Documentation
How VendorLogic works, flow by flow and page by page, for the people who use it and the systems that connect to it.
Flows
How a task goes from start to finish.
- Credit decisionHow a credit manager reviews an application and records a signed approve, decline or counter-offer decision.
- Deleting a workspace or an accountHow owners, staff and members delete a workspace or an account, what is removed at once, what is kept for credit-law retention, and how legal holds work.
Pages
What each screen is for and who can use it.
- Sign in and sign upHow people sign in at /login, why /signup only redirects, and where each role lands afterwards.
- Post-login routingThe /post-login page that decides where a signed-in person goes next, by role and organization.
- Account settingsSettings is one page with tabs for your profile, email, security and data, and, for the people who can use them, the organization, signing terms, the team and workspace deletion.
API and agents
Endpoints, the MCP server and the connect API.
- MCP server for agentsConnect Claude, ChatGPT or Cursor to VendorLogic over remote MCP with OAuth: who may use it, the tools per role, staff proof, audit attribution, rate limits and errors.
- Agent access pageWhere a person finds the MCP address, the tools their assistant gets, and what agents did for them, and what the page can and cannot show about tokens.
- Team and users APIOrganization admins invite and manage teammates; super admins suspend users and revoke sessions.
- Health, status and scheduled jobsLiveness, readiness and public status endpoints, and the jobs the services run on a clock.
Connectors
Documentation each connector writes and serves itself.
Security and data
Access, evidence and how personal data is handled.
- Roles and permissionsHow the API decides: permission keys, the staff-editable role matrix, per-person lists, own or organization scope, the staff flag.
- Audit trail and evidenceWhat is recorded when state changes, how decisions and reference responses stay tamper-evident, and who may read the audit log.
- Personal dataWhere personal data lives, who can read it, what is masked, exported or logged, and the rules new code follows.