---
title: "Send a security questionnaire to a vendor"
method: POST
path: "/vendor/questionnaire"
tags: ["vendors"]
---

# Send a security questionnaire to a vendor

`POST /vendor/questionnaire`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/vendor/questionnaire`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/vendor/questionnaire/post.ts> (a function with typed inputs; its response is checked against the schema)

Request a vendor questionnaire to be sent to one or more nominated email addresses.
Vendor must be already monitored in UpGuard.

Required API key permissions: `VendorRisk` (select when creating API key in Account Settings)

The following merge tags are supported for email_title and email_subject text:
+ Vendor name {{VendorName}}
+ Account name {{AccountName}}
+ Questionnaire type {{QuestionnaireType}}
+ Due date {{DueDate}}

The following merge tags are supported for email_message text:
+ Vendor name {{VendorName}}

## Request body

- PostVendorQuestionnaireBody: Must contain exactly one of *vendor_id* or *vendor_primary_hostname*.
  - `due_date` string, required: The date the questionnaire is due to be completed by. Must be a future ISO 8601 formatted date string (YYYY-MM-DD).
  - `email_message` string: Optional message sent to the questionnaire recipient. If not provided, the organization's default message will be used.
  - `email_title` string: Optional email title sent to the questionnaire recipient. If not provided, the organization's default email title will be used.
  - `questionnaire_type_id` integer, required: Numeric ID of the questionnaire type to be sent.
  - `recipients` QuestionnaireRecipient[], required: The list of questionnaire recipients.
    - `recipient_email` string, required: The email address of the questionnaire recipient (will be invited to the platform if not already a member).
    - `recipient_first_name` string: The first name of the questionnaire recipient (used for new recipients only).
    - `recipient_last_name` string: The last name of the questionnaire recipient (used for new recipients only).
    - `recipient_title` string: The title of the questionnaire recipient (used for new recipients only).
  - `reminder_date` string: The date to send a questionnaire reminder to the recipients. Must be a future ISO 8601 formatted date string (YYYY-MM-DD).
  - `risk_information_visiblity` 'ShowAllRiskInformation' | 'HideSeverity' | 'HideAllRiskInformation', required: The visibility level of risk information in the questionnaire.
  - `sender_email` string, required: The email address of the questionnaire sender (must be an UpGuard user with full access to Vendor Risk or the portfolio containing the vendor).
  - `vendor_id` integer: ID of the vendor the questionnaire is being sent to. This, or *vendor_primary_hostname* must be provided.
  - `vendor_primary_hostname` string: Primary hostname of the vendor the questionnaire is being sent to. This, or *vendor_id* must be provided.

## Response `200`

The questionnaire was successfully sent

- QuestionnaireSent: Questionnaire ID
  - `questionnaire_id` integer: The id of the questionnaire that was sent

## Other responses

- `403`: Your API key does not have permission to perform this action.
- `404`: The vendor was not found.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)