Conveyor

Delete a Trust Center document via DELETE /v2/exchange/documents/{document_id}. Deletes a document. IRREVERSIBLE: the document and every version of its file are removed from your Trust Center, and any customer link to it stops working. Measured 2026-09-18 on a document created for the purpose: 204 with an empty body, and the document gone from the list afterwards. An id that does not exist answers 400 "Record not found", not 404. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Delete a Trust Center folder via DELETE /v2/exchange/folders/{folder_id}. Deletes a folder. IRREVERSIBLE. Measured 2026-09-18 on folders created for the purpose: 204 with an empty body, and gone from the list afterwards. An id that does not exist answers 400 "Record not found", not 404. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Remove a subprocessor via DELETE /v2/subprocessors/{subprocessor_id}. IRREVERSIBLE, and it is PUBLISHED state: your Trust Center's vendor profile is what customers read during due diligence, and everyone subscribed to subprocessor-change notifications is emailed when this list changes. Measured 2026-09-18 on a subprocessor created for the purpose: 204 with an empty body, and gone from the list afterwards. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List collaboration groups via GET /v2/collaboration_groups. List all collaboration groups (Team Routing) configured for your organization. Collaboration groups are teams that questionnaire questions route to. Each group has members and optional AI suggestion instructions that tell ConveyorAI when to propose that group for a question. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center access groups via GET /v2/exchange/access_groups. Gets all the access groups for a program. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List the Trust Center access request queue via GET /v2/exchange/authorization_request_queue. Gets all the open authorization requests for a program. WARNING: this endpoint can be replicated by hitting the GET Authorization Requests endpoint (https://docs.conveyor.com/reference/get-authorization-requests) with the status parameter 'requested'. As such, we are looking to deprecate this endpoint in the near future. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center access requests via GET /v2/exchange/authorization_requests. Gets authorization requests with an optional status filter. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Get a Trust Center access request via GET /v2/exchange/authorization_requests/{authorization_request_id}. Gets the authorization request with the ID from the path. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center authorizations via GET /v2/exchange/authorizations. Gets authorizations with an optional status filter. This is where conveyor_get_v2_exchange_gate_document_signatures_by_id's `id` comes from: each authorization carries a `gate_document_signature_id`, which is null until the visitor has signed the room's NDA. MEASURED 2026-09-18: 200 with the real key, 401 without, against an invented sibling at the same depth answering 404 both ways. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center connections via GET /v2/exchange/connections. List the Trust Center exchange connections for your organization. Recovered from the research run's discovery; absent from the per-page OpenAPI fragments. Route MEASURED 2026-09-17: GET 401 against an invented-path control at the same depth (/v2/exchange/invented_xyz) returning 404. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center documents via GET /v2/exchange/documents. Gets all documents. The document LIST, and the id source for the document PATCH and DELETE -- before this shipped, an agent could update or delete a document by id and had no way to discover one. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center folders via GET /v2/exchange/folders. Gets all folders. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Get a signed NDA via GET /v2/exchange/gate_document_signatures/{id}. Gets a signed NDA document with a temporary download link (valid for 1 hour). Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center interactions via GET /v2/interactions. Gets all interactions (document interactions, q&a interactions) with optional filters. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List interactions for a connection via GET /v2/interactions/connections/{connection_id}. Gets all interactions (document interactions, q&a interactions) for a given connection. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List interactions for a document via GET /v2/interactions/documents/{document_id}. Gets all interactions (document interactions, q&a interactions) for a given document. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List interactions for a question via GET /v2/interactions/questions/{question_id}. Gets all interactions (document interactions, q&a interactions) for a given Knowledge Base q&a. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List knowledge base question tags via GET /v2/knowledge_base/question_tags. Question tags are program-scoped labels used to organize and filter curated Q&As. Use the returned tag IDs with the question_tag_ids parameter on POST or PATCH /api/v2/knowledge_base/questions to tag Q&As. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List curated Q&A via GET /v2/knowledge_base/questions. Gets all knowledge base questions with optional filters. The id source for conveyor_patch_v2_knowledge_base_questions_by_id, which has no other. `status` filters to verified or unverified only -- note that unverified does NOT mean excluded from answering: MEASURED 2026-09-18, a row reading `status: unverified` still reads `use_for_question_answering: true`, and `question_answering_usage` (always / test_only / non_test_only) is the field that governs it. That one is set at creation and CANNOT be changed -- a PATCH carrying only it answers 400 'No update parameters provided'. MEASURED: 200 with the real key, 401 without, invented sibling 404 both ways. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Search the knowledge base via GET /v2/knowledge_base/search. Searches the knowledge base for curated Q&As and past questionnaire answers matching a text query. Returns results from both the curated knowledge base and historical questionnaire answers. Answers are truncated to 500 characters. Authentication: API key or OAuth. `product_line_ids` is a COMMA-SEPARATED string, not a list. Measured 2026-09-18: `?product_line_ids=A,B` and `?product_line_ids[]=A&product_line_ids[]=B` both read BOTH ids, while the repeated-key form `?product_line_ids=A&product_line_ids=B` silently keeps only the LAST one. An id Conveyor does not know is refused by name. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List one-off questions via GET /v2/oneoff_questions. Returns a paginated list of one-off questions submitted through API, Slack, browser extension, web app, or customer room sources. Each question includes ConveyorAI's generated answer, answer metadata, issue status, source metadata, and the user who asked the question when available. Conveyor returns this collection under a `search_queries` key rather than the `questions` key its own schema documents (measured 2026-09-18); read whichever the response carries. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List product lines via GET /v2/product_lines. Gets all the product lines for a program. The id source for `product_line_ids`, which appears in nine shipped tools' schemas and had no other. Returns the program's product lines under `_embedded.product_lines` -- an envelope the vendor's spec and the live response agree on. MEASURED 2026-09-18: 200 with the real key (empty list on a tenant with no product lines configured), 401 without, invented sibling 404 both ways. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List RFP projects via GET /v2/projects. List RFP projects with optional filters. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List question categories via GET /v2/question_categories. Lists all available question categories (security domains) for tagging Knowledge Base Q&As. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List questionnaires via GET /v2/questionnaires. Gets all questionnaires with optional filters. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Get a questionnaire export via GET /v2/questionnaires/{id}/exports/{export_id}. Poll export status and get download URL. POST to create an export, then poll GET until status is "completed" and download_url is present. Both ids are required and both must belong together: a questionnaire id with another questionnaire's export answers 400 "Record not found" rather than a 404 (measured 2026-09-18). Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List questionnaire questions via GET /v2/questionnaires/questions. Returns a paginated list of questions extracted from questionnaires submitted to ConveyorAI. Each question includes the bot's draft answer, the final human-reviewed answer, grading data, collaborators, cited sources, answer revision history, and metadata about the parent questionnaire. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List subprocessors via GET /v2/subprocessors. List your company's active subprocessors. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center conversations via GET /v2/trust_center/conversations. List Trust Center Agent conversations. Returns conversations between customers and the Trust Center AI agent, with nested messages and referenced documents. Use this to understand what prospects are asking during due diligence, which documents the agent recommends, and how conversations flow. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List Trust Center feedback via GET /v2/trust_center/feedbacks. Returns paginated Trust Center survey feedback responses. Authentication: API key or OAuth. Requires Trust Center Designer read permission. `dataroom_id` is documented as required and is NOT enforced: measured 2026-09-18, the route answers 200 with no dataroom_id, with a zero UUID and with a value that is not a UUID at all. Get the id from any folder returned by the list-folders tool, whose `dataroom_id` field names it. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

