Vendor Pulse API
Ship agent-grade vendor intelligence in your own product — the same claims and citations your workspace uses, available by API.
What it is
Vendor Pulse API — in detail.
The Vendor Pulse API gives GRC platforms, compliance tools, and procurement applications access to the same agent-produced claims and citations the Vendor Risk workspace runs on. One resolve call turns a domain name or company name into a canonical vendor identity. One pulse call returns posture score, assurance score, active certifications, open signals by severity, and evidence links — every field traceable to an agent-produced claim with an artifact ID and a sha256 hash.
Webhooks fire on agent-produced events: vendor.ready when the Extractor agent finishes profiling a new vendor, score.changed when a score computation runs after new claims land, signal.raised when the Triage agent marks a change as material. Your integration receives the full event payload including claim_ids and evidence_ids — so your customers can click through to the same span-level evidence the workspace shows.
Resolve is permanently free and unmetered. Pulse calls are priced per resolved vendor per month so your integration costs scale with actual usage. Enterprise partners can white-label the entire intelligence layer — no TrustVendor branding, custom domain for snapshot links, and the full agent pipeline operating as invisible infrastructure behind your product.
How it works
Three steps,
fully auditable.
POST a domain or company name to /v1/vendors/resolve. The Resolver agent returns a canonical vendor_id with confidence score in under 100ms for known vendors. Batch resolution for onboarding an existing book of business accepts up to 1,000 domains in a single call.
GET /v1/vendors/{vendor_id}/pulse returns posture score, assurance score, certifications with expiry dates, open signals by severity, and evidence links. Every score and certification links to the agent-produced claim that backs it. New vendors return 202 with a status poll endpoint while the Extractor agent runs — typically 2 to 8 minutes.
Register a webhook for agent-produced events: vendor.ready, score.changed, signal.raised, certification.expiring, subprocessor.changed. Your integration receives real-time pushes with claim_ids and evidence_ids attached — no polling, no stale data.
What you get
Built for teams that
have to prove things.
Free resolve, metered pulse
Identity resolution is never charged or rate-limited. Pulse calls are priced per resolved vendor per month — $0.40 to $1.20 depending on volume — so your integration costs scale with actual usage.
Webhook-first, agent-event-driven
Webhooks fire on agent-produced events with claim_ids and evidence_ids in the payload. Your customers see changes when agents detect them, not on your next polling cycle.
White-label option
Enterprise API partners can white-label the full agent intelligence layer. Your customers see your brand; TrustVendor operates as infrastructure. Available with a platform partnership agreement.
What the agents will never do
Agent guarantees,
in plain terms.
Agents produce claims, never numbers. Scoring is deterministic Go arithmetic over those claims — models never run in the scoring path.
Every claim cites a hashed, immutable snapshot span. No claim is written to the database without an artifact_id and a validated quote hash.
Extractor agents are prompt-versioned. Every claim records the prompt file, model, and schema version that produced it. A regression is a rollback, not a data loss.
The Analyst agent's system prompt forbids it from asserting a fact it cannot cite. Warnings surface in the response envelope when tool results are incomplete — the answer is never silently filtered.
Sample
What it looks
like in practice.
Request
# 1. Resolve a vendor identity
curl -X POST https://api.trustvendor.co/v1/vendors/resolve \
-H "Authorization: Bearer tv_live_..." \
-H "Content-Type: application/json" \
-d '{"domain":"acme.com"}'
# 2. Fetch the live pulse
curl https://api.trustvendor.co/v1/vendors/vnd_8kQ2mR/pulse \
-H "Authorization: Bearer tv_live_..."Response
{
"vendor_id": "vnd_8kQ2mR",
"posture": {
"score": 84,
"band": "strong"
},
"assurance": {
"score": 71,
"band": "established"
},
"certifications": [
{
"framework": "SOC2_TYPE2",
"status": "active",
"expires": "2026-11-30",
"evidence_url": "https://..."
}
],
"open_signals": {"high": 0}
}Common questions
Answered plainly.
How do I get started without committing to a volume contract?
What does "async by default" mean for new vendors?
Is the API versioned?
What is included in the evidence links in the API response?
Which model tier runs which extraction?
See it live
Vendor Pulse API
on your vendors.
Book a 30-minute demo. We’ll run it live on vendors from your register — not demo data.