given a risk level
  - `residualRiskLevel` 'CRITICAL' | 'HIGH' | 'LOW' | 'MEDIUM' | 'UNSCORED', required — The risk level of a vendor: - CRITICAL: The vendor has a critical security risk - HIGH: The vendor has a high security risk - MEDIUM: The vendor has a medium security risk - LOW: The vendor has a low security risk - UNSCORED: The vendor has not been given a risk level
  - `vendorHeadquarters` 'EUE' | 'AND' | 'ARE' | 'AFG' | 'ATG' | 'AIA' | 'ALB' | 'ARM' | 'AGO' | 'ATA' | 'ARG' | 'ASM' | 'AUT' | 'AUS' | 'ABW' | 'ALA' | 'AZE' | 'BIH' | 'BRB' | 'BGD' | 'BEL' | 'BFA' | 'BGR' | 'BHR' | 'BDI' | 'BEN' | 'BLM' | 'BMU' | 'BRN' | 'BOL' | 'BES' | 'BRA' | 'BHS' | 'BTN' | 'BVT' | 'BWA' | 'BLR' | 'BLZ' | 'CAN' | 'CCK' | 'COD' | 'CAF' | 'COG' | 'CHE' | 'CIV' | 'COK' | 'CHL' | 'CMR' | 'CHN' | 'COL' | 'CRI' | 'CUB' | 'CPV' | 'CUW' | 'CXR' | 'CYP' | 'CZE' | 'DEU' | 'DJI' | 'DNK' | 'DMA' | 'DOM' | 'DZA' | 'ECU' | 'EST' | 'EGY' | 'ESH' | 'ERI' | 'ESP' | 'ETH' | 'FIN' | 'FJI' | 'FLK' | 'FSM' | 'FRO' | 'FRA' | 'GAB' | 'ENG' | 'SCT' | 'GBR' | 'WAL' | 'NIR' | 'GRD' | 'GEO' | 'GUF' | 'GGY' | 'GHA' | 'GIB' | 'GRL' | 'GMB' | 'GIN' | 'GLP' | 'GNQ' | 'GRC' | 'SGS' | 'GTM' | 'GUM' | 'GNB' | 'GUY' | 'HKG' | 'HMD' | 'HND' | 'HRV' | 'HTI' | 'HUN' | 'IDN' | 'IRL' | 'ISR' | 'IMN' | 'IND' | 'IOT' | 'IRQ' | 'IRN' | 'ISL' | 'ITA' | 'JEY' | 'JAM' | 'JOR' | 'JPN' | 'KEN' | 'KGZ' | 'KHM' | 'KIR' | 'COM' | 'KNA' | 'PRK' | 'KOR' | 'KWT' | 'CYM' | 'KAZ' | 'LAO' | 'LBN' | 'LCA' | 'LIE' | 'LKA' | 'LBR' | 'LSO' | 'LTU' | 'LUX' | 'LVA' | 'LBY' | 'MAR' | 'MCO' | 'MDA' | 'MNE' | 'MAF' | 'MDG' | 'MHL' | 'MKD' | 'MLI' | 'MMR' | 'MNG' | 'MAC' | 'MNP' | 'MTQ' | 'MRT' | 'MSR' | 'MLT' | 'MUS' | 'MDV' | 'MWI' | 'MEX' | 'MYS' | 'MOZ' | 'NAM' | 'NCL' | 'NER' | 'NFK' | 'NGA' | 'NIC' | 'NLD' | 'NOR' | 'NPL' | 'NRU' | 'NIU' | 'NZL' | 'OMN' | 'PAN' | 'PER' | 'PYF' | 'PNG' | 'PHL' | 'PAK' | 'POL' | 'SPM' | 'PCN' | 'PRI' | 'PSE' | 'PRT' | 'PLW' | 'PRY' | 'QAT' | 'REU' | 'ROU' | 'SRB' | 'RUS' | 'RWA' | 'SAU' | 'SLB' | 'SYC' | 'SDN' | 'SWE' | 'SGP' | 'SHN' | 'SVN' | 'SJM' | 'SVK' | 'SLE' | 'SMR' | 'SEN' | 'SOM' | 'SUR' | 'SSD' | 'STP' | 'SLV' | 'SXM' | 'SYR' | 'SWZ' | 'TCA' | 'TCD' | 'ATF' | 'TGO' | 'THA' | 'TJK' | 'TKL' | 'TLS' | 'TKM' | 'TUN' | 'TON' | 'TUR' | 'TTO' | 'TUV' | 'TWN' | 'TZA' | 'UKR' | 'UGA' | 'UMI' | 'USA' | 'URY' | 'UZB' | 'VAT' | 'VCT' | 'VEN' | 'VGB' | 'VIR' | 'VNM' | 'VUT' | 'WLF' | 'WSM' | 'YEM' | 'MYT' | 'ZAF' | 'ZMB' | 'ZWE', required
  - `contractAmount` VendorContractAmount, required
    - `amount` number, double, required — The amount of the contract.
    - `currency` 'ARS' | 'AUD' | 'BRL' | 'CAD' | 'COP' | 'CZK' | 'DKK' | 'EUR' | 'GBP' | 'ILS' | 'INR' | 'JPY' | 'MXN' | 'NOK' | 'NZD' | 'PHP' | 'PKR' | 'PLN' | 'RSD' | 'SEK' | 'SGD' | 'UAH' | 'USD' | 'ZAR', required
  - `customFields` CustomField[], nullable, required — The vendor's custom fields.
    - `label` string, required
    - `value` union, required
      - string
      - string[]
  - `latestDecision` VendorDecision, required — The decision for a vendor.
    - `status` 'APPROVED' | 'CONDITIONALLY_APPROVED' | 'NOT_APPROVED', required
    - `lastUpdatedAt` string, date-time, required
  - `linkedTaskTrackerTaskProcurementRequest` object, nullable, required — The task tracker procurement request associated with this vendor (if linked).
    - `url` string, required
    - `service` string, required

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)