---
title: "Get vendor by ID"
method: GET
path: "/vendors/{id}"
tags: ["Vendors"]
---

# Get vendor by ID

`GET /vendors/{id}`

Retrieves a single vendor by its ID, including associated project IDs.

## Path parameters

- `id` integer, required

## Response `200`

Vendor retrieved successfully

- object
  - `message` string
  - `data` Vendor
    - `id` integer — Auto-generated primary key
    - `order_no` integer, nullable — Display order number
    - `vendor_name` string, required — Name of the vendor
    - `vendor_provides` string, required — What the vendor provides
    - `assignee` integer, required — User ID of the assigned owner
    - `website` string, required — Vendor website URL
    - `vendor_contact_person` string, required — Name of the vendor contact
    - `review_result` string, nullable — Free-text review result summary
    - `review_status` 'Not started' | 'In review' | 'Reviewed' | 'Requires follow-up', nullable — Current review lifecycle status
    - `reviewer` integer, nullable — User ID of the reviewer
    - `review_date` string, date-time, nullable — Date the review was performed (ISO 8601)
    - `is_demo` boolean — Whether this is a demo vendor (read-only after creation)
    - `projects` integer[] — Array of associated project IDs
    - `data_sensitivity` 'None' | 'Internal only' | 'Personally identifiable information (PII)' | 'Financial data' | 'Health data (e.g. HIPAA)' | 'Model weights or AI assets' | 'Other sensitive data', nullable — Scorecard - type of data the vendor accesses
    - `business_criticality` 'Low (vendor supports non-core functions)' | 'Medium (affects operations but is replaceable)' | 'High (critical to core services or products)', nullable — Scorecard - how critical the vendor is to operations
    - `past_issues` 'None' | 'Minor incident (e.g. small delay, minor bug)' | 'Major incident (e.g. data breach, legal issue)', nullable — Scorecard - history of past incidents
    - `regulatory_exposure` 'None' | 'GDPR (EU)' | 'HIPAA (US)' | 'SOC 2' | 'ISO 27001' | 'EU AI act' | 'CCPA (california)' | 'Other', nullable — Scorecard - applicable regulatory framework
    - `risk_score` integer, nullable — Computed risk score for the vendor
    - `created_at` string, date-time — Creation timestamp (ISO 8601)
    - `updated_at` string, date-time — Last update timestamp (ISO 8601)

## Other responses

- `401` — Unauthorized - missing or invalid JWT
- `404` — Vendor not found
- `500` — Internal server error

---

[API](https://skmtc.net/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.net/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/versions/c764f0a64a5e/schema)