{
  "info": {
    "name": "vendor-evidence-drift",
    "description": "Monitor vendor security, privacy, subprocessor, certification and SLA evidence, and map changes to controls and risk.\n\n## Getting started\n\n1. Run **Create a free sandbox API key** — it needs no auth.\n2. Copy the returned `apiKey` into the collection's `apiKey` variable.\n3. Every authenticated request then works as-is.\n\nGenerated from the deployed OpenAPI contract — it cannot drift from the live API.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "auth": {
    "type": "bearer",
    "bearer": [
      {
        "key": "token",
        "value": "{{apiKey}}",
        "type": "string"
      }
    ]
  },
  "variable": [
    {
      "key": "baseUrl",
      "value": "https://vendorevidence-api.com",
      "type": "string"
    },
    {
      "key": "apiKey",
      "value": "",
      "type": "string",
      "description": "Paste the key returned by POST /v1/keys."
    }
  ],
  "item": [
    {
      "name": "Liveness and deployed version",
      "request": {
        "method": "GET",
        "header": [],
        "url": {
          "raw": "{{baseUrl}}/health",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "health"
          ]
        }
      }
    },
    {
      "name": "Service index — endpoints, auth and error format",
      "request": {
        "method": "GET",
        "header": [],
        "url": {
          "raw": "{{baseUrl}}/",
          "host": [
            "{{baseUrl}}"
          ],
          "path": []
        }
      }
    },
    {
      "name": "Compare two evidence snapshots and return drift, controls and risk",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          },
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/checks",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "checks"
          ]
        },
        "description": "Send a previous and a current snapshot of one vendor's published compliance evidence — certifications, subprocessors, policies, SLA commitments, data-residency statements, pen-test and insurance documents. Returns every drift finding with a stable code, a fixed severity, the controls it bears on and a recommended action, plus a risk score whose derivation is printed line by line. Expiry arithmetic is in whole UTC days and expiresAt is the last day covered. Omit \"previous\" for a first-ever baseline. Send one \"check\" or up to 50 in \"checks\" — billed one evidence_check per check. This service compares only what you supply: it never fetches a vendor document, never verifies that a certificate is genuine, and makes no claim about any real vendor's actual posture.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"check\": {\n    \"vendorId\": \"vnd-northwind\",\n    \"vendorName\": \"Northwind Software\",\n    \"previous\": {\n      \"capturedAt\": \"2026-02-01\",\n      \"certifications\": [\n        {\n          \"framework\": \"soc2_type2\",\n          \"auditor\": \"Prior & Co\",\n          \"issuedAt\": \"2025-02-15\",\n          \"expiresAt\": \"2026-02-14\",\n          \"scope\": [\n            \"security\",\n            \"availability\",\n            \"confidentiality\"\n          ],\n          \"exceptions\": [],\n          \"opinion\": \"unqualified\"\n        }\n      ],\n      \"subprocessors\": [\n        {\n          \"name\": \"Cloudmail\",\n          \"country\": \"US\",\n          \"purpose\": \"transactional email\",\n          \"processesPersonalData\": true\n        },\n        {\n          \"name\": \"Metricly\",\n          \"country\": \"IE\",\n          \"purpose\": \"product analytics\",\n          \"processesPersonalData\": false\n        }\n      ],\n      \"policies\": [\n        {\n          \"name\": \"Information Security Policy\",\n          \"version\": \"4.1\",\n          \"effectiveAt\": \"2025-03-01\",\n          \"contentHash\": \"sha256:9f2c\"\n        }\n      ],\n      \"slas\": [\n        {\n          \"metric\": \"uptime\",\n          \"uptimeBasisPoints\": 9995\n        },\n        {\n          \"metric\": \"support_response\",\n          \"targetMinutes\": 240\n        }\n      ],\n      \"residency\": [\n        {\n          \"dataCategory\": \"customer_content\",\n          \"countries\": [\n            \"IE\",\n            \"US\"\n          ]\n        }\n      ],\n      \"attestations\": [\n        {\n          \"kind\": \"insurance\",\n          \"provider\": \"Meridian\",\n          \"issuedAt\": \"2025-06-01\",\n          \"expiresAt\": \"2026-05-31\",\n          \"coverageMinor\": 1000000000,\n          \"currency\": \"USD\"\n        }\n      ]\n    },\n    \"current\": {\n      \"capturedAt\": \"2026-08-01\",\n      \"certifications\": [\n        {\n          \"framework\": \"soc2_type2\",\n          \"auditor\": \"Nextgen Assurance\",\n          \"issuedAt\": \"2026-03-20\",\n          \"expiresAt\": \"2027-03-19\",\n          \"scope\": [\n            \"security\",\n            \"confidentiality\"\n          ],\n          \"exceptions\": [\n            \"Access review evidence incomplete for two of twelve months\"\n          ],\n          \"opinion\": \"unqualified\"\n        }\n      ],\n      \"subprocessors\": [\n        {\n          \"name\": \"Cloudmail\",\n          \"country\": \"US\",\n          \"purpose\": \"transactional email\",\n          \"processesPersonalData\": true\n        },\n        {\n          \"name\": \"Metricly\",\n          \"country\": \"IE\",\n          \"purpose\": \"product analytics\",\n          \"processesPersonalData\": false\n        },\n        {\n          \"name\": \"Supportly\",\n          \"country\": \"BR\",\n          \"purpose\": \"customer support tooling\",\n          \"processesPersonalData\": true\n        }\n      ],\n      \"policies\": [\n        {\n          \"name\": \"Information Security Policy\",\n          \"version\": \"4.1\",\n          \"effectiveAt\": \"2025-03-01\",\n          \"contentHash\": \"sha256:44e1\"\n        }\n      ],\n      \"slas\": [\n        {\n          \"metric\": \"uptime\",\n          \"uptimeBasisPoints\": 9990\n        },\n        {\n          \"metric\": \"support_response\",\n          \"targetMinutes\": 480\n        }\n      ],\n      \"residency\": [\n        {\n          \"dataCategory\": \"customer_content\",\n          \"countries\": [\n            \"BR\",\n            \"IE\",\n            \"US\"\n          ]\n        }\n      ],\n      \"attestations\": [\n        {\n          \"kind\": \"insurance\",\n          \"provider\": \"Meridian\",\n          \"issuedAt\": \"2026-06-01\",\n          \"expiresAt\": \"2027-05-31\",\n          \"coverageMinor\": 500000000,\n          \"currency\": \"USD\"\n        }\n      ]\n    }\n  }\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      }
    },
    {
      "name": "Public demo — compare one pair of snapshots without a key",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/demo/check",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "demo",
            "check"
          ]
        },
        "description": "The real engine, capped at one check and 40 evidence items across both snapshots. Nothing is stored, nothing is metered, no key is needed.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"check\": {\n    \"vendorId\": \"vnd-northwind\",\n    \"vendorName\": \"Northwind Software\",\n    \"previous\": {\n      \"capturedAt\": \"2026-02-01\",\n      \"certifications\": [\n        {\n          \"framework\": \"soc2_type2\",\n          \"auditor\": \"Prior & Co\",\n          \"issuedAt\": \"2025-02-15\",\n          \"expiresAt\": \"2026-02-14\",\n          \"scope\": [\n            \"security\",\n            \"availability\",\n            \"confidentiality\"\n          ],\n          \"exceptions\": [],\n          \"opinion\": \"unqualified\"\n        }\n      ],\n      \"subprocessors\": [\n        {\n          \"name\": \"Cloudmail\",\n          \"country\": \"US\",\n          \"purpose\": \"transactional email\",\n          \"processesPersonalData\": true\n        },\n        {\n          \"name\": \"Metricly\",\n          \"country\": \"IE\",\n          \"purpose\": \"product analytics\",\n          \"processesPersonalData\": false\n        }\n      ],\n      \"policies\": [\n        {\n          \"name\": \"Information Security Policy\",\n          \"version\": \"4.1\",\n          \"effectiveAt\": \"2025-03-01\",\n          \"contentHash\": \"sha256:9f2c\"\n        }\n      ],\n      \"slas\": [\n        {\n          \"metric\": \"uptime\",\n          \"uptimeBasisPoints\": 9995\n        },\n        {\n          \"metric\": \"support_response\",\n          \"targetMinutes\": 240\n        }\n      ],\n      \"residency\": [\n        {\n          \"dataCategory\": \"customer_content\",\n          \"countries\": [\n            \"IE\",\n            \"US\"\n          ]\n        }\n      ],\n      \"attestations\": [\n        {\n          \"kind\": \"insurance\",\n          \"provider\": \"Meridian\",\n          \"issuedAt\": \"2025-06-01\",\n          \"expiresAt\": \"2026-05-31\",\n          \"coverageMinor\": 1000000000,\n          \"currency\": \"USD\"\n        }\n      ]\n    },\n    \"current\": {\n      \"capturedAt\": \"2026-08-01\",\n      \"certifications\": [\n        {\n          \"framework\": \"soc2_type2\",\n          \"auditor\": \"Nextgen Assurance\",\n          \"issuedAt\": \"2026-03-20\",\n          \"expiresAt\": \"2027-03-19\",\n          \"scope\": [\n            \"security\",\n            \"confidentiality\"\n          ],\n          \"exceptions\": [\n            \"Access review evidence incomplete for two of twelve months\"\n          ],\n          \"opinion\": \"unqualified\"\n        }\n      ],\n      \"subprocessors\": [\n        {\n          \"name\": \"Cloudmail\",\n          \"country\": \"US\",\n          \"purpose\": \"transactional email\",\n          \"processesPersonalData\": true\n        },\n        {\n          \"name\": \"Metricly\",\n          \"country\": \"IE\",\n          \"purpose\": \"product analytics\",\n          \"processesPersonalData\": false\n        },\n        {\n          \"name\": \"Supportly\",\n          \"country\": \"BR\",\n          \"purpose\": \"customer support tooling\",\n          \"processesPersonalData\": true\n        }\n      ],\n      \"policies\": [\n        {\n          \"name\": \"Information Security Policy\",\n          \"version\": \"4.1\",\n          \"effectiveAt\": \"2025-03-01\",\n          \"contentHash\": \"sha256:44e1\"\n        }\n      ],\n      \"slas\": [\n        {\n          \"metric\": \"uptime\",\n          \"uptimeBasisPoints\": 9990\n        },\n        {\n          \"metric\": \"support_response\",\n          \"targetMinutes\": 480\n        }\n      ],\n      \"residency\": [\n        {\n          \"dataCategory\": \"customer_content\",\n          \"countries\": [\n            \"BR\",\n            \"IE\",\n            \"US\"\n          ]\n        }\n      ],\n      \"attestations\": [\n        {\n          \"kind\": \"insurance\",\n          \"provider\": \"Meridian\",\n          \"issuedAt\": \"2026-06-01\",\n          \"expiresAt\": \"2027-05-31\",\n          \"coverageMinor\": 500000000,\n          \"currency\": \"USD\"\n        }\n      ]\n    }\n  }\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      }
    },
    {
      "name": "Every drift code, severity, control mapping and scoring constant",
      "request": {
        "method": "GET",
        "header": [],
        "url": {
          "raw": "{{baseUrl}}/v1/drift-types",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "drift-types"
          ]
        },
        "description": "The catalogue the engine emits from — not a copy of it, the same object. Branch on these codes rather than on the human-readable detail, which is prose and will be reworded. Includes the severity-to-points table and the band boundaries, so a risk score can be reproduced by hand."
      }
    },
    {
      "name": "Start a hosted Square checkout for a paid tier",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/checkout",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "checkout"
          ]
        },
        "description": "Returns a Square-hosted payment URL for the requested tier. No API key is needed — a prospect has not got one yet. The email Square collects becomes the account, so a key issued later for the same address inherits the paid quota. Enterprise returns a contact route rather than a payment link.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"tier\": \"developer\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      }
    },
    {
      "name": "Square billing events, forwarded by the shared hub",
      "request": {
        "method": "POST",
        "header": [],
        "url": {
          "raw": "{{baseUrl}}/api/billing/webhook",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "api",
            "billing",
            "webhook"
          ]
        },
        "description": "Machine-to-machine only. The shared Square billing hub POSTs signed events here; the signature is verified over the exact request bytes. Not callable by API consumers — documented so the integration is auditable."
