---
title: "Create a vendor"
method: POST
path: "/vendors"
tags: ["Vendors"]
---

# Create a vendor

`POST /vendors`

Creates a new vendor in the authenticated user's organization.
Validates required fields, checks demo restrictions, associates
projects via the vendors_projects join table, records creation
in change history, fires automation triggers (vendor_added),
and sends in-app assignment notifications to assignee and reviewer.

## Request body

- VendorInput
  - `vendor_name` string, required — Name of the vendor (required, non-empty)
  - `vendor_provides` string, required — What the vendor provides (required, non-empty)
  - `assignee` integer, required — User ID of the assigned owner (required, >= 1)
  - `website` string, required — Vendor website URL (required, non-empty)
  - `vendor_contact_person` string, required — Name of the vendor contact (required, non-empty)
  - `review_result` string — Free-text review result summary
  - `review_status` 'Not started' | 'In review' | 'Reviewed' | 'Requires follow-up' — Current review lifecycle status
  - `reviewer` integer — User ID of the reviewer
  - `review_date` string, date-time — Date of the review (ISO 8601)
  - `order_no` integer — Display order number
  - `is_demo` boolean — Mark as demo vendor
  - `projects` integer[] — Array of project IDs to associate
  - `data_sensitivity` 'None' | 'Internal only' | 'Personally identifiable information (PII)' | 'Financial data' | 'Health data (e.g. HIPAA)' | 'Model weights or AI assets' | 'Other sensitive data'
  - `business_criticality` 'Low (vendor supports non-core functions)' | 'Medium (affects operations but is replaceable)' | 'High (critical to core services or products)'
  - `past_issues` 'None' | 'Minor incident (e.g. small delay, minor bug)' | 'Major incident (e.g. data breach, legal issue)'
  - `regulatory_exposure` 'None' | 'GDPR (EU)' | 'HIPAA (US)' | 'SOC 2' | 'ISO 27001' | 'EU AI act' | 'CCPA (california)' | 'Other'
  - `risk_score` integer — Computed risk score

## Response `201`

Vendor created successfully

- object
  - `message` string
  - `data` Vendor
    - `id` integer — Auto-generated primary key
    - `order_no` integer, nullable — Display order number
    - `vendor_name` string, required — Name of the vendor
    - `vendor_provides` string, required — What the vendor provides
    - `assignee` integer, required — User ID of the assigned owner
    - `website` string, required — Vendor website URL
    - `vendor_contact_person` string, required — Name of the vendor contact
    - `review_result` string, nullable — Free-text review result summary
    - `review_status` 'Not started' | 'In review' | 'Reviewed' | 'Requires follow-up', nullable — Current review lifecycle status
    - `reviewer` integer, nullable — User ID of the reviewer
    - `review_date` string, date-time, nullable — Date the review was performed (ISO 8601)
    - `is_demo` boolean — Whether this is a demo vendor (read-only after creation)
    - `projects` integer[] — Array of associated project IDs
    - `data_sensitivity` 'None' | 'Internal only' | 'Personally identifiable information (PII)' | 'Financial data' | 'Health data (e.g. HIPAA)' | 'Model weights or AI assets' | 'Other sensitive data', nullable — Scorecard - type of data the vendor accesses
    - `business_criticality` 'Low (vendor supports non-core functions)' | 'Medium (affects operations but is replaceable)' | 'High (critical to core services or products)', nullable — Scorecard - how critical the vendor is to operations
    - `past_issues` 'None' | 'Minor incident (e.g. small delay, minor bug)' | 'Major incident (e.g. data breach, legal issue)', nullable — Scorecard - history of past incidents
    - `regulatory_exposure` 'None' | 'GDPR (EU)' | 'HIPAA (US)' | 'SOC 2' | 'ISO 27001' | 'EU AI act' | 'CCPA (california)' | 'Other', nullable — Scorecard - applicable regulatory framework
    - `risk_score` integer, nullable — Computed risk score for the vendor
    - `created_at` string, date-time — Creation timestamp (ISO 8601)
    - `updated_at` string, date-time — Last update timestamp (ISO 8601)

## Other responses

- `400` — Validation error (missing or invalid required fields)
- `401` — Unauthorized - missing or invalid JWT
- `403` — Business logic error (e.g. demo vendor restriction)
- `500` — Internal server error
- `503` — Service unavailable - vendor creation returned null

---

[API](https://skmtc.net/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.net/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/versions/c764f0a64a5e/schema)