> ## Documentation Index
> Fetch the complete documentation index at: https://www.trycomp.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update vendor record | Comp AI API

> Update vendor ownership, risk attributes, review metadata, and third-party compliance context for an organization.



## OpenAPI

````yaml /openapi.json patch /v1/vendors/{id}
openapi: 3.0.0
info:
  title: Comp AI API
  description: >-
    Compliance automation API for SOC 2, ISO 27001, HIPAA, GDPR, evidence
    collection, policy workflows, Trust Access, security questionnaires,
    integrations, cloud checks, and device compliance.
  version: '1.0'
  contact: {}
servers:
  - url: https://api.trycomp.ai
    description: Production API Server
security: []
tags:
  - name: Attachments
    description: >-
      Generate signed download links for files attached to compliance tasks,
      comments, evidence records, and workflow reviews.
  - name: Audit Logs
    description: >-
      Retrieve audit trails for compliance activity, evidence changes, access
      decisions, and customer-facing security review workflows.
  - name: CloudSecurity
    description: >-
      Run AWS, Azure, and GCP cloud security scans, detect enabled services,
      review findings, and connect cloud posture results to compliance work.
    x-group: Cloud Security
  - name: Comments
    description: >-
      Create and manage collaboration comments on compliance entities such as
      tasks, policies, risks, vendors, and findings.
  - name: Context
    description: >-
      Manage organization context that helps Comp AI tailor policies,
      assessments, and compliance automation to the business.
  - name: Controls
    description: >-
      Manage controls, map them to policies, tasks, framework requirements, and
      evidence document types, and track implementation progress.
  - name: Device Agent
    description: >-
      Register employee devices, submit device compliance check-ins, download
      agent builds, and manage endpoint security status.
  - name: Devices
    description: >-
      Read and manage employee device inventory and Fleet compliance data used
      for endpoint security controls.
  - name: Evidence Export
    description: >-
      Export task evidence, automation evidence, and reviewer-ready evidence
      bundles as PDF or ZIP files.
  - name: Evidence Export (Auditor)
    description: Export all organization evidence for an auditor review package.
  - name: Evidence Forms
    description: >-
      Collect, review, upload, and export structured evidence submissions for
      compliance tasks and document requirements.
  - name: Findings
    description: >-
      Create, review, update, and track audit findings, remediation activity,
      and finding history for an organization.
  - name: Frameworks
    description: >-
      Manage SOC 2, ISO 27001, HIPAA, GDPR, and custom framework instances,
      requirements, scores, and sync history.
  - name: ISMS
  - name: Integrations
    description: >-
      Connect vendor systems, configure OAuth apps, run compliance checks, sync
      employees, manage variables, and collect automated evidence.
  - name: Knowledge Base
    description: >-
      Upload source documents, process them for retrieval, and manage reusable
      manual answers that power questionnaires and AI policy workflows.
  - name: Offboarding Checklist
  - name: Org Chart
    description: >-
      Manage organization chart metadata and evidence used for governance,
      accountability, and audit readiness.
  - name: Organization
    description: >-
      Manage organization profile data, API keys, logos, ownership, role
      notifications, and access approval settings.
  - name: People
    description: >-
      Invite and manage workforce members, training status, device compliance,
      email preferences, and employee evidence records.
  - name: Policies
    description: >-
      Create, version, publish, export, map, and improve compliance policies
      with AI-assisted drafting and approval workflows.
  - name: Questionnaire
    description: >-
      Parse security questionnaires, generate answers from approved evidence,
      save reviewer edits, stream progress, and export completed files.
  - name: Risks
    description: >-
      Create, update, and report on organizational risks with ownership,
      departments, and compliance remediation status.
  - name: Roles
    description: >-
      Create custom roles and resolve permission sets for organization-level
      access control.
  - name: SOA
    description: >-
      Create, auto-fill, review, approve, and export ISO 27001 Statement of
      Applicability documents.
    x-group: Statement of Applicability
  - name: Security Penetration Tests
    description: >-
      Create AI-powered penetration test runs, track progress, inspect findings
      and events, and download markdown or PDF reports.
  - name: Task Automations
    description: >-
      Create, version, run, and inspect automated evidence collection workflows
      attached to compliance tasks.
  - name: Task Management
    description: >-
      Manage task items and attachments linked to operational entities such as
      risks and vendors.
  - name: Tasks
    description: >-
      Manage compliance task lifecycle, assignments, review approvals, evidence
      uploads, policy links, and activity history.
  - name: Timelines
    description: >-
      Track audit and compliance readiness timelines, phases, and review
      milestones for an organization.
  - name: Training
    description: >-
      Record security awareness and HIPAA training completion status and
      generate completion certificates.
  - name: Trust Access
    description: >-
      Manage external Trust Center access requests, NDA signing, grants,
      tokenized document downloads, public FAQs, and reviewer access.
  - name: Trust Portal
    description: >-
      Configure the live Trust Center, custom domain, public overview, FAQs,
      compliance resources, documents, links, and vendor disclosures.
  - name: Uploads
  - name: Vendors
    description: >-
      Manage third-party vendors, global vendor search, risk assessment
      triggers, and Trust Center vendor visibility.
paths:
  /v1/vendors/{id}:
    patch:
      tags:
        - Vendors
      summary: Update vendor record
      description: >-
        Update vendor ownership, risk attributes, review metadata, and
        third-party compliance context for an organization.
      operationId: VendorsController_updateVendor_v1
      parameters:
        - name: id
          required: true
          in: path
          description: Vendor ID
          schema:
            example: vnd_abc123def456
            type: string
      requestBody:
        required: true
        description: Vendor update data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateVendorDto'
      responses:
        '200':
          description: Vendor updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Vendor ID
                    example: vnd_abc123def456
                  name:
                    type: string
                    description: Vendor name
