Skip to main content
Vendors represent external services and suppliers your organization uses. Each vendor can have one or more risk assessments that capture data sensitivity and business impact.

​
The Vendor object

​
id
string
required
Global ID (GID) of the vendor.
​
organization_id
string
required
GID of the organization this vendor belongs to.
​
name
string
required
Display name of the vendor.
​
description
string | null
Optional description.
​
category
string
required
Vendor category. See the Category enum below.
​
headquarter_address
string | null
Physical address of the vendor’s headquarters.
​
legal_name
string | null
Legal entity name (if different from display name).
​
website_url
string | null
Vendor’s website URL.
​
privacy_policy_url
string | null
URL of the vendor’s privacy policy.
​
service_level_agreement_url
string | null
URL of the service level agreement document.
​
data_processing_agreement_url
string | null
URL of the data processing agreement.
​
business_associate_agreement_url
string | null
URL of the business associate agreement (relevant for HIPAA).
​
subprocessors_list_url
string | null
URL of the vendor’s subprocessors list.
​
certifications
string[]
List of compliance certifications held by the vendor (e.g. "SOC 2 Type II", "ISO 27001").
​
countries
string[]
Countries where the vendor operates or stores data (ISO 3166-1 alpha-2 codes).
​
business_owner_id
string | null
GID of the internal user who owns the business relationship with this vendor.
​
security_owner_id
string | null
GID of the internal user who owns the security review for this vendor.
​
status_page_url
string | null
URL of the vendor’s status page.
​
terms_of_service_url
string | null
URL of the vendor’s terms of service.
​
security_page_url
string | null
URL of the vendor’s security documentation page.
​
trust_page_url
string | null
URL of the vendor’s trust center.
​
created_at
string (date-time)
required
ISO 8601 timestamp of when the vendor was created.
​
updated_at
string (date-time)
required
ISO 8601 timestamp of the last update.

​
Category enum

ValueDescription
ANALYTICSAnalytics and reporting tools
CLOUD_MONITORINGInfrastructure monitoring services
CLOUD_PROVIDERCloud infrastructure providers
COLLABORATIONTeam communication and collaboration
CUSTOMER_SUPPORTCustomer service platforms
DATA_STORAGE_AND_PROCESSINGDatabases and data processing services
DOCUMENT_MANAGEMENTDocument storage and management
EMPLOYEE_MANAGEMENTHR and employee lifecycle tools
ENGINEERINGDeveloper tools and platforms
FINANCEAccounting and financial services
IDENTITY_PROVIDERSSO, directory, and identity services
ITIT management and support tools
MARKETINGMarketing and advertising platforms
OFFICE_OPERATIONSOffice management and facilities
OTHERVendors that don’t fit other categories
PASSWORD_MANAGEMENTPassword managers and secrets tools
PRODUCT_AND_DESIGNProduct management and design tools
PROFESSIONAL_SERVICESConsulting and professional service firms
RECRUITINGRecruiting and applicant tracking systems
SALESCRM and sales tools
SECURITYSecurity tools and services
VERSION_CONTROLSource code and version control systems

​
The VendorRiskAssessment object

​
id
string
required
Global ID (GID) of the risk assessment.
​
organization_id
string
required
GID of the organization.
​
vendor_id
string
required
GID of the vendor this assessment belongs to.
​
data_sensitivity
string
required
The sensitivity of data shared with this vendor. One of: NONE, LOW, MEDIUM, HIGH, CRITICAL.
​
business_impact
string
required
The business impact if this vendor becomes unavailable. One of: LOW, MEDIUM, HIGH, CRITICAL.
​
expires_at
string (date-time)
required
When this risk assessment expires and should be renewed.
​
notes
string | null
Optional notes about this risk assessment.
​
snapshot_id
string | null
GID of the snapshot this assessment belongs to, or null for live data.
​
created_at
string (date-time)
required
ISO 8601 timestamp of when the assessment was created.
​
updated_at
string (date-time)
required
ISO 8601 timestamp of the last update.

​
Operations

​
listVendors

Returns all vendors for the organization. MCP tool: listVendors

​
Parameters

​
organization_id
string
required
GID of the organization.
​
size
integer
Number of results per page.
​
cursor
string
Pagination cursor from a previous response’s next_cursor.
​
order_by
object
​
filter
object

​
Response

​
vendors
Vendor[]
required
Array of vendor objects.
​
next_cursor
string
Cursor for the next page.

​
addVendor

Creates a new vendor. MCP tool: addVendor

​
Parameters

​
organization_id
string
required
GID of the organization.
​
name
string
required
Vendor name.
​
description
string
Optional description.
​
category
string
Vendor category (see Category enum).
​
legal_name
string
Legal entity name.
​
website_url
string
Vendor website.
​
privacy_policy_url
string
Privacy policy URL.
​
service_level_agreement_url
string
SLA document URL.
​
data_processing_agreement_url
string
DPA document URL.
​
business_associate_agreement_url
string
BAA document URL.
​
subprocessors_list_url
string
Subprocessors list URL.
​
certifications
string[]
List of compliance certifications.
​
countries
string[]
Countries of operation (ISO 3166-1 alpha-2).
​
business_owner_id
string
GID of the business owner profile.
​
security_owner_id
string
GID of the security owner profile.
​
status_page_url
string
Status page URL.
​
terms_of_service_url
string
Terms of service URL.
​
security_page_url
string
Security documentation URL.
​
trust_page_url
string
Trust center URL.

​
Response

​
vendor
Vendor
required
The created vendor object.

​
updateVendor

Updates an existing vendor. MCP tool: updateVendor

​
Parameters

​
id
string
required
GID of the vendor to update.
All other fields from addVendor are optional and will only update if provided.

​
Response

​
vendor
Vendor
required
The updated vendor object.

​
deleteVendor

Deletes a vendor. MCP tool: deleteVendor

​
Parameters

​
id
string
required
GID of the vendor to delete.

​
Response

​
deleted_vendor_id
string
required
GID of the deleted vendor.

​
Example

curl -X POST https://your-probo-instance/api/mcp/v1 \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "addVendor",
      "arguments": {
        "organization_id": "gid://probo/Organization/01J5XKZW9QMXP3N6V8HTJA2FKB",
        "name": "AWS",
        "category": "CLOUD_PROVIDER",
        "website_url": "https://aws.amazon.com",
        "certifications": ["SOC 2 Type II", "ISO 27001"],
        "countries": ["US", "IE", "DE"]
      }
    }
  }'

Build docs developers (and LLMs) love

Get started for freeTalk to us