Security Profile API

Endpoint

GET https://api.vendordeck.org/api/trust/{slug}/security-profile

The slug is the identifier in the Trust Centre URL. For a Trust Centre at https://vendordeck.org/trust/acme the slug is acme.

Responses are served as application/ld+json with Access-Control-Allow-Origin: *, so the endpoint is callable directly from a browser. No authentication or API key is required.

Discovery

Every Trust Centre page links to its own machine-readable profile, so an agent that has landed on the HTML page can find the JSON without knowing this documentation exists:

<link rel="alternate" type="application/ld+json"
      href="https://api.vendordeck.org/api/trust/acme/security-profile">

Response

The payload is a schema.org Organization with a securityProfile extension describing the vendor's MVSP position. complianceScore is the percentage of MVSP controls the vendor has marked as implemented.

{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Acme Ltd",
  "securityProfile": {
    "provider": "VendorDeck",
    "profileUrl": "https://vendordeck.org/trust/acme",
    "framework": "MVSP",
    "frameworkVersion": "v3.0-20231109",
    "frameworkUrl": "https://mvsp.dev",
    "attestation": "self-attested",
    "attestationNote": "MVSP operates no certification scheme. Checklist answers are the vendor's own. Where a control is marked verifiedByVendorDeck, VendorDeck has reviewed the supporting artifact.",
    "totalControls": 25,
    "controlsImplemented": 18,
    "controlsEvidenceBacked": 4,
    "controlsVerifiedByVendorDeck": 2,
    "selfAssessmentComplete": true,
    "complianceScore": 78,
    "lastUpdated": "2026-08-01T09:14:22.000Z",
    "implementedControls": [
      {
        "controlId": "1.4",
        "category": "Business controls",
        "question": "Do you commission an annual penetration test by an independent third party?",
        "status": "yes",
        "justification": null,
        "evidence": [
          {
            "label": "Penetration test report 2026",
            "issuedBy": "Cure53",
            "issuedAt": "2026-03-01T00:00:00.000Z",
            "expiresAt": "2027-03-01T00:00:00.000Z",
            "verifiedByVendorDeck": true
          }
        ]
      }
    ],
    "gaps": [
      {
        "controlId": "3.2",
        "question": "Do you maintain a current data flow diagram?",
        "justification": "In progress; first version due Q4 2026."
      }
    ],
    "documents": [
      { "title": "Incident Response Policy", "type": "policy", "updatedAt": "2026-07-19T11:02:10.000Z" }
    ]
  }
}

Access levels

Vendors choose whether the full control set is public. When it is not, the summary fields are still returned along with instructions for requesting access — so an agent always gets a usable answer rather than a hard failure:

{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Acme Ltd",
  "securityProfile": {
    "provider": "VendorDeck",
    "profileUrl": "https://vendordeck.org/trust/acme",
    "framework": "MVSP",
    "frameworkVersion": "v3.0-20231109",
    "attestation": "self-attested",
    "totalControls": 25,
    "controlsImplemented": 18,
    "complianceScore": 78,
    "accessRequired": true,
    "requestAccessUrl": "https://vendordeck.org/trust/acme",
    "botWhitelistInstructions": "Register your procurement bot at the requestAccessUrl to get structured data access."
  }
}

Vendors can register a bot user-agent pattern to receive the full response automatically. This is intended for procurement platforms that vet many suppliers and identify themselves with a stable user agent.

Status codes

• 200 — profile returned (full or summary, per the vendor's settings).
• 404 — no Trust Centre exists for that slug, or it has not been published.

Notes for implementers

• complianceScore reflects vendor self-attestation against MVSP. It is not an audited or independently verified figure, and should not be presented to buyers as one.
• lastUpdated is the last time the vendor changed their Trust Centre. Treat a stale timestamp as a signal worth surfacing.
• The documents array lists metadata only. Document contents are never returned by this endpoint.