Projects
List project vendors
Last updated 21 October 2026
/v1/projects/{projectId}/vendorsAuthentication
- bearerAuth
bearerAuth: http / bearer — Use an Inth API key or OAuth access token in the Authorization header. Product operations need a capability. Feedback intake only requires authentication. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (`organizations.read`, `projects.read`, `projects.write`, `api-keys.read`, `inbox.read`, `billing.read`), so writes that name the person who made them, such as `inbox.write` and `vendors.write`, need a user token. A credential without the capability an operation needs is answered with `403 INSUFFICIENT_SCOPE`. `GET /v1/me` reports the capabilities of the calling credential. OAuth scopes: - `organizations.read`: List the organizations you belong to. - `organizations.write`: Create organizations you will own. - `projects.read`: Read projects, their consent configuration, and the vendors seen on them. - `projects.write`: Create, update, and delete projects and their consent configuration. - `members.read`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - `members.write`: Invite members, change member roles, remove members, and cancel invitations. - `api-keys.read`: List organization API keys. - `api-keys.write`: Create, roll, and delete organization API keys. - `code-audit.read`: Read Code Audit scans, their findings, and connected repositories. - `code-audit.write`: Start Code Audit scans and unlock their reports. - `inbox.read`: Read Inbox findings. - `inbox.write`: Change the status of Inbox findings and open GitHub issues for them. - `vendors.write`: Approve or ignore vendors detected on your projects, which resolves their Inbox findings. - `billing.read`: Read the plan and credit balance of an organization.
Request
Path Parameters
| Name | Type | Required | Description |
|---|---|---|---|
projectId | string | Required | Project ID. |
Query Parameters
| Name | Type | Required | Description |
|---|---|---|---|
state | "active" | "not_seen_recently" | "ignored" | "approved" | "blocked" | Optional | Only vendors in this state. |
limit | integer | Required | Page size, between 1 and 100. |
cursor | string | Optional | Opaque cursor from the previous page’s pagination.nextCursor. |
Responses
200
Vendors seen on the project.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
data | object[] | Required | — |
data[].categorySource | "global_default" | "identifier_default" | "project_override" | "scan_inferred" | "ai_suggested" | null | Required | — |
data[].consentCategory | string | null | Required | — |
data[].description | string | null | Required | — |
data[].domains | string[] | Required | — |
data[].firstSeenAt | string (date-time) | Required | — |
data[].homepageUrl | string | null | Required | — |
data[].id | string | Required | Vendor ID. Pass it to GET /v1/projects/{projectId}/vendors/{vendorId}. |
data[].lastSeenAt | string (date-time) | Required | — |
data[].legalName | string | null | Required | — |
data[].name | string | Required | — |
data[].privacyPolicyUrl | string | null | Required | — |
data[].projectId | string | Required | — |
data[].reviewState | "accepted" | "suggested" | "rejected" | "needs_review" | Required | — |
data[].slug | string | Required | — |
data[].sources | "runtime" | "web_scan" | "code_scan"[] | Required | — |
data[].state | "active" | "not_seen_recently" | "ignored" | "approved" | "blocked" | null | Required | — |
pagination | object | Required | — |
pagination.nextCursor | string | null | Required | — |
pagination.hasMore | boolean | Required | — |
View JSON schema
400
The request payload or parameters are invalid.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
401
Authentication is missing, invalid, or expired.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
403
The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
Headers
| Name | Type | Description |
|---|---|---|
WWW-Authenticate | string | Present on `INSUFFICIENT_SCOPE`: `Bearer error="insufficient_scope", scope="<required scope>"`. |
404
The requested resource was not found.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
429
The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
500
An unexpected internal error occurred.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
503
The capability is temporarily paused by an operator. Retry later.
Content type application/json
| Property | Type | Required | Description |
|---|---|---|---|
success | boolean | Required | — |
error | object | Required | — |
error.code | "UNAUTHORIZED" | "FORBIDDEN" | "INSUFFICIENT_SCOPE" | "PLAN_LIMIT_REACHED" | "PLAN_REQUIRED" | "INVALID_ORIGIN" | "INVALID_REGION" | "INVALID_PAYLOAD" | "NOT_FOUND" | "CONFLICT" | "KEY_LIMIT_REACHED" | "INSUFFICIENT_CREDITS" | "SCAN_IN_PROGRESS" | "UNLOCK_REQUIRED" | "REPOSITORY_NOT_LINKED" | "PAYLOAD_TOO_LARGE" | "RATE_LIMITED" | "SERVICE_UNAVAILABLE" | "INTERNAL_ERROR" | Required | — |
error.message | string | Required | — |
error.details | unknown | Optional | Optional structured error details. |
View JSON schema
Related
- REST API overview: Every operation in this API.