List subprocessor-change subscribers via GET /v2/vendor_subscriptions. Lists all users who signed up for subprocessor change notifications on your Trust Center. These subscribers receive emails when subprocessors are added or removed from your vendor profile. Authentication: API key or OAuth. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Ignore a Trust Center access request via PATCH /v2/exchange/authorization_requests/{authorization_request_id}. Update the status of an authorization request to be ignored. `status` accepts exactly one value, `ignored` -- this dismisses a pending access request rather than approving it; approval is POST /v2/exchange/authorizations. `reviewer_email` is REQUIRED and is recorded as who dismissed it, so it must be a real user in your organization. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which is the only form with an unambiguous encoding for the list-valued ones. NOT measured on this operation: it validates the path id before its parameters, so an id matching nothing answers "Record not found" whatever the body holds, and no real record existed to test against. It rests on the same behaviour measured on five sibling operations -- Conveyor is a Rails application and merges the query string and a JSON body into one params hash. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Revoke or re-scope Trust Center access via PATCH /v2/exchange/authorizations/{authorization_id}. Revoke an authorization or update it with new access groups. DESTRUCTIVE AND IRREVERSIBLE. `status` accepts exactly one value, `revoked`, and it ends that person's access to your Trust Center room -- nothing in this integration re-grants it. READ THIS BEFORE SENDING `access_group_ids`: the list you send REPLACES the authorization's groups, it does not add to them. Naming two groups REMOVES EVERY OTHER GROUP the authorization held, and an empty array REMOVES ALL OF THEM. To add one group, send the groups it already has PLUS the new one -- read them back from conveyor_get_v2_exchange_authorizations first. Classified destructive rather than write because the HTTP verb is not the effect: this takes access away, while its sibling POST /v2/exchange/authorizations only grants it. MEASURED 2026-09-18: an id matching nothing answers 400 {"error":"Record not found"} while an invented sibling path at the same depth answers 404, which is what proves the route exists rather than the id. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which is the only form with an unambiguous encoding for the list-valued ones. NOT measured on this operation: it validates the path id before its parameters, so an id matching nothing answers "Record not found" whatever the body holds, and no real record existed to test against. It rests on the same behaviour measured on five sibling operations -- Conveyor is a Rails application and merges the query string and a JSON body into one params hash. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Update a Trust Center document via PATCH /v2/exchange/documents/{document_id}. Updates a document. The document's FILE cannot be replaced through this integration -- Conveyor's `file` field takes raw bytes and this build ships no artifact transport, so it is not offered here. Everything else about the document is editable. At least one field must be sent: with none, or with only a field Conveyor does not recognise, it answers 400 "No update parameters provided" (measured 2026-09-18) -- one of the few routes on this API that does not silently ignore an unknown parameter. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which Conveyor reads identically (measured 2026-09-18 on this operation) and which is the only form with an unambiguous encoding for the list-valued ones. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Update a curated Q&A via PATCH /v2/knowledge_base/questions/{id}. Update a Knowledge Base question answer, verification status, product line assignments, question domain assignments, question tags, curator, or any combination of these fields. At least one update parameter must be provided. At least one update field must be sent: with none, Conveyor answers 400 "No update parameters provided". The three id lists REPLACE what is there -- send an empty array to clear, omit to leave unchanged -- and an id Conveyor does not know is refused by name (measured 2026-09-18: "Invalid question domain IDs: ..."), so a 200 means every id was applied. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which Conveyor reads identically (measured 2026-09-18 on this operation) and which is the only form with an unambiguous encoding for the list-valued ones. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Update a questionnaire request via PATCH /v2/questionnaire_requests/{id}. PATCH a questionnaire request in Conveyor. The id goes in the PATH. Conveyor's documentation records this endpoint at /v2/questionnaire_requests with the id as a parameter, and that bare path answers 404 (measured 2026-09-18, against an invented sibling at the same depth which also answers 404, and against /v2/questionnaire_requests/<id> which answers 200); this integration sends it to the real route. An id with no matching request is not an error -- it answers 200 with an empty `questionnaire_requests` list, so check the list rather than the status. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Update a questionnaire via PATCH /v2/questionnaires/{questionnaire_id}. Update a questionnaire. Provide at least one update field. Setting status to completed sets completed_at and triggers grading. `notes` is accepted and does not come back: measured 2026-09-18, a PATCH setting it answers 200 with `notes: null`, while `due_at` on the same call is applied and reflected. `status` takes only `approved` or `completed` and names the alternatives when it is wrong. