The SupplierVault API
Read your supplier data and add suppliers and invoices from your own systems. API access is included in the Enterprise plan.
The SupplierVault API lets your own systems read your supplier data and add suppliers and invoices. Use it to feed Power BI or Excel, keep your finance system in step, or trigger a workflow when something changes.
1. Create a key
An admin creates keys in SupplierVault: Account › Organisation › API keys. Choose Read only for reporting, or Read and write if the system will add suppliers or invoices. The key is shown once, so copy it into your password manager or the system's secure settings straight away. You can revoke a key at any time, and the list shows when each key was last used.
Treat a key like a password. Anyone with it can read your organisation's supplier records. We only store a fingerprint of each key, so we can't show it to you again.
2. Make a request
Send the key in the X-API-Key header. All responses are JSON.
curl -H "X-API-Key: sv_your_key_here" \
"https://rpqabtyahmtpdqfccnei.supabase.co/functions/v1/api/v1/suppliers?stage=active&limit=100"Base address: https://rpqabtyahmtpdqfccnei.supabase.co/functions/v1/api/v1
3. What you can read
| Request | Returns |
|---|---|
GET /suppliers | Every supplier, with contract, risk, finance set-up and governance details. Filter with stage, area and updated_since. |
GET /suppliers/{id} | One supplier. |
GET /tasks, /invoices, /requests, /sourcing, /savings, /people, /activity | The same records you see in the app. Filter tasks and invoices with status or supplier_id. |
GET /obligations | Every contractual obligation, one row each, with the supplier, owner, due date and status. |
GET /signatures | Electronic signatures: who signed what, when, and the document fingerprint (SHA-256). |
Paging: up to 500 records per request (limit, default 100). If there are more, the response includes next_cursor. Send it back as cursor to get the next page.
Changes only: add updated_since=2026-10-01 to fetch only records changed since a date, which is ideal for a nightly sync.
4. What you can add (read-and-write keys)
| Request | Body | What happens |
|---|---|---|
POST /suppliers | {"name", "category", "legalName", "regNo", "vatNo", "currency"} | Adds the supplier at the intake stage, ready for your usual checks. |
POST /invoices | {"supplierId", "number", "amount", "currency", "date", "period", "po"} | Records the invoice. If the supplier's bank details aren't verified (penny test and call-back), it is held automatically. |
PATCH /invoices/{id} | {"status", "note"} | Status is one of received, matched, on-hold, disputed or paid. An invoice can't be released while bank details are unverified. |
Every change made through the API appears in the supplier's activity trail with the name of the key that made it. The API can't approve requests, release bank changes or sign anything: those always need a person signed in to SupplierVault.
5. Power BI and Excel
In Power BI or Excel choose Get data › From web › Advanced, enter the address (for example https://rpqabtyahmtpdqfccnei.supabase.co/functions/v1/api/v1/suppliers?limit=500) and add a header named X-API-Key with your key. Expand the data list into a table.
Errors
Errors return a status code and {"error": {"code", "message"}}: 401 means the key is missing, wrong or revoked; 403 means your plan doesn't include the API or has ended, or a read-only key tried to make a change; 404 means not found; 409 means a duplicate invoice or unverified bank details.
Need help?
Email hello@suppliervault.co.uk.