                    example: CloudTech Solutions Inc.
                  description:
                    type: string
                    description: Vendor description
                    example: >-
                      Cloud infrastructure provider offering AWS-like services
                      including compute, storage, and networking solutions for
                      enterprise customers.
                  category:
                    type: string
                    enum:
                      - cloud
                      - infrastructure
                      - software_as_a_service
                      - finance
                      - marketing
                      - sales
                      - hr
                      - other
                    example: cloud
                  status:
                    type: string
                    enum:
                      - not_assessed
                      - in_progress
                      - assessed
                    example: assessed
                  inherentProbability:
                    type: string
                    enum:
                      - very_unlikely
                      - unlikely
                      - possible
                      - likely
                      - very_likely
                    example: possible
                  inherentImpact:
                    type: string
                    enum:
                      - insignificant
                      - minor
                      - moderate
                      - major
                      - severe
                    example: moderate
                  residualProbability:
                    type: string
                    enum:
                      - very_unlikely
                      - unlikely
                      - possible
                      - likely
                      - very_likely
                    example: unlikely
                  residualImpact:
                    type: string
                    enum:
                      - insignificant
                      - minor
                      - moderate
                      - major
                      - severe
                    example: minor
                  website:
                    type: string
                    nullable: true
                    example: https://www.cloudtechsolutions.com
                  organizationId:
                    type: string
                    example: org_abc123def456
                  assigneeId:
                    type: string
                    nullable: true
                    description: ID of the user assigned to manage this vendor
                    example: mem_abc123def456
                  createdAt:
                    type: string
                    format: date-time
                    description: When the vendor was created
                  updatedAt:
                    type: string
                    format: date-time
                    description: When the vendor was last updated
                  authType:
                    type: string
                    enum:
                      - api-key
                      - session
                    description: How the request was authenticated
                  authenticatedUser:
                    type: object
                    description: User information (only for session auth)
                    properties:
                      id:
                        type: string
                        example: usr_def456ghi789
                      email:
                        type: string
                        example: user@example.com
        '400':
          description: Bad request - Invalid input data
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: array
                    items:
                      type: string
                    example:
                      - name should not be empty
                      - category must be a valid enum value
                      - status must be a valid enum value
                      - website must be a URL address
                  error:
                    type: string
                    example: Bad Request
                  statusCode:
                    type: number
                    example: 400
        '401':
          description: Unauthorized - Invalid authentication or insufficient permissions
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: Invalid or expired API key
        '404':
          description: Vendor not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: >-
                      Vendor with ID vnd_abc123def456 not found in organization
                      org_abc123def456
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: Internal server error
      security:
        - apikey: []
components:
  schemas:
    UpdateVendorDto:
      type: object
      properties:
        name:
          type: string
          description: Vendor name
        description:
          type: string
          description: Vendor description
        category:
          type: string
          description: Vendor category
          enum:
            - cloud
            - infrastructure
            - software_as_a_service
            - finance
            - marketing
            - sales
            - hr
            - other
        status:
          type: string
          description: Assessment status
          enum:
            - not_assessed
            - in_progress
            - assessed
        inherentProbability:
          type: string
          description: Inherent probability
          enum:
            - very_unlikely
            - unlikely
            - possible
            - likely
            - very_likely
        inherentImpact:
          type: string
          description: Inherent impact
          enum:
            - insignificant
            - minor
            - moderate
            - major
            - severe
        residualProbability:
          type: string
          description: Residual probability
          enum:
            - very_unlikely
            - unlikely
            - possible
            - likely
            - very_likely
        residualImpact:
          type: string
          description: Residual impact
          enum:
            - insignificant
            - minor
            - moderate
            - major
            - severe
        treatmentStrategy:
          type: string
          description: Risk treatment strategy
          enum:
            - accept
            - avoid
            - mitigate
            - transfer
          default: accept
          example: mitigate
        treatmentStrategyDescription:
          type: object
          description: Description of the treatment strategy
          example: We isolated the vendor to a dedicated VPC.
        website:
          type: string
          description: Vendor website URL
        isSubProcessor:
          type: boolean
          description: Whether the vendor is a sub-processor
        assigneeId:
          type: string
          description: Assignee member ID
  securitySchemes:
    apikey:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for authentication

````