---
title: "Get project vendor"
method: GET
path: "/v1/projects/{projectId}/vendors/{vendorId}"
tags: ["Projects"]
---

# Get project vendor

`GET /v1/projects/{projectId}/vendors/{vendorId}`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/projects/{projectId}/vendors/{vendorId}`
- Auth: HTTP bearer

Gets one vendor seen on a project: the pages and hosts it was seen on, what loaded it, and its runtime Inbox finding. Requires projects.read.

## Path parameters

- `projectId` string, required
- `vendorId` string, required

## Response `200`

Requested vendor.

- object
  - `success` true, required
  - `data` ProjectVendorDetail, required
    - `consentCategory` string, nullable, required
    - `evidence` object[], required
      - `kind` string, required
      - `loadedBy` object, nullable, required: What loaded the vendor, when the scan saw it.
        - `initiator` string, nullable, required: Browser initiator type, such as `parser` for a tag in the page HTML.
        - `scriptUrl` string, nullable, required: The script that made the request or set the cookie.
        - `tagManagerContainerId` string, nullable, required: Google Tag Manager container that injected the loading script.
        - `viaGoogleTagManager` boolean, required: True when Google Tag Manager is in the chain of scripts that loaded the vendor.
      - `observedAt` string, date-time, required
      - `pageUrl` string, nullable, required
      - `source` string, required
      - `value` string, required
    - `firstSeenAt` string, date-time, required
    - `hosts` string[], required: Hosts named by the vendor's evidence: request and script hosts, and cookie domains. A cookie domain does not mean the site contacted that host.
    - `lastSeenAt` string, date-time, required
    - `name` string, required
    - `privacyPolicyUrl` string, nullable, required
    - `projectId` string, required
    - `projectSlug` string, required
    - `reviewState` 'accepted' | 'suggested' | 'rejected' | 'needs_review', required
    - `sources` string[], required
    - `state` 'active' | 'not_seen_recently' | 'ignored' | 'approved' | 'blocked', required
    - `id` string, required: Vendor ID.
    - `inboxItemId` string, nullable, required: The runtime Inbox finding for the vendor in any status, if one exists.

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `429`: The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
- `500`: An unexpected internal error occurred.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-21** `66f3737449a3`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/projects/:projectId/vendors/:vendorId/get.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/8741280c3463?raw)