Documentation
How VendorLogic works, flow by flow and page by page, for the people who use it and the systems that connect to it.
Flows
How a task goes from start to finish.
API and agents
Endpoints, the MCP server and the connect API.
- Session and shell APIHow the web app learns who is calling, the shell data per workspace, and the public apply context.
- Onboarding steps and gatesThe ordered "Finish setting up" steps for a customer or supplier business, how each is derived, and which actions wait for which step.
- MCP server for agentsConnect Claude, ChatGPT or Cursor to VendorLogic over remote MCP with OAuth: who may use it, the tools per role, staff proof, audit attribution, rate limits and errors.
- Agent access pageWhere a person finds the MCP address, the tools their assistant gets, and what agents did for them, and what the page can and cannot show about tokens.
- Applications and credit decisions APISubmit a signed credit application (public) and record, list and read credit decisions (credit team): routes, who may call, validation, errors.
- References APIAdd, correct and remind trade references (applicant and credit team), answer by private link (public), and the reference portal reads.
- Signatures APISend a credit agreement or personal guaranty for signature, sign it on an emailed link, and read the sealed copy: routes, states, permissions, errors.
- Profile and account APIRead and edit your profile, business details and saved signature, and download your personal data.
- Team and users APIOrganization admins invite and manage teammates; super admins suspend users and revoke sessions.
- Organizations and membershipsOne person can belong to several organizations with a separate role in each; switching, invitations, leaving and the single sign-on rule.
- CSV exports APICredit teams download their organization's applications and references as CSV.
- Business verification (KYB)How an organization administrator verifies the business with Didit, and how the signed webhook moves the status.
- Documents APIUpload, download and remove application documents, for signed-in users and for references with a private link.
- Messages and notifications APIApplication messages between supplier, applicant and reference, the inbox, and the notification bell.
- Invitations APICustomers invite their suppliers, suppliers invite customers, and an invited business accepts.
- Search and sales QR link APIThe command-palette search and the personal sales-rep application link.
- Customer (applicant) read APIRead endpoints behind the customer workspace: dashboard, application detail, messages, references and settings.
- Application drafts APISave and resume an unsent credit application across devices; one sealed draft per signed-in customer and application form, kept 30 days.
- Supplier workspace read APIRead endpoints behind the supplier (credit team) pages: pipeline, application detail, references, messages, builder, team overview, QR and invite.
- Supplier listing APIRead and save the optional tagline and rich text a supplier shows to customers in the Find vendors marketplace.
- Contact and feedback APIThe public contact form and the in-app feedback form.
- Supplier terms APIWrite, preview, publish and retire the terms of sale and guaranty wording a supplier sends with its credit agreements.
- Supplier finder APISearch for businesses, enrich a website, and start an application with a participating supplier.
- AI assist APIPipeline and reference summaries, application assist drafts, and public scan-to-fill, all through the configured model gateway.
- Forms APISuppliers design and publish forms with an assistant, ask an applicant to fill one in on an application, and read the submitted answers.
- Health, status and scheduled jobsLiveness, readiness and public status endpoints, and the jobs the services run on a clock.
Connectors
Documentation each connector writes and serves itself.
- Connectors, marketplace and inbound emailHow connectors are listed, installed and reviewed, the one inbound-email interface every mail connector uses, and how official connectors register themselves.
- Connector documentation contractHow a connector publishes its own docs, how core fetches and caches them, and who can read them.
- Connector SDKThe package a connector backend uses to reach core, and to serve its own documentation.
Security and data
Access, evidence and how personal data is handled.
- Roles and permissionsHow the API decides: permission keys, the staff-editable role matrix, per-person lists, own or organization scope, the staff flag.
- Audit trail and evidenceWhat is recorded when state changes, how decisions and reference responses stay tamper-evident, and who may read the audit log.
- API response headers and outbound request guardThe security headers every API answer carries, and the guard that stops the API calling private addresses on behalf of a user-supplied URL.
- Personal dataWhere personal data lives, who can read it, what is masked, exported or logged, and the rules new code follows.
- Assign roles from your identity providerHow a vendor's IT admin makes company SSO users Owner, Administrator, Credit Manager or Salesman by putting them in groups in authentik (or any OIDC provider) and mapping the groups in WorkOS.