Vendor Criteria

Vendor Criteria are the reusable assessment criteria evaluated during a Vendor Security Review. Each criterion carries a type, a severity, the vendor types it applies to (empty means all), and an optional questionnaire file.

List Vendor Criteria

Find vendor assessment criteria matching the provided filters.

🔒 Requires Vendors: List Vendor Criteria permission.

💎 Requires your account have the TPRM Agentic Assessment, AI Data Share feature. Contact your Account Manager for help upgrading.

Securitybearer or oauth2
Request
query Parameters
cursor
string

This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results

size
number [ 1 .. 500 ]
Default: 50

Number of results to return

sort
string (SortTypeLimitedEnum)

Which field to sort by

Enum: "createdAt" "updatedAt"
sortDir
string (SortDirectionEnum)

The direction to sort the data

Enum: "ASC" "DESC"
includeTotalCount
boolean

Include total count of all matching records in response. Only honored on first page (when cursor is null).

Example: includeTotalCount=false
name
string

Filters by name prefix match: returns rows whose name starts with this text.

Example: name=security
impactLevels[]
Array of strings (VendorImpactLevelLabelsEnum)

Filter Criteria by impact level. Accepts: INSIGNIFICANT, MINOR, MODERATE, MAJOR, CRITICAL, UNSCORED.

Items Enum: "INSIGNIFICANT" "MINOR" "MODERATE" "MAJOR" "CRITICAL" "UNSCORED"
vendorRiskLevelIds[]
Array of numbers <= 300 items

Filter Criteria by Vendor Risk Level ID

Example: vendorRiskLevelIds[]=1&vendorRiskLevelIds[]=2
vendorTypeIds[]
Array of numbers <= 300 items

Filter Criteria by Vendor Type ID

Example: vendorTypeIds[]=1&vendorTypeIds[]=2
isDraft
boolean

Filter Criteria by draft status

Example: isDraft=false
securityReviewId
number

Filter Criteria by Security Review ID: returns the Criteria selected for this Security Review. When none have been selected, returns the Criteria the review will assess, chosen from the Vendor's impact level, risk level and Vendor Type; those are always published, so pairing this with isDraft=true returns no rows. Returns 404 when the Security Review does not exist.

Example: securityReviewId=123
criterionTypes[]
Array of strings (VendorAssessmentCriterionTypeEnum)

Filter Criteria by type. Accepts: CUSTOM, DEFAULT, AI_GENERATED.

Items Enum: "CUSTOM" "DEFAULT" "AI_GENERATED"
severities[]
Array of strings (VendorAssessmentCriterionSeverityEnum)

Filter Criteria by severity. Accepts: LOW, MEDIUM, HIGH.

Items Enum: "LOW" "MEDIUM" "HIGH"
expand[]
Array of strings (VendorCriteriaExpandEnum)

List of sub-objects to expand

Items Enum: "vendorTypes" "impactLevels" "questionnaireFile"
Responses
200

Successful

400

Malformed data and/or validation errors

401

Invalid Authorization

402

You must upgrade your plan to use this feature

403

You are not allowed to perform this action

404

No security review exists with the given securityReviewId

412

You must accept the Drata terms and conditions to use the API

500

Internal server error

get/vendor-criteria
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "id": 1,
      • "name": "Data Security Criteria",
      • "description": [
        • "The vendor has designated security personnel"
        ],
      • "source": "Drata default",
      • "type": "DEFAULT",
      • "severity": "HIGH",
      • "isDraft": false,
      • "vendorTypes": [
        • {
          • "id": 3,
          • "name": "Cloud Provider"
          }
        ],
      • "impactLevels": [
        • {
          • "impactLevel": "CRITICAL",
          • "vendorRiskLevelId": 14
          }
        ],
      • "createdAt": "2025-07-01T16:45:55.246Z",
      • "updatedAt": "2025-07-01T16:45:55.246Z",
      • "questionnaireFile": {
        • "id": 1,
        • "name": "Security Policy Document"
        },
      • "questionnaireFileId": null
      }
    ],
  • "pagination": {
    • "cursor": "string",
    • "totalCount": 0
    }
}