---
title: "Update a vendor"
method: PATCH
path: "/vendors/{id}"
tags: ["Vendors"]
---

# Update a vendor

`PATCH /vendors/{id}`

Partially updates an existing vendor. Only provided fields are updated.
Review and scorecard fields can be explicitly set to null to clear them.
Required fields (vendor_name, vendor_provides, website, vendor_contact_person)
are only updated if they have a non-empty value.
Records field-level changes in change history, fires automation triggers
(vendor_updated), and sends in-app notifications when assignee or reviewer changes.

## Path parameters

- `id` integer, required

## Request body

- VendorUpdate — All fields are optional. Only provided fields are updated. Review and scorecard fields can be set to null to clear them.
  - `vendor_name` string
  - `vendor_provides` string
  - `assignee` integer
  - `website` string
  - `vendor_contact_person` string
  - `review_result` string, nullable
  - `review_status` 'Not started' | 'In review' | 'Reviewed' | 'Requires follow-up', nullable
  - `reviewer` integer, nullable
  - `review_date` string, date-time, nullable
  - `order_no` integer
  - `projects` integer[]
  - `data_sensitivity` 'None' | 'Internal only' | 'Personally identifiable information (PII)' | 'Financial data' | 'Health data (e.g. HIPAA)' | 'Model weights or AI assets' | 'Other sensitive data', nullable
  - `business_criticality` 'Low (vendor supports non-core functions)' | 'Medium (affects operations but is replaceable)' | 'High (critical to core services or products)', nullable
  - `past_issues` 'None' | 'Minor incident (e.g. small delay, minor bug)' | 'Major incident (e.g. data breach, legal issue)', nullable
  - `regulatory_exposure` 'None' | 'GDPR (EU)' | 'HIPAA (US)' | 'SOC 2' | 'ISO 27001' | 'EU AI act' | 'CCPA (california)' | 'Other', nullable
  - `risk_score` integer, nullable

## Response `202`

Vendor updated successfully

- object
  - `message` string
  - `data` Vendor
    - `id` integer — Auto-generated primary key
    - `order_no` integer, nullable — Display order number
    - `vendor_name` string, required — Name of the vendor
    - `vendor_provides` string, required — What the vendor provides
    - `assignee` integer, required — User ID of the assigned owner
    - `website` string, required — Vendor website URL
    - `vendor_contact_person` string, required — Name of the vendor contact
    - `review_result` string, nullable — Free-text review result summary
    - `review_status` 'Not started' | 'In review' | 'Reviewed' | 'Requires follow-up', nullable — Current review lifecycle status
    - `reviewer` integer, nullable — User ID of the reviewer
    - `review_date` string, date-time, nullable — Date the review was performed (ISO 8601)
    - `is_demo` boolean — Whether this is a demo vendor (read-only after creation)
    - `projects` integer[] — Array of associated project IDs
    - `data_sensitivity` 'None' | 'Internal only' | 'Personally identifiable information (PII)' | 'Financial data' | 'Health data (e.g. HIPAA)' | 'Model weights or AI assets' | 'Other sensitive data', nullable — Scorecard - type of data the vendor accesses
    - `business_criticality` 'Low (vendor supports non-core functions)' | 'Medium (affects operations but is replaceable)' | 'High (critical to core services or products)', nullable — Scorecard - how critical the vendor is to operations
    - `past_issues` 'None' | 'Minor incident (e.g. small delay, minor bug)' | 'Major incident (e.g. data breach, legal issue)', nullable — Scorecard - history of past incidents
    - `regulatory_exposure` 'None' | 'GDPR (EU)' | 'HIPAA (US)' | 'SOC 2' | 'ISO 27001' | 'EU AI act' | 'CCPA (california)' | 'Other', nullable — Scorecard - applicable regulatory framework
    - `risk_score` integer, nullable — Computed risk score for the vendor
    - `created_at` string, date-time — Creation timestamp (ISO 8601)
    - `updated_at` string, date-time — Last update timestamp (ISO 8601)

## Other responses

- `400` — Validation error
- `401` — Unauthorized - missing or invalid JWT, or missing userId/role
- `403` — Business logic error (e.g. demo vendor restriction)
- `404` — Vendor not found
- `500` — Internal server error

---

[API](https://skmtc.net/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.net/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/versions/c764f0a64a5e/schema)