<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Third-Party Risk Assessment — API Reference

## SecurityScorecard API

```bash
# Get company rating
curl -H "Authorization: Bearer $SSC_TOKEN" \
  "https://api.securityscorecard.io/companies/<DOMAIN>"

# Get factor grades
curl -H "Authorization: Bearer $SSC_TOKEN" \
  "https://api.securityscorecard.io/companies/<DOMAIN>/factors"

# Get historical ratings
curl -H "Authorization: Bearer $SSC_TOKEN" \
  "https://api.securityscorecard.io/companies/<DOMAIN>/history/score"
```

## BitSight API

```bash
# Get company rating
curl -H "Authorization: Basic $BITSIGHT_TOKEN" \
  "https://api.bitsighttech.com/ratings/v1/companies?domain=<DOMAIN>"

# Get risk vectors
curl -H "Authorization: Basic $BITSIGHT_TOKEN" \
  "https://api.bitsighttech.com/ratings/v1/companies/<GUID>/risk-vectors"
```

## Breach Intelligence

```bash
# HIBP domain search
curl -H "hibp-api-key: $HIBP_KEY" \
  "https://haveibeenpwned.com/api/v3/breaches?domain=<DOMAIN>"

# Check for leaked credentials
curl -H "hibp-api-key: $HIBP_KEY" \
  "https://haveibeenpwned.com/api/v3/breachedaccount/<EMAIL>"
```

## Vendor Assessment Frameworks

| Framework | Scope | Questions | Use Case |
|-----------|-------|-----------|----------|
| SIG Lite | Quick assessment | ~150 | Tier 3-4 vendors |
| SIG Full | Comprehensive | ~800 | Tier 1-2 vendors |
| CAIQ v4 | Cloud-specific | ~260 | Cloud service providers |
| VSAQ | Google's questionnaire | ~100 | Web application vendors |
| CIS CSAT | Self-assessment | ~170 | CIS Controls alignment |

## SOC 2 Report Review Checklist

```
SOC 2 Report Review Points:
├── Report type (Type I vs Type II)
├── Observation period dates
├── Scope of services covered
├── Trust Service Criteria included
├── Auditor opinion (qualified vs unqualified)
├── Exceptions or findings noted
├── Complementary User Entity Controls (CUECs)
├── Subservice organizations and carve-outs
└── Management assertions vs auditor testing
```