      }
    },
    {
      "name": "Request a free sandbox API key (sends a verification email)",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/keys",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys"
          ]
        },
        "description": "Starts self-serve key issuance. A one-time claim token is emailed to the address you supply; POST it to /v1/keys/claim to receive the key. No key is returned here, and the response is the same whether or not that address already has an account — so this endpoint cannot be used to find out who has one. The email is verified because your account, your usage and your invoice are all keyed to it: issuing on an unverified address would let anyone mint a working key on your account and spend your allowance. Keep using the same address and a paid plan bought with it raises the keys you already hold rather than issuing new ones.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"email\": \"you@example.com\",\n  \"name\": \"staging\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      }
    },
    {
      "name": "List your API keys for this API",
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/keys",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys"
          ]
        },
        "description": "Every key on YOUR account for this API — label, non-secret prefix, status, when it was created, when it was last used, and what it has consumed this period. Authenticate with any active key on the account; the account is taken from that key, never from a parameter, so this can only ever return your own keys. Keys you hold for other APIs in the portfolio are not listed here. Secrets are not returned and cannot be: only a peppered hash is stored. Free, and consumes no quota."
      }
    },
    {
      "name": "Exchange an emailed claim token for the API key",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/keys/claim",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys",
            "claim"
          ]
        },
        "description": "Spends the token emailed by POST /v1/keys and returns the key. The key is shown ONCE — only a peppered hash is stored, so it can never be read back; if you lose it, rotate. The key works only on this API, and the allowance it is issued with reflects your account: your paid plan when you have one, the free sandbox allowance when you do not.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"token\": \"eyJ2IjoxLCJlIjoieW91QGV4YW1wbGUuY29tIn0.ZXhhbXBsZQ\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      }
    },
    {
      "name": "Revoke one of your API keys",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/keys/{id}/revoke",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys",
            "{id}",
            "revoke"
          ]
        },
        "description": "Kills a key immediately: the very next request made with it is refused with 401 invalid_api_key. There is no propagation delay and no cache to wait out. You may revoke the key you are authenticating with — that is the correct move when it has leaked, though you will then need another key, or the email flow, to get back in; rotate does both in one call. A key belonging to another account, or to another API, answers 404 exactly as an unknown id does, so this cannot be used to probe for keys you do not own. Idempotent, and free."
      }
    },
    {
      "name": "Replace one of your API keys with a new secret",
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "content-type",
            "value": "application/json"
          },
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/keys/{id}/rotate",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "keys",
            "{id}",
            "rotate"
          ]
        },
        "description": "Issues a replacement key and revokes the old one. This is the answer to a leaked or lost key: the new secret is returned once, the old secret stops working immediately, and the label carries over unless you supply a new one. The replacement is issued at your account's current allowance — your paid plan if you have one — not at the old key's. Rotating does not count against the active-key limit, because it replaces rather than adds. Free, and it works while you are out of quota.",
        "body": {
          "mode": "raw",
          "raw": "{\n  \"name\": \"production (rotated)\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        }
      }
    },
    {
      "name": "Your consumption and remaining allowance for this period",
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "authorization",
            "value": "Bearer {{apiKey}}"
          }
        ],
        "url": {
          "raw": "{{baseUrl}}/v1/usage",
          "host": [
            "{{baseUrl}}"
          ],
          "path": [
            "v1",
            "usage"
          ]
        },
        "description": "Reports what this API key has consumed in the current quota period, the ceiling being enforced against it, and when that ceiling resets. Free, and it consumes no quota, so it still answers once you are getting 429 quota_exceeded — which is the point: compare \"used\" against \"ceiling\" and read \"period.resetsAt\" to tell a period you have simply exhausted from a plan that is no longer active, which shows as a \"status\" of canceled and a ceiling of 0. \"used\" counts billing units (see \"unit\"), not HTTP requests: a single request can consume several. All money is in integer minor units (cents), never a decimal. The period reported here is the quota period — the calendar month in UTC, resetting at 00:00 UTC on the 1st. Your invoice window is anchored to the date you subscribed and is a different window; the amounts here are what this period’s usage has accrued so far, not a bill."
      }
    }
  ]
}