---
title: "Approve or ignore project vendor"
method: POST
path: "/v1/projects/{projectId}/vendors/{vendorId}/decision"
tags: ["Projects"]
---

# Approve or ignore project vendor

`POST /v1/projects/{projectId}/vendors/{vendorId}/decision`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/projects/{projectId}/vendors/{vendorId}/decision`
- Auth: HTTP bearer

Approves a vendor seen on a project, which accepts the data sharing, or ignores it. Either decision resolves the vendor's runtime Inbox finding, and later scans keep the decision. Take the vendor ID from GET /v1/projects/{projectId}/vendors or from `runtimeVendor` on an Inbox item. Requires vendors.write, which organization API keys cannot hold, and an admin or owner role.

## Path parameters

- `projectId` string, required
- `vendorId` string, required

## Request body

- DecideProjectVendorRequest
  - `decision` 'approve' | 'ignore', required

## Response `200`

Decision was recorded.

- object
  - `success` true, required
  - `data` ProjectVendorDecision, required
    - `inboxItemId` string, nullable, required: The runtime Inbox finding for the vendor, if one exists.
    - `name` string, required
    - `projectId` string, required
    - `reviewState` 'accepted' | 'suggested' | 'rejected' | 'needs_review', required
    - `state` 'approved' | 'ignored', required
    - `vendorId` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `413`: The request body exceeds the 1 MB limit.
- `429`: The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
- `500`: An unexpected internal error occurred.

## Changes

- **2026-10-21** `66f3737449a3`: 1 info
  - added the required property `data/name` to the response with the `200` status
- **2026-10-19** `8ebea9777d0c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/projects/:projectId/vendors/:vendorId/decision/post.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)