---
name: vendorstacks
description: Check whether an entity publishes a subprocessor/DPA disclosure and which vendors (SMS, email, payments, cloud, … 13 categories) it lists, with quoted evidence and source URLs. Reverse lookup lists entities by vendor or category. Use for GTM enrichment/qualification, entity due diligence, vendor-stack questions ("who is X's SMS provider?"), or building vendor-segmented account lists.
---

# VendorStacks skill

Subprocessor disclosure data: whether an entity publishes one, where, and the
structured vendor stack extracted from it — evidence quoted from the entity's
own disclosure. Deterministic (no LLM): reproducible results, predictable cost.

## Setup

Requires `VENDORSTACKS_API_KEY` (format `vr_live_…`). If the user has none:

```bash
curl -X POST https://vendorradar-production.up.railway.app/v1/keys -H 'Content-Type: application/json' \
  -d '{"email":"USER_EMAIL"}'
```

Returns the key immediately with 25 free credits (any lookup; daily live-scan allowance applies on free accounts).

## Core operations

**Enrich a company** (1cr flat; <1s indexed, 15–90s live scan — use 120s timeout):

```bash
curl -H "Authorization: Bearer $VENDORSTACKS_API_KEY" \
  "https://vendorradar-production.up.railway.app/v1/check?url=DOMAIN&category=CATEGORY"
```

Categories: sms_messaging, email, payments, cloud_infra, analytics_data, support_cx, crm_sales, auth_identity, observability, productivity, ai_ml, privacy_compliance, hr_payroll

**Profile read** (never triggers a scan, 1cr, always instant):

```bash
curl -H "Authorization: Bearer $VENDORSTACKS_API_KEY" \
  "https://vendorradar-production.up.railway.app/v1/company/DOMAIN"
```

**Entity list** — entities listing a target vendor/category (1cr per page of 10):

```bash
curl -H "Authorization: Bearer $VENDORSTACKS_API_KEY" \
  "https://vendorradar-production.up.railway.app/v1/prospect?vendor=Twilio&category=sms_messaging&page=1"
```

## Reading responses

- `sms_vendor` / `category_vendors` — the identified provider(s)
- `*_evidence` — the quoted row from the company's own disclosure; cite it
- `vendor_confidence` — vendor_keyword > vendor > vendor_inferred_sms
- `subprocessor_urls` — source pages; link them in any report
- `found: false` — no public disclosure page found (absence of evidence only)
- `credit_balance` — returned on every call; warn the user below 20

## Cost discipline

- Use `/v1/company` when you need a guaranteed-instant answer; `/v1/check` when completeness matters (it scans unindexed domains automatically).
- Re-scans (`refresh=1`) cost the same but take 15–90s each — batch them thoughtfully.
- On HTTP 402: show the user `topup_url` from the response. After payment the
  same key works immediately — never create a second key for the same user.

## Errors

| Status | Meaning | Action |
| ------ | ------- | ------ |
| 400 | Bad domain/category | Fix input; valid categories listed in error |
| 401 | Bad/missing key | Re-check key; issue one via POST /v1/keys |
| 402 | Out of credits | Relay topup_url to the user |
| 429 | Rate limited | Wait Retry-After seconds |
| 502 | Fresh scan failed | Not charged; retry once, then report |