PRODUCT

Vendor Pulse API

Name: Vendor Pulse API
Brand: TrustVendor

Embed live vendor intelligence into Vanta, Drata, Sprinto, or your own product.

What it is

The Vendor Pulse API is the surface that compliance platforms, GRC tools, and procurement applications use to embed TrustVendor's evidence-grade vendor intelligence directly into their products. One resolve call turns a domain name or company name into a canonical vendor identity. One pulse call returns everything needed to render a vendor risk panel: posture score, assurance score, active certifications, open signals by severity, and subprocessor count.

Resolve is intentionally free and unmetered. The first call any integration makes is identity resolution, and any friction there kills the integration before it starts. The API is priced on pulse calls — per resolved vendor per month — so economics align: you pay as your customer base grows and actually queries vendor data, not upfront for a capability you are still building.

Every API response includes evidence links. When a partner surfaces a posture score in their UI, the evidence link goes to the specific artifacts and spans that produced that score. This means your customers can trust the number because they can see exactly where it came from — not a black-box score from an opaque model, but a deterministic computation grounded in named, dated, hash-verified documents.

How it works

Three steps, fully auditable.

Resolve

POST a domain or company name to /v1/vendors/resolve. The resolver returns a canonical vendor_id with confidence score in under 100ms for known vendors. Batch resolution for onboarding an existing book of business accepts up to 1,000 domains in a single call.

Pulse

GET /v1/vendors/{vendor_id}/pulse returns posture score, assurance score, certifications with expiry dates, open signals by severity, and evidence links. New vendors return 202 with a status poll endpoint while enrichment runs — typically 2 to 8 minutes.

Register a webhook for vendor.signal and vendor.score_change events. Your integration receives real-time pushes when something material changes, rather than polling on a schedule that either over-fetches or misses events.

What you get

Built for compliance teams that have to prove things.

Free resolve, metered pulse

Identity resolution is never charged or rate-limited. Pulse calls are priced per resolved vendor per month — $0.40 to $1.20 depending on volume — so your integration costs scale with actual usage.

Webhook-first architecture

Subscribe to vendor.signal and vendor.score_change events. Your customers see changes when they happen, not on your next polling cycle. Webhooks include the full event payload with evidence links.

White-label option

Enterprise API partners can white-label the vendor intelligence layer. Your customers see your brand; TrustVendor operates as infrastructure. Available with a platform partnership agreement.

Sample

What it looks like in practice.

Request

# 1. Resolve a vendor identity
curl -X POST https://api.trustvendor.co/v1/vendors/resolve \
  -H "Authorization: Bearer tv_live_..." \
  -H "Content-Type: application/json" \
  -d '{"domain":"acme.com"}'

# 2. Fetch the live pulse
curl https://api.trustvendor.co/v1/vendors/vnd_8kQ2mR/pulse \
  -H "Authorization: Bearer tv_live_..."

Response

{
  "vendor_id": "vnd_8kQ2mR",
  "posture": {
    "score": 84,
    "band": "strong"
  },
  "assurance": {
    "score": 71,
    "band": "established"
  },
  "certifications": [
    {
      "framework": "SOC2_TYPE2",
      "status": "active",
      "expires": "2026-11-30",
      "evidence_url": "https://..."
    }
  ],
  "open_signals": {"high": 0}
}

Common questions.

How do I get started without committing to a volume contract?

The resolve endpoint is permanently free with no account required. Pulse access starts with a sandbox key that covers 100 pulse calls per month — enough to build and test your integration. Production keys and volume pricing are activated when you are ready to launch.

What does "async by default" mean for new vendors?

When you resolve a vendor that TrustVendor has not yet profiled, the resolve call returns 202 with a status of "enriching" and a job ID. You can poll the status endpoint or register a vendor.ready webhook to be notified when the profile is complete. Enrichment typically takes 2 to 8 minutes for a vendor with a public trust centre.

Is the API versioned?

Yes. The URL carries the major version (/v1). Minor, backwards-compatible changes are announced via the TV-Version header. You can pin to a specific minor version to prevent unexpected response shape changes during your development cycle.

What is included in the evidence links in the API response?

Each certification and signal in the pulse response includes an evidence_url field that links to the specific artifact and claim in the TrustVendor evidence archive. The link is publicly accessible for public-graph data and requires workspace authentication for tenant-uploaded documents.

See Vendor Pulse API on your vendor data.

Book a 30-minute demo. We will run it live on vendors from your register.