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Update questionnaire questions in bulk via PATCH /v2/questionnaires/questions/bulk_update. Apply the same update to multiple questionnaire questions at once. Provide question_ids and at least one update field: assignee_email, collaboration_group_id, unassign, or reusable. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Update a questionnaire question via PATCH /v2/questionnaires/questions/{id}. Toggle whether a questionnaire question's answer is reusable by ConveyorAI for future questionnaires, assign the question to a user or collaboration group, or remove the current assignment. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Grant Trust Center access via POST /v2/exchange/authorizations. Creates an authorization based on an email or an existing authorization_request. ACTS OUTSIDE THE DATA. This grants a named person access to your Trust Center room and Conveyor emails them an invitation; nothing here can recall a message that has already been sent. It is not classified destructive because it deletes nothing, but treat it as irreversible. Give EITHER `email` OR `request_id`, not neither: with neither, Conveyor answers 400 "Email or request_id is required" (measured 2026-09-18). An address Conveyor cannot place in your program is refused by name, and so is a room owner. `email` and `request_id` are an either/or: Conveyor's own schema marks both required, which is impossible to satisfy as written, and each field's description says one OR the other. Send exactly one. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which Conveyor reads identically (measured 2026-09-18 on this operation) and which is the only form with an unambiguous encoding for the list-valued ones. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Create a Trust Center folder via POST /v2/exchange/folders. Creates a folder. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which Conveyor reads identically (measured 2026-09-18 on this operation) and which is the only form with an unambiguous encoding for the list-valued ones. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Create a curated Q&A via POST /v2/knowledge_base/questions. Create a curated Q&A pair in the Knowledge Base. Requires the "Write" Knowledge Base Question permission on the API key. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Create an RFP project via POST /v2/projects. Create a new RFP project. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Export a questionnaire via POST /v2/questionnaires/{id}/exports. Request an export of a filled questionnaire. A `csv` export completes immediately -- measured 2026-09-18, the reply carries `status: completed` and a signed `download_url` in the same response. `original` and `summary` rebuild a document and come back `pending`; poll the get-export tool until the status is `completed`. The download URL expires after seven days. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Answer a questionnaire question via POST /v2/questionnaires/questions/{id}/answer. Write or update an answer on a questionnaire question. Creates a new immutable answer revision; the previous answer is preserved in edit_history. Requires api_questionnaires with write capability, the same permission as PATCH Questionnaire Question. At least one answer field must be provided. Errors: 400 when no answer fields are provided or the question is not found; 403 when the API key lacks api_questionnaires write permission. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Create a vendor review via POST /v2/reviews. Creates a review with optional references to external VM unique IDs. Creates a vendor review record. `email` must be a WORK address -- the vendor rejects free consumer domains. MEASURED 2026-09-18 that this route reads a JSON body exactly as it reads the query string: with an empty body it names `email` as missing, and with `email` in the BODY it advances to naming `vendor_name`, identically to sending it in the query. That is why the emitter's move-to-body is safe here. Conveyor's documentation lists these fields as query parameters; this integration sends them as a JSON body, which Conveyor reads identically (measured 2026-09-18 on this operation) and which is the only form with an unambiguous encoding for the list-valued ones. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Ask ConveyorAI a question via POST /v2/single_question. Answer a single question. SPENDS THE ACCOUNT'S CONVEYORAI BUDGET: each call runs a generation and is recorded as a one-off question with source `api`, which the list-one-off-questions tool then returns. Measured 2026-09-18: a question against an empty knowledge base answers 201 with `answer: "?"` and a null confidence, so an unhelpful answer is a 201 rather than an error. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.

Add a subprocessor via POST /v2/subprocessors. Add a subprocessor to your Trust Center vendor profile. Provide either vendor_name (preferred) or canonical_asset_id to identify the subprocessor company. `vendor_name` must match a company Conveyor already knows: measured 2026-09-18, an unknown name answers 400 "Vendor not available, contact support" while "Twilio" answers 201 and fills in the canonical asset. Conveyor's own spec marks only `description` required; the live API additionally demands one of `vendor_name` or `canonical_asset_id`. Conveyor reports a missing record as 400 `{"error": "Record not found"}` rather than 404; a 404 from this API means the ROUTE does not exist.