API
Read-only JSON over HTTPS, for everything the site shows. Sign in to create a key.
Requests
curl -H "Authorization: Bearer $API_KEY" https://thirdpartyindex.com/api/v1/vendors/slack/subprocessors
Endpoints
| GET | Parameters | Returns |
|---|---|---|
/vendors | q, limit (≤500), cursor | Vendors: transparency score, document and subprocessor counts |
/vendors/{slug} | A vendor, its monitored documents, its parent and child companies, the transparency rating's parts, its reach in the subprocessor graph, upstream_incidents: incidents of the last 30 days reported by vendors it names as subprocessors, each with a source (status; hibp: a breach listed by Have I Been Pwned, CC BY 4.0; sec: a Form 8-K Item 1.05 filing, Item 8.01 not read) and a date with its date_kind (started: when a status incident began; listed: the day HIBP added a breach; filed: the filing day). id and started_at are status-only; occurred_on is the breach or event date when the source states it | |
/vendors/{slug}/subprocessors | cursor, limit (≤500; without it, the whole list) | Current subprocessors: purposes, locations, transfer mechanisms, listed since, the AI model provider an entry is |
/vendors/{slug}/used-by | cursor, limit (≤500; without it, the whole list) | Tracked vendors listing it as a subprocessor, with their stated purposes |
/vendors/{slug}/changes | cursor, limit | Its published changes |
/vendors/{slug}/incidents | impact, q, since, cursor, limit (≤500) | Incidents its status page reported, newest first. An incident's url is on the status page's own host: its incident page there, or the status page itself |
/vendors/{slug}/status | What its status page says now, incidents under way, the last 90 days by impact, typical time to resolve | |
/vendors/{slug}/compliance | Certifications its trust center lists (audited or claimed), its FedRAMP Marketplace offerings, its IAB Europe TCF registrations (purposes, special features), the cybersecurity section of its latest annual report | |
/vendors/{slug}/security | CISA known exploited vulnerabilities, SEC Form 8-K Item 1.05 filings, Have I Been Pwned breaches, its security.txt | |
/vendors/{slug}/website | What its homepage loads in a browser, who controls each domain, technologies detected, its third parties by category (each entry's source: detected on this homepage, reviewed from the company's own page, or usually detected as that category elsewhere), and the security headers its response carried (observed values, no grade) | |
/vendors/{slug}/federal | role (funding | awarding) | Federal agencies in its contract records |
/vendors/{slug}/federal/awards | org, role | The award records behind them |
/government/orgs | level, parent | Departments, agencies or offices, with tracked vendors |
/government/orgs/{slug} | role | An organization and the vendors in its records |
/changes | cursor, vendor, limit (≤1000) | All published changes |
/incidents | impact (critical,major,minor,none), q, since, cursor, limit (≤500) | Incidents across tracked vendors' status pages, each once, newest first; url as for a vendor's incidents |
/incidents/ongoing | Incidents under way now, and status pages reporting problems | |
/evidence/{id} | include=text,parsed | A snapshot: source, fetch time, hashes; with include, its normalized text and what we read from it |
AI agents
No key needed for these. Same license: credit Third Party Index with a link.
Change feed
/changes lists published changes oldest first. Keep the last next_cursor and pass it back to receive only newer ones; an empty page returns the same cursor.
Incidents
What vendors' own status pages report (Atlassian Statuspage, incident.io, Instatus, Better Stack, status.io, StatusIQ, Uptime.com, StatusPal, PagerDuty, Sorry, Cronitor, Rootly): the vendor's words, not measured downtime. /incidents pages newest first: pass next_cursor back for older ones; it is absent on the last page. impact is none when the page states none. url is the vendor's own report and evidence_id the reading it came from. Incidents a page listed before our first reading come from its history, without components.