<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Third-Party Risk Management — API Reference

## Vendor Assessment Schema

```json
{
  "vendor_name": "CloudCorp",
  "tier": 1,
  "data_access": "direct",
  "data_types": ["pii", "phi"],
  "overall_score": 82.5,
  "certifications": ["SOC 2 Type II", "ISO 27001"],
  "last_assessment": "2026-01-15",
  "next_assessment": "2026-07-15"
}
```

## Agent Commands

```bash
# Tier a vendor
node agent.js --action tier --vendor "CloudCorp" --data-access direct --criticality critical

# Assess vendor from questionnaire
node agent.js --action assess --input questionnaire.json

# Generate TPRM report
node agent.js --action report --input vendors.json --output tprm_report.json
```

## External Rating Services

| Service | Coverage | Scoring | API |
|---------|----------|---------|-----|
| BitSight | 540K+ companies | 250-900 | REST API |
| SecurityScorecard | 12M+ companies | A-F grade | REST API |
| UpGuard | 1M+ companies | 0-950 | REST API |
| RiskRecon | Broad | A-F grade | REST API |
