Get the sub-processor report

GET/v1/trust/subprocessors

Get the sub-processor report.

Lists every party your organization's AI data reached in the window, or can reach through its configuration: model providers (one entry per legal entity, with the models used and the provider's published data terms), tool servers your agents called through the MCP Gateway, and the services VectorAxis itself runs on. Each entry is OBSERVED (it received data in the window) or CONFIGURED (it is set up, through a virtual key, an MCP integration or a guardrail, but received nothing in the window). Requests answered from the response cache are not counted.

The window defaults to the 90 days up to now and can be at most 366 days long. Without workspace_id the report covers the whole organization and requires an organization owner or admin; with it, the report covers that workspace and any member of the workspace may call it.

Errors: 400 when start_time is not before end_time or the window is longer than 366 days; 402 when the organization's plan does not include the AI Trust Pack; 403 without the access above.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Query parameters

organizationstringrequired
the organization slug
workspace_idstring<uuid>
limit the report to this workspace (UUID); omit for the whole organization
start_timestring<date-time>
start of the window, ISO 8601 date-time; default 90 days before end_time
end_timestring<date-time>
end of the window, ISO 8601 date-time; default now

Responses

200application/json

organizationstring
The organization slug the report is for.
workspace_idstring<uuid>
The workspace the report is limited to (UUID); absent for an organization-wide report.
start_timestring<date-time>
Start of the report window (ISO 8601 date-time).
end_timestring<date-time>
End of the report window (ISO 8601 date-time).
generated_atstring<date-time>
When the report was generated (ISO 8601 date-time).
summaryobject
Counts over the report's entries.
Child attributes
- model_providersinteger<int32>
  Model providers that received data in the window.
- tool_serversinteger<int32>
  Tool servers called in the window.
- platforminteger<int32>
  Platform services listed.
- configured_onlyinteger<int32>
  Entries that are configured but received nothing in the window.
- uncataloguedinteger<int32>
  Model providers and platform services whose terms are not in the catalogue.
- requestsinteger<int64>
  Requests in the window that reached a model provider.
dataobject[]
The sub-processors: model providers first, then tool servers, then platform services; within each, those that received data in the window first, most used first.
Child attributes
- keystring
  The sub-processor's key: a catalogue key (for example openai, aws), the provider id in lower case when the provider is not catalogued, or the MCP integration slug for a tool server.
- namestring
  The sub-processor's name.
- categoryenum<string>
  What kind of party it is. MODEL_PROVIDER: an AI model provider the requests were sent to. TOOL_SERVER: an upstream MCP server or API called through the MCP Gateway. PLATFORM: a service VectorAxis itself uses to run the gateway (hosting, edge, embeddings, AI guardrail checks).
  One of "MODEL_PROVIDER", "TOOL_SERVER", "PLATFORM"
- usageenum<string>
  OBSERVED: it received the organization's data in the period. CONFIGURED: it is reachable through the organization's configuration (a virtual key, an integration, a guardrail) but received nothing in the period.
  One of "OBSERVED", "CONFIGURED"
- providersstring[]
  The provider ids this entry covers (as GET /v1/providers lists them); model providers only.
- purposesstring[]
  What the data is sent for; platform services and tool servers.
- hoststring
  Host of an upstream tool server.
- requestsinteger<int64>
  Requests (or tool calls) in the window that reached this party.
- first_seenstring<date-time>
  First request (or tool call) in the window that reached it (ISO 8601 date-time); absent when none did.
- last_seenstring<date-time>
  Last request (or tool call) in the window that reached it (ISO 8601 date-time); absent when none did.
- regionsstring[]
  Regions requests were sent to, where the gateway knows them; else see the terms' processing regions.
- modelsobject[]
  Models used in the window, most used first (at most 50).
  Child attributes
  - modelstring
    The model id, as requested.
  - requestsinteger<int64>
    Requests to this model in the window.
  - first_seenstring<date-time>
    First request to this model in the window (ISO 8601 date-time).
  - last_seenstring<date-time>
    Last request to this model in the window (ISO 8601 date-time).
- virtual_keysinteger<int32>
  Active or exhausted virtual keys that can reach this provider.
- cataloguedboolean
  Whether the provider's terms are in the catalogue; null for tool servers.
- termsobject
  A provider's published data-handling terms for its API, as recorded in the VectorAxis provider catalogue. Every value comes from the pages in sources, checked on reviewed_on; a null value means the provider's own pages did not clearly state it.
  Child attributes
  - legal_entitystring
    The legal entity that processes API data (several when it depends on the customer's location).
  - headquartersstring
    ISO country code of the provider's headquarters.
  - processing_regionsstring[]
    Regions where the provider processes API data, as it states them.
  - data_residencystring
    Data residency options the provider offers, as it states them.
  - trains_on_api_databoolean
    Whether the provider trains on API inputs and outputs by default; null when not stated.
  - api_data_retentionstring
    How long the provider keeps API inputs and outputs, as it states it.
  - zero_retentionstring
    Whether and how zero data retention is available, as the provider states it.
  - baastring
    Whether and how a HIPAA business associate agreement is available, as the provider states it.
  - dpa_urlstring
    Link to the provider's data processing agreement.
  - terms_urlstring
    Link to the provider's terms of service.
  - privacy_urlstring
    Link to the provider's privacy policy.
  - sourcesstring[]
    The provider's pages these facts were taken from.
  - reviewed_onstring
    ISO date the facts were last checked against the sources.
notesstring[]
How to read the report: what is and is not counted.

VectorAxis is built by GK Labs, a member of NVIDIA Inception.