{"openapi":"3.1.0","info":{"title":"VendorRisk API","version":"0.1.0","description":"A fully local vendor/third-party-risk-assessment toolkit: a five-category risk framework (financial stability, data security, compliance, business continuity, reputational), a genuine weighted composite risk-scoring calculator with tiering, and a risk-tier-to-due-diligence-depth escalation mapping.\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://vendorrisk.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"hr@unifydynamics.com","url":"https://connectorbay.com/vendorrisk/docs"},"termsOfService":"https://connectorbay.com/vendorrisk/terms"},"servers":[{"url":"https://vendorrisk.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/vendorrisk/docs"},"security":[{},{"bearer":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/risk_category_reference":{"post":{"operationId":"risk_category_reference","summary":"Explains the five-category vendor-risk framework -- each category's scoring weight, what it measures,","description":"Explains the five-category vendor-risk framework -- each category's scoring weight, what it measures,\n    and example red-flag indicators. Use for \"what categories should I assess a vendor's risk on\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"category":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"One of: financial_stability, data_security, compliance_regulatory, business_continuity, reputational. Omit to list all five.","title":"Category"}},"title":"risk_category_referenceArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/vendor_risk_score":{"post":{"operationId":"vendor_risk_score","summary":"Computes the real weighted composite vendor-risk score (financial 25%, data security 30%, compliance","description":"Computes the real weighted composite vendor-risk score (financial 25%, data security 30%, compliance\n    20%, continuity 15%, reputational 10% of the 1-5 scale) and the resulting tier: critical (>=4.0), high\n    (>=3.0), medium (>=2.0), or low (<2.0). Use for \"rate this vendor 2/4/3/2/1 across the five categories and\n    tell me the risk tier\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"financial_stability":{"description":"1 (lowest risk) to 5 (highest risk).","maximum":5,"minimum":1,"title":"Financial Stability","type":"number"},"data_security":{"description":"1 (lowest risk) to 5 (highest risk).","maximum":5,"minimum":1,"title":"Data Security","type":"number"},"compliance_regulatory":{"description":"1 (lowest risk) to 5 (highest risk).","maximum":5,"minimum":1,"title":"Compliance Regulatory","type":"number"},"business_continuity":{"description":"1 (lowest risk) to 5 (highest risk).","maximum":5,"minimum":1,"title":"Business Continuity","type":"number"},"reputational":{"description":"1 (lowest risk) to 5 (highest risk).","maximum":5,"minimum":1,"title":"Reputational","type":"number"}},"required":["financial_stability","data_security","compliance_regulatory","business_continuity","reputational"],"title":"vendor_risk_scoreArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/due_diligence_depth":{"post":{"operationId":"due_diligence_depth","summary":"Maps a vendor-risk tier to the depth of due diligence it warrants -- required documents/audits and","description":"Maps a vendor-risk tier to the depth of due diligence it warrants -- required documents/audits and\n    reassessment frequency -- with depth increasing monotonically as risk rises from low to critical. Use for\n    \"how much due diligence does a high-risk vendor need\", \"what's the reassessment schedule for a critical vendor\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"tier":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"critical | high | medium | low. Omit to see the full escalation mapping.","title":"Tier"}},"title":"due_diligence_depthArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/vendor_risk_glossary":{"post":{"operationId":"vendor_risk_glossary","summary":"Definitions of third-party-risk-management terms: inherent risk, residual risk, SOC 2 report,","description":"Definitions of third-party-risk-management terms: inherent risk, residual risk, SOC 2 report,\n    concentration risk, fourth-party risk, right-to-audit clause, vendor tiering. Use for \"what's the\n    difference between inherent and residual risk\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"term":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null,"description":"A specific term to look up; omit to list all.","title":"Term"}},"title":"vendor_risk_glossaryArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}