# Create a vendor

```http
POST https://secure.yoprint.com/v1/api/store/{team_slug}/vendor
```

- API version: v1
- Operation ID: `v1_public_vendor_store`
- Section: Purchasing › [Vendors](https://developer.yoprint.com/reference/vendors.md)
- Web page: https://developer.yoprint.com/reference/vendors/v1-vendor-store/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

Creates a vendor, with its contacts, and returns it with `contacts`. The first contact you send becomes the primary contact.

A vendor is a supplier you buy from: purchase orders and your products name one.

## Permission

Needs the Manage Vendors permission at the level that can create vendors.

## Business rules

- Only the vendor's own fields are checked, as strings. `name` is not required, and contacts sent here are not checked at all: add a contact with Add a contact to a vendor when you want its fields checked.
- Vendor names need not be unique.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.

## Request body

Content type `application/json`, required.

Fields:

- `account_number` (string, optional): Your account number with this vendor.
- `contact` (array of objects, optional): The vendor's contacts. The first one becomes primary.
  - Each item:
    - `email` (string (email), optional)
    - `fax` (string, optional): Checked as a real number for `fax_country`.
    - `fax_country` (string, optional)
    - `first_name` (string, optional): The contact's first name.
    - `last_name` (string, optional): The contact's last name.
    - `phone` (string, optional)
    - `phone_country` (string, optional): Two-letter country code of `phone`, such as `US`. Required with `phone`.
- `default_vendor_note` (string, optional): A note for the vendor, available on purchase order PDFs.
- `internal_notes` (string, optional): Notes for your team only.
- `name` (string, optional): The vendor's name. Not required by the API (a vendor can be saved without one), but send it: it is how the vendor is shown everywhere.
- `website` (string, optional): The website address.

### Example request

```bash
curl -X POST 'https://secure.yoprint.com/v1/api/store/your-team/vendor' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1' \
  -H 'Content-Type: application/json' \
  -d '{
    "account_number": "ACCT-1001",
    "contact": [
      {
        "email": "sam@example.com",
        "first_name": "Sam",
        "last_name": "Lee",
        "phone": "+1 201 555 0123",
        "phone_country": "US"
      }
    ],
    "name": "Example Blanks Co",
    "website": "https://example.com"
  }'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required)
  - `id` (string, required)
  - `name` (string | null, required)
  - `trashed` (boolean, required): True when the vendor is deleted.
  - `account_number` (string | null, optional)
  - `contacts` (array of objects, optional): Every contact, deleted ones included.
    - Each item:
      - `created_at` (string (date-time), required)
      - `first_name` (string | null, required)
      - `id` (string, required)
      - `is_primary` (boolean, required)
      - `trashed` (boolean, required): True when the contact is deleted.
      - `updated_at` (string (date-time), required)
      - `customer_id` (string, optional): Customer contacts only.
      - `default_receive_sms` (boolean, optional)
      - `email` (string | null, optional)
      - `external_type` (string | null, optional)
      - `fax` (string | null, optional)
      - `fax_country` (string | null, optional)
      - `is_external` (boolean, optional): True for a contact synced from Shopify; such contacts are read-only.
      - `last_name` (string | null, optional)
      - `phone` (string | null, optional)
      - `phone_country` (string | null, optional)
      - `send_invoice` (boolean, optional): Customer contacts only.
      - `vendor_id` (string, optional): Vendor contacts only.
  - `default_vendor_note` (string | null, optional)
  - `internal_notes` (string | null, optional)
  - `website` (string | null, optional)
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "account_number": "ACCT-1001",
    "contacts": [
      {
        "created_at": "2026-11-01T09:00:00+00:00",
        "default_receive_sms": false,
        "email": "sam@example.com",
        "external_type": null,
        "fax": null,
        "fax_country": null,
        "first_name": "Sam",
        "id": "fopJXRDkZ8Qk7S",
        "is_external": false,
        "is_primary": true,
        "last_name": "Lee",
        "phone": "+1 201 555 0123",
        "phone_country": "US",
        "trashed": false,
        "updated_at": "2026-11-01T09:00:00+00:00",
        "vendor_id": "MFwvMEIK7ud89l"
      }
    ],
    "default_vendor_note": null,
    "id": "MFwvMEIK7ud89l",
    "internal_notes": null,
    "name": "Example Blanks Co",
    "trashed": false,
    "website": "https://example.com"
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
  - When: Your role cannot create vendors. This 403 has a short body, `{"message": "Insufficient Permission"}`, with no `success` or `error`. Fix: Ask a team owner to raise Manage Vendors for your role.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
- `422` The request was refused and changed nothing. `validation_failed` lists what to fix in `error.fields`; other codes name a business rule, explained in `error.message`. A few checks answer with only `{"message": "..."}`. An operation that calls another service (a payment provider, a carrier, an accounting app) can answer `connect_timeout` ("Please retry again") when that service does not answer in time: the change may or may not have happened there, so read the record back before you retry.
  - When: A field has the wrong type. `error.code` is `validation_failed`. Fix: Send text fields as strings.

## Related

- [Add a contact to a vendor](https://developer.yoprint.com/reference/vendor-contacts/v1-vendor-contact-store.md): `POST /v1/api/store/{team_slug}/vendor/{hash_id}/contact`
- [Update a vendor (PATCH)](https://developer.yoprint.com/reference/vendors/v1-vendor-update-patch.md): `PATCH /v1/api/store/{team_slug}/vendor/{hash_id}`