VendorLens API

Register once to get a token, then send it on every call. The token is your API key; screens are metered per account (3 free, unlimited on Pro or a Team plan).

curl -X POST https://getvendorlens.com/api/register \
  -H "Content-Type: application/json" \
  -d '{"email":"you@company.com"}'
# → { "token": "..." }

Rate limit: 20 requests / 60 seconds per IP (HTTP 429 on excess). Use your individual work email; shared or role mailboxes are not accepted.

curl -X POST https://getvendorlens.com/api/screen \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "vendors": [ {"name":"Salesforce","domain":"salesforce.com"},
                 {"name":"HubSpot","domain":"hubspot.com"} ],
    "mode": "standard",
    "industry": "software",
    "risk": { "tier": 2, "scores": [2,1,1] }
  }'

1 to 5 vendors per call. Add ?stream=1 for NDJSON (one line per vendor as it completes, then a done line). mode:"ai" runs the AI deep scan (models, data use, governance).

Each vendor returns tprm (likelihood, confidence, band) and a signals object: FedRAMP, CSA STAR, Common Criteria, NAID AAA, OFAC/CSL sanctions, GLEIF legal entity, domain legitimacy, DNS security posture, breaches/KEV, legal, compliance claims, data protection, pricing, and the AI profile. Every signal carries a status, plain-language detail, and a source URL so each fact is independently checkable in your assessment record.

Generate an RFP in the app, then use the .json button for a machine-readable document your system can store or transform (the app's own Word export renders from the same model):

{ "schema": "vendorlens.rfp.v1",
  "vendor": { "name": "Salesforce", "host": "salesforce.com" },
  "blocks": [ { "t": "h1", "text": "1. Introduction & Background" },
              { "t": "p",  "text": "..." },
              { "t": "table", "header": true, "rows": [["Criterion","Weight"], ["..."]] } ] }

Block types: title · subtitle · h1 · h2 · p · note · ul · table · toc · pagebreak. Rendering blocks in order reproduces the document. Word (.docx), Markdown, and CSV exports are also available in the app.

When a business user picks the vendor to move forward with, the Hand off to procurement action produces an internal request (distinct from the vendor-facing RFP) to kick off a sourcing / procurement / TPRM intake. The .json button emits a flat, stable payload for API import; the same data is available as a one-row CSV intake record, a Word (.docx) brief, and a pre-filled email:

{ "schema": "vendorlens.handoff.v1",
  "requestor": { "name": "...", "department": "..." },
  "request": { "action": "Initiate sourcing / procurement / third-party-risk process",
               "businessNeed": "...", "targetDate": "...", "estimatedBudget": "..." },
  "recommendedVendor": { "name": "Datadog", "domain": "datadoghq.com",
    "category": "...", "hqJurisdiction": "US", "legalEntity": "DATADOG, INC.",
    "verdict": { "band": "Likely to clear", "likelihoodToClearPct": 90, "confidence": "Strong" },
    "estimatedCost": { "tier": "$$$", "basis": "usage-based" },
    "inherentRisk": { "tier": 2, "label": "Elevated" } },
  "evidence": { "verifiedPublic": ["FedRAMP authorized ...", "..."], "toRequestAndVerify": ["SOC 2 Type II", "..."] },
  "alternativesConsidered": [ { "name": "New Relic", "domain": "newrelic.com", "verdict": "...", "confidence": "...", "estCost": "..." } ] }

The flat shape maps directly onto an intake / vendor-request record. Map recommendedVendor.* to the supplier fields, inherentRisk to the risk tier, and evidence.toRequestAndVerify to the diligence checklist. All handoff outputs are generated client-side (the email opens the user's own mail app) — nothing is sent to a server.

• GRC / TPRM (OneTrust, ProcessUnity, ServiceNow VRM, Archer): call /api/screen from the platform's custom-connector framework at vendor intake; map signals.* to evidence fields; attach the RFP to the engagement.
• Procurement (Coupa, Ariba, Jaggaer): screen at sourcing-event creation; store the RFP .docx as the event document; use tprm.likelihood as a supplier-qualification input.
• Intake / sourcing requests (Zip, ServiceNow, Coupa intake, shared inboxes): a business user forwards the vendorlens.handoff.v1 request (email, CSV, JSON, or .docx) to open a sourcing / vendor-request record.
• Scripts / spreadsheets: the in-app CSV exports (screen results and the handoff intake record) mirror the data without an API.

Other endpoints: POST /api/discover (shortlist vendors for a need), GET /api/account, GET /api/industries, GET /api/categories.